{"report_id":"dcb8b460-cceb-46a4-beda-092a4a47f24c","version":0,"status":"done","tags":[],"date":"2026-09-07T00:33:07Z","url":{"schema":"http","addr":"g36b.top/","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.132","port":0,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"g36b.top/home","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"title":"welcome-BET365","dom":{"size":490864,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (49937)","md5":"dea02377607bb55fa1dfd90989b745a2","sha1":"c6f4adf7bb55f8ee6ce4c7130d631d16c88b6ff5","sha256":"3a102ef4c3d89f7f2892dbf3930af915e753bf83457b64073c43ff8632cad009","sha512":"34c581d4df391d61e65ace5e032d5aaa6f5fc7f0046ebf3aa49d9653403ef1970ea4e401de2cb5bd355a136dec97263e34625307da684eaede3d55f8bf959b08","ssdeep":"3072:8X8Y838J8j858C828k8rd0HEdX183TO1l/TMIlPXS1V7:w8Y838J8j858C828k8rdaE5183TyQIs","tlshash":"c0a4e8f4825d02b2e54bc7cdb8766e6636e2315befc60608e3ed4691afe2dc2d419c11","dom_hash":"domhashcc22f0aaf4c6ac49d869f0fc7fc667ce","first_seen":"2026-09-07T00:33:21.593146Z","last_seen":"2026-09-07T00:33:21.593146Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"g36b.top/","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.132","port":0,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-12T00:33:07Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":6}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"img.esportsdata.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"g36b.top","ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"domain_registered":"2026-08-28","domain_rank":0,"first_seen":"2026-09-07T00:31:46.952045Z","last_seen":"2026-09-07T00:31:46.952046Z","alert_count":700,"request_count":140,"received_data":10226679,"sent_data":80278,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"photo.365live88.com","ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"domain_registered":"2022-08-16","domain_rank":0,"first_seen":"2025-11-02T03:06:46.95373Z","last_seen":"2026-09-05T09:19:12.084101Z","alert_count":0,"request_count":148,"received_data":6790425,"sent_data":86136,"comment":"","tags":null,"fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"img.esportsdata.cc","ip":{"addr":"104.26.3.221","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2023-06-01","domain_rank":0,"first_seen":"2023-07-06T16:47:53Z","last_seen":"2026-09-05T09:19:12.337559Z","alert_count":4,"request_count":4,"received_data":90919,"sent_data":2316,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"g36b.top/js/22872.1781011881923.153832d9.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"f9ee602f8eeb24db94a45e276eb229fd","sha1":"add3d7dea3c94842531e4e52db7b334a705c5e6b","sha256":"3d79813c4166473dcbe19eb56d456a226f183993f5aa4108a4fccae156001245","sha512":"8ad5674af4bbf338d1188a8108d0984786a4c94afddefbd592dbc428928dae301e40d4a936d73d0e29ba68989ccd13abee0988a8a6938495736115c80a53eae7","ssdeep":"3072:XHW7tB4Vgj5tNlxyU5YegxYffj7TEOiGzZl+DJVkzEcx1nKs:XHW7tBwgttXxyUtffjAGzT+DJVkzEcxF","tlshash":"21f31bd4f2c071f6475f45f2a22b0075b26f4d92318c98b0e15ba6597f21a48c7abeec","size":157599,"data":"","first_seen":"2026-06-12T19:29:57.267326Z","last_seen":"2026-09-07T08:08:08.15899Z","times_seen":1208,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/index-a3dad144.1781011881923.1093b11d.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"0fc0f4a0379e369b442d93ffb72561fd","sha1":"497d95fced30bab2efe9ad3a561c35cd40ad5e9c","sha256":"da926a537d946d3158d41a8531082a740aec7a6a4e3b98599d35546182f20806","sha512":"ef5664991d7fb472281b2696b3b25a322bf51f9bcbccf2043f77fdb67ca9a84d90b893029e93bedea935724bbc4b58a77154b35ac40b15f8e691b539cc3102e3","ssdeep":"6144:LrbhFOufhu/LHEY/T8CPis7lVV4YlRlNsmq9D7:3zBw/LHEY/TBas7lVVhsp9X","tlshash":"ed742b90f76ce1bd875e55ff7a329094902c1b41b0c89e58d29e2944fe6b385eeb04bc","size":356584,"data":"","first_seen":"2026-06-12T19:29:57.253128Z","last_seen":"2026-09-07T08:08:08.266828Z","times_seen":1193,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-09-09T05:26:45.635986Z","times_seen":754356,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/83876.1781011881923.7ce40e6b.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"abf84df30621edc23a82d05ff0b8a83a","sha1":"e727ad94ce5d5f5b8fabec0e0b5a966fb6e6594f","sha256":"c3b02d056ac034939c3ff75a10a2da23f5f05f96a36ca1e5cea2157ce0fe12be","sha512":"db2a2a00f51cc6f75cfcbb6d988df74403fae93255982a054710e5f87a2d8407f4f8f02fef8ef1a0e5edb289736296b2d11a3b77cad6c6d9089bb831cda45be5","ssdeep":"6144:0/rOTU2/xB0Jjytg7DiQPkcsz1aL3p2YO+WidjHrrL:0iUjytgPJPT3p2YpHrrL","tlshash":"2f442c44b291f0b8879b42f7922b4056a17f48a1308cacb4f265f990be7555c927fbfc","size":262269,"data":"","first_seen":"2026-06-12T19:29:57.272405Z","last_seen":"2026-09-07T08:08:08.234968Z","times_seen":1229,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/65246.1781011881923.03480a32.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"b98dafd31fe547add2f96acf9bea9922","sha1":"e63706f4b83ed72ce8a0ffee74c7d606968bd280","sha256":"92014e9ab9f7e62a6651d0a69b63f69a84ed58e15ee5dd8e287d46b28fe610cc","sha512":"a676475f44bd6ec6ab9e7421deb8c29430404be3852f96d012418d03e9135d3ec450ee58b4871a4f8ed2a053656c9a9a6523853d6238d701144d9b72c6df8ab8","ssdeep":"1536:f2+iDvYvNjx4Uyao0L8oDNzAuMMsTAQ0mqt2pXYzA4dANVO:e+iDYvPo0L8oZzAuMMsTA7mqt9zA4dAO","tlshash":"a673a501f78272385fa7e290220f2026e16e191505ac5ed8f179ffb93ef0954aa7d7b4","size":73415,"data":"","first_seen":"2026-06-12T19:29:57.345997Z","last_seen":"2026-09-07T08:08:08.100114Z","times_seen":1162,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/home","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-09-09T03:48:04.101606Z","times_seen":94064,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/chunk-svg.1781011881923.7ca9cdc1.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"2e885a50d7dc711be337a96fe33f0c2e","sha1":"8c767dd1bdcbf35f2577bd215ff6fe495cbd0f43","sha256":"603d14d58a247671742688b96c517d62e9c636443b960bc421af5352df4c01f7","sha512":"09289e06b0db84915693f0b78ab40149972b29693d0d6b1e66e4fbe9bddf00380f5f4e8e78961512d91a132226494572994ceade62d3d8a878126fdcdeb8fd95","ssdeep":"3072:/8nz2uaLZSZvx6Q/sIPrekK+mB6Ua94sRZI7gbpF/:/8nz2uasNxpXPrekK+mB6UHsE4pF/","tlshash":"c0a4fcb4c190f4edf704ce196e7c9e1c50321688e0a9e9e52da9fe0d9e85d6b241cdec","size":470763,"data":"","first_seen":"2026-06-12T19:29:57.244213Z","last_seen":"2026-09-07T08:08:08.174729Z","times_seen":1243,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/config/initGeetest4.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"87855e19802d75b55afa7bcf3af515c1","sha1":"4af373375728a98d623f2299a68a91e150f2672e","sha256":"9ec8a5ef8c8ffe369dd1a5c4730dce6570c0d90955798c0be4ac04ef1c8f4baa","sha512":"3baa6d9e916abfb3d38b7ebb9372c5987e8f10534bb978383751c0094f8f5a3e764f9b8e44a73d9d4871cbaeca7e1939f0ffaf9499af5c4a71f64c3588167d85","ssdeep":"192:23aP8Ha0D+Nu5dq+EvNiqc4K25MB5VYaiQwSL4SScQVy8QRHIsGiz0iX9rES6Myy:2fe61w1iXKb2sMGUI+KQTwwHlB","tlshash":"00621d0d68f764534553b4388b9fb014b5388a53042cde41be9ce354afa843d9bbabdc","size":14975,"data":"","first_seen":"2026-02-16T20:32:40.162764Z","last_seen":"2026-09-08T23:44:55.19034Z","times_seen":2213,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-09-09T04:45:55.472295Z","times_seen":239225,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/home","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-09-09T05:26:45.635986Z","times_seen":754356,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/home","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-09-09T04:45:55.472295Z","times_seen":239225,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"2bbd69200a3d758f89e8076a123ed982","sha1":"dfe2d66f2d85ddc2008401ed15dcba3515392f37","sha256":"b79cd0c532adb639e6139c9394527b217982efdbff4969494986edacd943e2b7","sha512":"ffb7e75ea86b911ed842f7525c08ad5cd4ef5085736e757c47f3b4e09b3c9497dad089fae69953dd819f57b3ac1cb3a54ba037f9a8ad3fa37d7aeac9ac36bcb3","ssdeep":"","tlshash":"07c0c0770f2c7f14110310230174f3ac5431c028fc15b302331f40018b50b0d0c30e40","size":178,"data":"","first_seen":"2026-05-25T23:43:55.293244Z","last_seen":"2026-09-08T23:44:55.218194Z","times_seen":1411,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"da7d6cf21ba9b37cce394593785671f7","sha1":"aabeaf8e874da29cee7e1645707577446b8de63b","sha256":"6912a38811267077bd6dd2630bccd25ba04b653b4967a636d75a6ec97c5bd2fd","sha512":"9739d97867822d248e0083a78d8657485d85e70bbb7a75e0fccd283c2bdb980ded0ea78b1a4fb0540c529e602ba88286021df0553bb23e45fc91281f64a4db49","ssdeep":"","tlshash":"de31ce286eb29531a413612a1f6ff2843235d62f3148ef003f0cc7651f24d6ba6356d5","size":1686,"data":"","first_seen":"2026-06-12T10:00:06.928319Z","last_seen":"2026-09-08T23:44:55.235615Z","times_seen":1341,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"a15b4803f5b926cf35dd50ad665005e3","sha1":"0dd0dd998736dc9db4ab3c7ee8f7cabc8e1e341b","sha256":"201c5550359d1e530619f58a4f77bfbe382200e2b0c85d4136df96523aee625b","sha512":"e21d282a7abbc3b8aba31153d7969b54c647e3c2bc2f1c786a6f3894ee0322540fc37d99351e5d8998991198a98b26c470c16fef19e5627cff75e0a6157f6e2d","ssdeep":"","tlshash":"b7700000be08a0a80000a0202828080c280238a0803b03080802c8023aa8c80288a802","size":24,"data":"","first_seen":"2026-05-25T23:43:55.294961Z","last_seen":"2026-09-08T23:44:55.236947Z","times_seen":1411,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"8f54a6c689ae3fb37bcded37e79fea08","sha1":"0861325faf70167325da7dfd6b4059a6991136aa","sha256":"c9a960988ba6d8cfea2c7e709385252a139280898d9b4010703981ce03184a1c","sha512":"08111d473c9567e7da677c4a5e61e232f670b58e2bac4f1a1d96005b83214368e6bdcf36efa1b99aa4708beb8a11bb3378270d70d1a8faa3b2fbea3abb10b4e6","ssdeep":"","tlshash":"82700008ec0088ab0000a00028000cc8380a00208a3b838f8a00008a2ea28b0000ac00","size":24,"data":"","first_seen":"2026-05-25T23:43:55.29586Z","last_seen":"2026-09-08T23:44:55.23819Z","times_seen":1411,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"c45b02b1f350ecba8716f39faa1d6dd9","sha1":"323d186c69f92adfbf21ac33010643886a3ada59","sha256":"81d9bb79dfb8f66568da929cceb338198f5fb8ef0d422c9bc19a97944981d729","sha512":"6cb26d6b01335a5779cf876ebce242b675745c80857fe191e0f42b927c5b8c40ff0896f64e6c28640c9bc1d9380344c6282790f6a7341d5ab74eba28fe93f4d2","ssdeep":"","tlshash":"eb017d9e483788107b2225bd537f5089f1a2516f8e8bcc103c1e5b00eff48ab25a2bd9","size":738,"data":"","first_seen":"2026-05-25T23:43:55.296647Z","last_seen":"2026-09-08T23:44:55.239166Z","times_seen":1411,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"077d4be9ad272f7d475481152daff715","sha1":"2f46a2943ac225687c445e0416015d1f97b7f0a1","sha256":"8d289c243d18cc7608ad59bd1b5d4c5edc5a26521213972903495b5ce1f78ff7","sha512":"310f88318435a5cee999868c4f24f906af4f7ba99540a2a5bf79b68f1cc1dc5fcd84b3c45051e8bc2e8ad3e36873f746fbd95aa84b6b92a27a76c5c84fec37d3","ssdeep":"","tlshash":"ac41027d826245a51973346a1f9e730836f340b31149e9113e5c8a802fa9a5f82b7bfa","size":2321,"data":"","first_seen":"2026-05-25T23:43:55.297422Z","last_seen":"2026-09-07T08:08:08.46442Z","times_seen":1380,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"e2d3475f1cf5b92ebde88c18cfb52625","sha1":"b178b44e61169b2fc5f25b0120206d3812b19cc1","sha256":"3a448e6329733e72eb2a1d80d1897a5ddf20226acbafb032eecdf71d83fe307a","sha512":"802939763c96de22534a93d89f00066ef7cd4cf58814954ebaa18ad6e77aaf19e99745c8a677625be818d3f378e5fe285ec537561be58e12504a1f3eaa23f363","ssdeep":"","tlshash":"00f0a00e0ee548131963706a4c0f9201203b2513414eea08bffe9bb24f92a6886174cc","size":538,"data":"","first_seen":"2026-05-25T23:43:55.298337Z","last_seen":"2026-09-08T23:44:55.24096Z","times_seen":1411,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"196e0f8d81dba38fb58a2eef3490451c","sha1":"4c70fb540d5f49bd92603d0cccd3005fea9b4c4f","sha256":"eabeb94d65d8704477ca411952b078a4fde998d61c9b3cb12b6940389dadfd90","sha512":"17596a9ca2ed22c2f13f6ec692ae8c32bc6aa1a1a4c7a888639c8ea5f2596a16efb37dcbd14bbc8b514c8bce98bc3f7ace246f5fdfe4070417cd670834883566","ssdeep":"192:q2wqx5Cvtib5XOQRzlaECoXZTAoV51nsPhwzvBa/id3+36a/E/97g6I52MdobsIS:q2VwiYwJvSoVXsp+pa/iZcVk97g6nMuQ","tlshash":"78322b69a5b71bba25673036277f301889b080630319fd947c0ff61e4fa54366297be7","size":11902,"data":"","first_seen":"2026-05-25T23:43:55.299247Z","last_seen":"2026-09-07T08:08:08.465972Z","times_seen":1320,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"4429af1150d1fa3b53d1df1756276b64","sha1":"1921726e78a10af853be137ddf92f3d86deda32a","sha256":"2f7789347336fe8f5baaeba0f2285060e84c161bd59ee0aa3c7d8c47cf27d580","sha512":"416f1e1d8ee3a03067609ca187a88c5e3a77cb751e8769f902a12c6115e6394121254e4d60e469c50ade2b044dff176c0f7ef93912c563c510279de31d61823e","ssdeep":"","tlshash":"0c11cc5a99e28132aa5b303735bd43887728a023d184df413dcc99456fa8da5cabf6c4","size":930,"data":"","first_seen":"2026-05-25T23:43:55.300055Z","last_seen":"2026-09-07T08:08:08.466726Z","times_seen":1320,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/chunk-init-1656f0b4.1781011881923.32336986.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"149a9a32eef525724cd200e4dce7a032","sha1":"29b091925cae6d90319391653e40685f6e6c5735","sha256":"10fcb7c4e44a141964cb31c527462c6e56f78d95c956fb02c50c61fc576cefd2","sha512":"62d80403786c13019e86e1c6b991d73cf52ff5bd25d4eeaec34ca12125d677604a269fc6c56ef301f074c42798f8e7935df623d6a0a62559d70749e53082085f","ssdeep":"1536:z2twqIPBoVbzfsO9ZuqpiXXIOU6Qgpp6KkB2EnBDsAxdrkm4SgiqvHynjM5TCif9:z2twqhOIK2nCLdyACifMur06/D","tlshash":"6dd3ec54b7d0b4b442cf13e6711b2475e3a61ca22058e8f0e31dee647f35689d26faac","size":136038,"data":"","first_seen":"2026-06-12T19:29:57.333908Z","last_seen":"2026-09-07T08:08:08.264184Z","times_seen":1241,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/chunk-common.1781011881923.b470d60e.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"08afa88982cffd7b96a2190cdafe1c42","sha1":"abb87563ff4cd658f4436118c54f3f39c08f74a4","sha256":"8673d3fc3524eb9d8b4020b3da3109aa5ab5e569ed8d0074f2b72b8643f813ae","sha512":"70c9df3dd7b3e3d41a607627c6a2750f43673649dbd55c7a56606a7d3e67382cb2991f146f7ad2359cc5ff1615f9db484b54642917150351017d0fa4385c3d2f","ssdeep":"1536:jBY8bgGcdWUa2UTY6eryXHuLmbErF/G7D1dMI59H64likx/vocGAClVbGD3tFk7u:jBYCRTY6wjFetH64liC/vocGAcgD3t","tlshash":"65f3e8c5b3a0f07e9a1ed53779331499b12f758274c87c60f1a1ade6bf1a704a436ca8","size":161286,"data":"","first_seen":"2026-06-12T19:29:57.317434Z","last_seen":"2026-09-07T08:08:08.071679Z","times_seen":1239,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/configPage.js?v=6/9/2026,%2021:37:10","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"e6aa74bb352ef198ba3e1c9a4b01b014","sha1":"2ea8bd6b5045475a36432f7665a129728e822d9e","sha256":"73828e873c0b6e847b37d78941ca436247471dfc90a12f743964f869f75abd5c","sha512":"2faaf24fdf1e4da637af8e9f82d1778bf061b00752dfca0c8f73432ba236a7b69410a7ad2a73727bc83e6cd631fd6555c3cc0d9d3a5d8a7f81818dd66566011f","ssdeep":"","tlshash":"be117aaf57444dffcf1d7e00a08b0a5ea8bc61d261889d4da8e9cf29e1c99002378978","size":949,"data":"","first_seen":"2025-09-04T00:49:32.949926Z","last_seen":"2026-09-08T23:44:55.151667Z","times_seen":3024,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-09-09T03:48:04.101606Z","times_seen":94064,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/config/gd.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"368318100a3c0f64373230a250953d5a","sha1":"6e0d91639cafd23f1b22aecee332da83c70b93ea","sha256":"dffc9b203a19b9e70363f75f737b7afe2164d6b8c045800d4dd7931d9093aff4","sha512":"91077ca792821795a816a0ee1a9cef242bf2915c02402706c7bd5c027c62f4bc52517b6a5e3db9f4b873e5a3c9d652758cc277c1f5ba07dc12e0d69b4f6e9eeb","ssdeep":"384:bJA61XVpi5LH4NmeJPXwXkQdcAwR0Nw3zzbSGwYg1C:bJA6BZX+oJjzzgY","tlshash":"80721f4d68f7905345a3b03c8bafa114b5388643181cde457e9ce394af6843d97babdc","size":17440,"data":"","first_seen":"2026-05-19T02:14:56.346288Z","last_seen":"2026-09-08T23:44:55.048931Z","times_seen":1411,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/21954.1781011881923.57c97863.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"35aef3c03c45b75cc6c2851265c30f23","sha1":"54874afc1d2d6391142418c6c17d7639247b6c9b","sha256":"c7a0283f3d2fde40ce97fe3bb5e79621f9939000c50c3c781a4597c3242ebae2","sha512":"f74356629d65ff26f6928ad3183ba8e6e01848921202f9c14c5aef758ef72acdcabf523209e892df42d230d9c87cb47cda7bd106105ed8447718fc502b2d71db","ssdeep":"768:U/aSfmzKrMdvf0eMQ/96loumY1PI1yBK9LudEz+yUy51y9y0yk6Dio+ILqpTeY:z81R6Ipyk6o","tlshash":"33132088fac2b06dd3eb7330857f505ae66a1dc0668c5434e260d6917e7198dc1fb9f8","size":41946,"data":"","first_seen":"2026-05-29T16:01:53.086335Z","last_seen":"2026-09-07T08:08:08.429388Z","times_seen":1212,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/31098.1781011881923.4108b3dd.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"3c55e2f7f495cd530603e700dd3bf229","sha1":"fdcabc58e872fde99b7d704711a75bc32cc2b8c8","sha256":"1c38b781ee4a302e955baab7d3306365881227cafc2814e1085f93f4ab0342d8","sha512":"94954c49e71bd95a7543f652e03bf68b5dd26d00b33c91eda9003ef81e37aa5735e846bc9322d52181550f0d010d125479a73d83dec0fe51fa0c4f2489108326","ssdeep":"1536:Z+0YvC9jlTKAUSseG1SY46DCdlBBo3AgXOG9AsqCfCXsvCfCXsLCfCXsyCfCXsfX:sKK5sY4brG7O3SnLJNpL","tlshash":"6174b6f4c248c6fdea04ce0a7e7d6f2d50723783f2ec56c446aaf8865e92857245c4da","size":352738,"data":"","first_seen":"2026-05-19T02:14:56.370466Z","last_seen":"2026-09-07T08:08:08.154579Z","times_seen":1195,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/config/telegram.js?t=1788741139362","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"4ef2154bcfb8399f256c2da15a4cb409","sha1":"e0f8f5578b2e0773ec1d79bb1cec54e1f5d6373d","sha256":"73fa4926373755b52fecfdf3145a0c9953c08af374ea69dda46fe2b3b9ddb022","sha512":"8b64643161386bdefbb7eab04416e78e5e183c50acba7b25b146aa6e733744a326566a01eb7eabb1a0a3f5b87ac8461a7ab3b9ad1c44de37ecea25af09e3eb41","ssdeep":"1536:WK4KZK+Klt3LbbdS4V+vO14KtA9phXTQ+fcZl8LDh7j8d3K+V4WMrnf/NunqxF00:Wj+dgdLbbdSA+1XTQRZ1jSBl","tlshash":"14b31c4c5cf3216285a7b1be8b9f925072759893304def203c4d9ba45f98d3c53eaad8","size":116886,"data":"","first_seen":"2025-05-31T08:16:48.368096Z","last_seen":"2026-09-08T23:44:55.185793Z","times_seen":2648,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/83749.1781011881923.02b71cf6.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"c1d2645de169d30e7a814fdbd1c1a47d","sha1":"41959bb5171f196d813c4b3c27bb3135d993ff43","sha256":"a400126839acc7fff4ce08e50633afc5560f3eb3e8aae7ec697fff30423bd26a","sha512":"21e02eeba3e71baf0938766c7abf83b68a4f54b149ea679f43c221c429729dacd395ed0e54233ff22be739636dcaf0104cd58083c50df9b6c521fcb2c3e27419","ssdeep":"1536:lcK/KnqHB3vmxuHXvKe+Gruc7iSxTcgOX8JwTl0sI5pQiVFFsdt+H+Xk:rB3vywXSex7HYgOXawTl0sgQi2tkwk","tlshash":"3693e7c4b5f4f5f8279ec5a2973644b8b02527c5b1c8ace0d2e96e147f19b62b0718bc","size":91749,"data":"","first_seen":"2026-06-12T19:29:57.252198Z","last_seen":"2026-09-07T08:08:08.217425Z","times_seen":1162,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/45540.1781011881923.25dfba7d.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"7983a109fba451279f84fe7b75724983","sha1":"9487dc955240c6083cf3497e806dff89bec2061f","sha256":"80bb5c781336a9095ee3e8ae99d724f58a409c7f3c159bf0f320a9c948afe030","sha512":"ddf49f5cfb4721100ef951228391607209e248a8733d48229ff5196fd8a32fc3e759d90c1040dd591b1c0bd97ab83a1c8baaffa70fa96bbe2d556af2379478b0","ssdeep":"6144:1YD4wFsYiSGfKnCKPP6Xm9sm3MCln1OSgpozfEe5a:1YD4wFsYiSAKNH3TY5","tlshash":"e724f894f294f1be075fc1f1d23b501af35b5e6120cc9ca0d296e6942e20b49da77eac","size":229366,"data":"","first_seen":"2026-06-12T19:29:57.328205Z","last_seen":"2026-09-07T08:08:08.223991Z","times_seen":1237,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/theme.config.ef94991b.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"90d279a2980268d2835cec593c23d286","sha1":"4374bf6da5cbdf8f025434137487bda68077cddf","sha256":"1679f19badc24dea0edab376edfb8583714645e18f705fb849037af6cf0b3ff8","sha512":"362ec1b73cebe1ad224a5b745c9ceebf2b86301deab27e35d6517d499499328b34c24d76a72e5b348d623e64a4d17bfa0ab08d2aa012f02af23c6a72df51817f","ssdeep":"1536:D2JREobVmtlIRM4Sb2mcTa2mnzyJog9CcHWHA:qEtlGu1Jnz45HT","tlshash":"c0b3bb7ae20c963a6177a8bfb46ce111d12f9c0c9b1d5fdef03e60a25710669c831de9","size":108079,"data":"","first_seen":"2026-06-12T19:29:57.324936Z","last_seen":"2026-09-07T08:08:08.216605Z","times_seen":1248,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/chunk-init-c0d76f48.1781011881923.0f397bb1.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"815f2acbd0918250f25d4f71409219b0","sha1":"d5778078df7eada22b3175f9182b8b22e828c433","sha256":"12a61f287da39190db34dff1de7188c3d8b76ffbd1c11290962db88fd5e2ab46","sha512":"5ba4adaf4b36b4a402c30c3aaa5be5f02e292391d79400d353a5ca6c61405cb40e5179858abddb1af6dad243899e420111e49004d01d339ce9de23d8f522c379","ssdeep":"1536:zG5qxPvO2lSV822bv0bcbpM/igw/aIwC23QOoKILbjxo4wc0tvB6xVS/J+pKY3Ns:iQz/Dp5/92xoKa/x5wc0dB5/J+UU0","tlshash":"5ef31b987392b1b847dba6e152371075b57e1dd73088e8f0c169a6803f31a9cd52afec","size":161226,"data":"","first_seen":"2026-05-11T06:12:53.502908Z","last_seen":"2026-09-07T08:08:08.385656Z","times_seen":1243,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/index-399e2569.1781011881923.9d909473.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"a89a32dae8cc80557b581a69e02f0d02","sha1":"00f9cfeca127af0a139c0670ed8d2e2e7ccf673b","sha256":"6f97c8ce9605a8e9e80a699696c70ec26a4b9bce20badaa6947bf4e5ac52e9d2","sha512":"2ca5bc054575932085e6cd6529613a94f145aa9a3b7731fb85b97b27286a882043110ab45b7eb4673228185ce1560b47968d3aa7b77492f17abf82e778076a9b","ssdeep":"384:pZTANHmDGIaVPkrTBTcK8K+Ehn6A3zgJ9Ks/fT5qZsxbt85F3oWf0Af/nwtU8Zci:znDGIYPkPVf8K5hn33UnKofy5FYxAfPY","tlshash":"e2b2b6e63392bdb8c24f9676f23a58ecc43f9141c30fc4f8d265bd947d98644aa92784","size":23775,"data":"","first_seen":"2026-06-12T19:29:57.227313Z","last_seen":"2026-09-07T08:08:08.428383Z","times_seen":1211,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/60024.1781011881923.e9a203dc.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"ac04ba4305a374571b2d241fe1f50dc2","sha1":"e559b9a0a338e35fb6605942f7d14e96c031ae71","sha256":"788282499d13bd0bb6207ed41a15a3d0b2058ca97003d1e1a872e81401f02aa7","sha512":"6edc613a3f8585bf6cfb8c034199265c1c1daf368d0d3a6e2c41bf441a334a7f93139c0b0fb4147b98264567be9b135fab3cbe923e8fe040ec553e9fec04c8ae","ssdeep":"96:UR4NFRSZqe65bD7RM/Rsxkw9usN6tKex9sX2NaenPdqUDDEz:UR4NFRSZqesbD6Rgks0RxeX2NbnPdqUE","tlshash":"3491cbd876d2f071426f9678862f285fe27bead074ccb415d1c1e690aef062d8933d68","size":4601,"data":"","first_seen":"2026-06-12T19:29:57.341024Z","last_seen":"2026-09-07T08:08:08.185422Z","times_seen":1164,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/home.1781011881923.a94e73ca.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"7ad9af47a2c0c93f65e42ff84b45dad7","sha1":"eed3b4bd1191c75416f457ee41317595880f8635","sha256":"c9d64aef33c7a35945a5963b08b2bc3157f403dc91a5c9c9463c82a0d4075af6","sha512":"757a63f9b96bc8a36491424f8e0ae9fd6813983817ab2da87bb3455e18b5cb5f71d5e682919941194e4a588bea925c790888e4d27f8531ee03c777c1e2c92678","ssdeep":"3072:T5daS9tSIMcewi8uJBuoMfqFf2GMkvVJuhxffj7TEOiGRlc:T5ES9tSIMcewiLQqFRmzffjAGHc","tlshash":"93141880b5f0e275575fc2a7d7371025b2271786d0ccac60e1f66b187e2879ab236db8","size":203243,"data":"","first_seen":"2026-06-12T19:29:57.277471Z","last_seen":"2026-09-07T08:08:08.456638Z","times_seen":1182,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/35142.1781011881923.1d227afa.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"8325235b613820a57b71043f360e5b36","sha1":"925ff977edf9892e868d43915f93d29e6feeb113","sha256":"0c505f39a463b09ece16c213b7ead75186dcdc26d25ee02dcba5a62cc0dff7c6","sha512":"efd16c9b7ff0f806890ae77542e8c0d4e954f8c797ff21b8dcde3f240e4940ca3c6d0fe75ee2fda35bf53ff5d0eb691fa7e38cfdfa82c0f231b0cd57458fbcf2","ssdeep":"6144:N0hEyLkbJDb7w/1FOAmBm7cene7Ancbt8sbyAkKJwoSlt5MMjmlHGwwzHUY9SroE:N0hEyLkFDb7w/1FOAmBm7cenaAncbt84","tlshash":"8a742b94b290b17883af86fb731a91a1d24d0e9460ccace4f27e6e407f15746b8775ec","size":340163,"data":"","first_seen":"2026-06-12T19:29:57.248751Z","last_seen":"2026-09-07T08:08:08.44733Z","times_seen":1181,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/13575.1781011881923.cda1d494.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"65e5fffbcacf52710ad963a4aeede3be","sha1":"f9c16a3c86649aeacf18e736faacff0cf78192e7","sha256":"36f42498ee253b0d1d5e7ec8bdf406f05c4c91e72f64169b1ff67435d2069099","sha512":"96e8263c115ca75ff63f6ce70ba8ad5af370662f86c2f95a8960a5aa5a30ce4134fa01d7fbd1694ce37f111b69e3e418f0542a7ab1bae4cec570c8c3d8d08986","ssdeep":"1536:917BBHFeKRKp+3ELSPtj6x2DgJoG7PIDmj9VA+s69JAFdE6WIzl+Ik1+eXMa7a4H:7jHoKRKphCnDgJoec+IDWIzls+7Xr0X7","tlshash":"23141a84764170b8c396a165322f601ae22f789650dd9c24f3789ba47f7470df26fabc","size":194916,"data":"","first_seen":"2026-06-12T19:29:57.266361Z","last_seen":"2026-09-07T08:08:08.0914Z","times_seen":1236,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"[Telegram.WebView] \u003e postEventweb_app_set_header_colormap[actor:server1.conn0.watcher17.process7//obj36 class:Object extensible:true frozen:false isError:false ownPropertyLength:1 preview:map[kind:Object ownProperties:map[color_key:map[configurable:true enumerable:true value:bg_color writable:true]] ownPropertiesLength:1] sealed:false type:object]","filename":"https://g36b.top/config/telegram.js?t=1788741139362","line_number":139,"column_number":13},{"level":"log","text":"[Telegram.WebView] \u003e postEventweb_app_set_bottom_bar_colormap[actor:server1.conn0.watcher17.process7//obj37 class:Object extensible:true frozen:false isError:false ownPropertyLength:1 preview:map[kind:Object ownProperties:map[color:map[configurable:true enumerable:true value:#ffffff writable:true]] ownPropertiesLength:1] sealed:false type:object]","filename":"https://g36b.top/config/telegram.js?t=1788741139362","line_number":139,"column_number":13},{"level":"log","text":"[Telegram.WebView] \u003e postEventweb_app_request_theme","filename":"https://g36b.top/config/telegram.js?t=1788741139362","line_number":139,"column_number":13},{"level":"log","text":"[Telegram.WebView] \u003e postEventweb_app_request_viewport","filename":"https://g36b.top/config/telegram.js?t=1788741139362","line_number":139,"column_number":13},{"level":"log","text":"[Telegram.WebView] \u003e postEventweb_app_request_safe_area","filename":"https://g36b.top/config/telegram.js?t=1788741139362","line_number":139,"column_number":13},{"level":"log","text":"[Telegram.WebView] \u003e postEventweb_app_request_content_safe_area","filename":"https://g36b.top/config/telegram.js?t=1788741139362","line_number":139,"column_number":13}]},"http":[{"url":{"schema":"https","addr":"g36b.top/kc523-1/sponsor/sponsor_web_1.png?1781011825626","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.714Z","timestamp":1788741142714,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_web_1.png?1781011825626 HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:26 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 30 Sep 2025 12:19:27 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68dbcacf-a556\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nAge: 43150\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c921a07947d93483f1\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":42326,"size_decoded":42203,"mime_type":"image/png","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 428x169, components 3","md5":"e0ecbe5a9349aaa328ffd6f9515f9007","sha1":"79ebc30d345c812a3e3a122f152829d161b00a52","sha256":"452d27839b3f3f35d11c9a26f06d6cc9db56dc8c61261ee43e0512f69abf71f4","sha512":"fd322bf3ca925ce2eb45317adae1dee0f1c2e4f30035738052a97ccc054ffb576a92a46758559c8d13cff6be549caca5541d14c5692cbec2758ab2b3c7f3324a","ssdeep":"768:2o9mjFjepo5h5jLasrCO57PIrvmMOSf4t7q5bo6Wruv9CSMsfRLMD7XZ0:2ogpymTxRrwmDSM7mbo6WrutR60","tlshash":"8713f2ebe1075d80bb946c9b3925eec61da50f047bc78d68c5e055f921290bb0fa33a7","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-09-07T08:08:08.077977Z","times_seen":2436,"resource_available":false,"data":null}},"time_used":4405,"timings":{"blocked":4087,"dns":0,"connect":0,"send":0,"wait":309,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/6791464a437b4cb5a2a1a3756e994b0b?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.387Z","timestamp":1788741144387,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/6791464a437b4cb5a2a1a3756e994b0b?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:26 GMT\r\nContent-Type: image/png\r\nContent-Length: 14099\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 86533\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"6791464a437b4cb5a2a1a3756e994b0b\"; filename*=utf-8''6791464a437b4cb5a2a1a3756e994b0b\r\nContent-Md5: lG1zrcvbU8fBs84lnradrw==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fr8PvrTXQE0mylrRlVuO2sZFxyj1\"\r\nLast-Modified: Mon, 31 Aug 2026 18:52:30 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: iEw7CfnYL\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: TyIAAAAHaN3kk9IY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14099,"size_decoded":14855,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"946d73adcbdb53c7c1b3ce259eb69daf","sha1":"bf0fbeb4d7404d26ca5ad1955b8edac645c728f5","sha256":"1ad5091e72aa231d713527297e41ec35babd3efcbc398ec5207fbdf3132a590a","sha512":"3e1e5c1e4d0f5af7e6324d95f6eff39ea1418503e6a7bd767bd2f7b6714ccebb5bbe67a769868632843b683382ead7c1ef7722d0b48ed805248a7d35521e738d","ssdeep":"384:AzqM48ZKB2h4NeP01nAJC0PHhb29snWo4TPYJDuviRmn9iXpfD:A0bB2hV0l05b29snN4Uuim8L","tlshash":"db52cfe3165506567e2b77bc5f428886242c22ca77d264dc9aa7cfe180ee2d97c31733","first_seen":"2024-10-24T22:52:54.795342Z","last_seen":"2026-09-07T00:33:21.598602Z","times_seen":159,"resource_available":false,"data":null}},"time_used":2389,"timings":{"blocked":2135,"dns":0,"connect":0,"send":0,"wait":254,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/fe1cd81e7b454e558b1657bbfde4f0ce?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.411Z","timestamp":1788741144411,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/fe1cd81e7b454e558b1657bbfde4f0ce?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/png\r\nContent-Length: 49188\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 31642\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"fe1cd81e7b454e558b1657bbfde4f0ce\"; filename*=utf-8''fe1cd81e7b454e558b1657bbfde4f0ce\r\nContent-Md5: 7kc5HmODl/NbufuE/EYNpA==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fs6thrvUa_IAbZaEb7Y-mSchK4dq\"\r\nLast-Modified: Mon, 31 Aug 2026 19:03:18 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: 1YgNCFm24\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: 734AAADo9svRxdIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":49188,"size_decoded":49944,"mime_type":"image/png","magic":"PNG image data, 195 x 195, 8-bit/color RGBA, non-interlaced","md5":"ee47391e638397f35bb9fb84fc460da4","sha1":"cead86bbd46bf2006d96846fb63e9927212b876a","sha256":"d578b9d7ba606ae3d85249958a668ec9f4d0dbbfa6e96d294f125e2e5dbcb7ce","sha512":"86f7dae687d7bb1c3431cd1ea1e9c3c2f798084102bcf388a808673b8ac4ac533796e242b1ffe5995d5665bb170970404649362f28dd2238b47cebf73e67fd04","ssdeep":"1536:vvi4AVrSlemStqoduie+LNTOsX83kJG+4R:Hi4AxFDgwTO7kJw","tlshash":"8c23f282bbe5a82302794484f0bef62c06d2b9a6d1b7bd87548fd200d3f7f1a9474d91","first_seen":"2025-01-29T13:39:14.717122Z","last_seen":"2026-09-07T08:08:08.392173Z","times_seen":206,"resource_available":false,"data":null}},"time_used":3874,"timings":{"blocked":3562,"dns":0,"connect":0,"send":0,"wait":265,"receive":47,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.esportsdata.cc/202/1/8f0cb22a122eab1bbbcf946ba61d8e5d.png?win007=sell","fqdn":"img.esportsdata.cc","domain":"esportsdata.cc","tld":"cc"},"ip":{"addr":"104.26.3.221","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.428Z","timestamp":1788741144428,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esportsdata.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 09:01:04 GMT","end":"Mon, 12 Oct 2026 10:00:52 GMT"},"fingerprint":{"sha1":"02:2C:76:E1:47:AB:DD:DF:78:F5:11:A8:4B:B9:89:0D:00:17:5A:00","sha256":"38:CC:62:D9:EA:20:2D:41:D0:01:77:C5:A3:E1:31:1D:2E:4A:68:8A:C9:01:14:FB:56:DB:59:4E:F0:B1:B5:08"}}},"request":{"raw":"GET /202/1/8f0cb22a122eab1bbbcf946ba61d8e5d.png?win007=sell HTTP/1.1\r\nHost: img.esportsdata.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Mon, 07 Sep 2026 00:32:24 GMT\r\ncontent-type: image/png\r\ncontent-length: 10609\r\nserver: cloudflare\r\naccept-ranges: bytes\r\netag: \"63308efb34eeb83387c6e70affc851eb\"\r\nlast-modified: Mon, 13 Jul 2026 13:20:00 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Origin, Accept-Encoding\r\nx-amz-id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8\r\nx-amz-request-id: 18D2D8A6E6A3E915\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nage: 3345\r\ncache-control: max-age=2678400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GM05ColXkCYca7cWA1%2FNASfJYeBCVf%2FR%2Bdg5U4EKr0ukAzGV%2B4hjfI67gPZj%2Fkfg0XHIPSxb%2BwR3QuxF4HVdm1tb9ohg0cjfIlg7xkUm2Kw41AyHSjB1%2FgMQafhRlN8KrwxBKw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3719dba1c9756b4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10609,"size_decoded":11566,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 8-bit colormap, non-interlaced","md5":"63308efb34eeb83387c6e70affc851eb","sha1":"6817ba28849f05a0c286f3416aa597471952e86d","sha256":"ab68ff19dec842e17d6c4cfb7b89fdafdb6ea5ab660cc7def3bdc87259f9c2d2","sha512":"e68cff5c73062ba712aabde8ed13dd52098c55ea6b7a12430b97d6966a901dbc4c98e3bb5963ac6e8c0928c04870da003d52b31e9a12e1a7cf76cae063c9bd23","ssdeep":"192:sQSegyIHusJUR7jNiogId+Qdj6sthYu4fJVatenVTVSzsJSYN1KOSJ:sQSbjURHdgIoQdjFhYlJ0t+TqySYTo","tlshash":"bd22c0f364f1ab93a366d46f28405a624a34f267459f50817986382ec411b32fc2a5fd","first_seen":"2025-08-04T09:17:36.702506Z","last_seen":"2026-09-07T00:33:21.600821Z","times_seen":14,"resource_available":false,"data":null}},"time_used":241,"timings":{"blocked":-1,"dns":3,"connect":2,"send":0,"wait":20,"receive":0,"ssl":215},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"img.esportsdata.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/f30932daf7ff45ddbd193b213b02a26b?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.463Z","timestamp":1788741144463,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/f30932daf7ff45ddbd193b213b02a26b?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/png\r\nContent-Length: 155661\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 25927\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"f30932daf7ff45ddbd193b213b02a26b\"; filename*=utf-8''f30932daf7ff45ddbd193b213b02a26b\r\nContent-Md5: Bqccv+UseZUnbpFBN05neA==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FsB8zRA0mTE0sptm8cyYBrBEH6OP\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:05 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: stDytPbAA\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: XBAAAABte-QEy9IY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":155661,"size_decoded":156418,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"06a71cbfe52c7995276e9141374e6778","sha1":"c07ccd1034993134b29b66f1cc9806b0441fa38f","sha256":"86c811719b76b4fd54ae48fc3a6078894811a5f1fed67961d4e9ec7fd8b8d178","sha512":"f462318cea7085e897b53dd5fe5b90db79ca82da67b5d80fa5cdc82096ee173a48576d343c87b96d4eba473b3c8384a8e5385743fdebd9186b1b154ddd251c6d","ssdeep":"3072:RgkL6PsOH59Y/mEAZmHjvFoKjKjdTtqXXM0VJrhc9eWKvJLzlne391okAL:9L6PlZDxmHjN5jKRcXzb0etdzlsUkW","tlshash":"ade312416d529caa593568d38b09b9e50fbf079f65c4b876ebae088cc2b3c9577240cc","first_seen":"2023-05-30T11:51:18Z","last_seen":"2026-09-07T08:08:08.19703Z","times_seen":72,"resource_available":false,"data":null}},"time_used":6581,"timings":{"blocked":6231,"dns":0,"connect":0,"send":0,"wait":259,"receive":91,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/364f9922561c4afb862543a519c8110b?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.500Z","timestamp":1788741144500,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/364f9922561c4afb862543a519c8110b?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:32 GMT\r\nContent-Type: image/png\r\nContent-Length: 15730\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 5527\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"364f9922561c4afb862543a519c8110b\"; filename*=utf-8''364f9922561c4afb862543a519c8110b\r\nContent-Md5: Szr/XmC27tgI8xYrt06ekg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FopCCX8G_fTDtN31TOWV2sMHqhAZ\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:46 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: WYjc1mN7S\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: m5EAAADNHuaS3dIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":15730,"size_decoded":16485,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"4b3aff5e60b6eed808f3162bb74e9e92","sha1":"8a42097f06fdf4c3b4ddf54ce595dac307aa1019","sha256":"5da47b1201f11f2b4779fad1ebcfa5d113048a439b3998c3d512476bcba80f2e","sha512":"bc4b22ff3d635d65897574529e5bdeb6ffc8ab678b93059cdfa8b452032b64a1e6f10df3b40be53ebe9a7f2c3df19ccbefcc78a8061cd212f914a586ca154a23","ssdeep":"384:/QUIQyxxrPagEdtoAyw9Xx6QJ30RFwwyarH+me6:4UIQoPLkoAyIx6u3k1jHh9","tlshash":"e662d03f8b7fd49c078c22c80d0efe40b23eaa8db56b5a885755a9175861bcdcd78660","first_seen":"2025-03-25T00:13:21.955479Z","last_seen":"2026-09-07T08:08:08.172648Z","times_seen":79,"resource_available":false,"data":null}},"time_used":8486,"timings":{"blocked":8223,"dns":0,"connect":0,"send":0,"wait":261,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_0b2c7f25-c17b-4d07-adb1-68f1823633a2.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.643Z","timestamp":1788741144643,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_0b2c7f25-c17b-4d07-adb1-68f1823633a2.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/webp\r\nContent-Length: 10536\r\nConnection: keep-alive\r\netag: \"83c227836fb01b2cef7c240c8d45f098\"\r\nLast-Modified: Tue, 02 Dec 2025 14:12:09 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 48495\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uSDLDRil5H%2FqSeI1t6TM471x3vyyAVb71dj%2FQg2Up3ulwVlYF5jVhTX9evwMi8L169dDzqTLXwsf8GtGFll%2FDcEa%2BQRfNSRyhO9kaI7cmhwOuZySIJbcP0EbGUevFqbXughC52rqBIxoOqFKqt3LwjM%3D\"}]}\r\nCF-RAY: a36cfde8a9cedd40-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c901a07947e6af87a1\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10536,"size_decoded":11447,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"83c227836fb01b2cef7c240c8d45f098","sha1":"fb1e1f8ef0fa166415a743fe004d926e7b040aba","sha256":"54544e3d3311ced9fef367585eb60a15e3bf7d8490ccb2098d7e76d59fbc1fea","sha512":"d41d274ecb2373e9f9eaafe28710226a6bdf54d4c0c8a24c9b04fdd18a6d7fb71611dc0111f54fdd6750929bf002dfbe4a2822fd77f455f850d3406671b6d499","ssdeep":"192:6Xrxa2Dv2+2JgMsTWhgDPkmw0OwIK1AmEIDvWrxaiXFr0NN2uCd16Abhu:aa2Dv2vJmTcgD8mw0ODBmilaiR0P2xJ4","tlshash":"d922b0aad71a5b23ca0056163f7f3476c1567c371b2eeca529eebd0112309e469f9313","first_seen":"2026-04-24T23:10:16.72265Z","last_seen":"2026-09-07T08:08:08.146747Z","times_seen":1165,"resource_available":false,"data":null}},"time_used":5918,"timings":{"blocked":5589,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/kc523-1/sponsor/sponsor.json?1781011825626","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.652Z","timestamp":1788741142652,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor.json?1781011825626 HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:22 GMT\r\nContent-Type: application/json\r\nContent-Length: 646\r\nConnection: keep-alive\r\nLast-Modified: Tue, 30 Sep 2025 12:19:27 GMT\r\nETag: \"68dbcacf-286\"\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c911a07947c9507f3c\r\nX-Cache-Status: BYPASS\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":646,"size_decoded":1048,"mime_type":"application/json","magic":"JSON text data","md5":"10d2161de8cf99c474812f4c43645a26","sha1":"71884ef7281cdcb5084088f16d4550ce8790e634","sha256":"bb02fd7438bb49dd4decb6f76a71f11e93355332fd9f965d6f9f13bb8175aeca","sha512":"bf0fd1232309fcc5582d5c42644e1c7b4b8d235b1066e988ff55e0dd94a956f89742401f00c2d904359041c8e0c2bac8e9316252fab60db5eb0a3b4c935172f0","ssdeep":"","tlshash":"d8f0f44ad8b25b93211fb57c58cd050470294a8f0eccaac4baac987c4f598ddd1e839e","first_seen":"2023-06-16T04:51:50Z","last_seen":"2026-09-08T23:44:55.092773Z","times_seen":2989,"resource_available":false,"data":null}},"time_used":392,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":392,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/a7d1253a43ae4000909a669eccb87728?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.371Z","timestamp":1788741144371,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/a7d1253a43ae4000909a669eccb87728?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:25 GMT\r\nContent-Type: image/png\r\nContent-Length: 34502\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 91923\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"a7d1253a43ae4000909a669eccb87728\"; filename*=utf-8''a7d1253a43ae4000909a669eccb87728\r\nContent-Md5: xF/OsyqLzCH3cS+41hUctQ==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fj-9ZwuDFasU5X-oMlFNiNlsZOsW\"\r\nLast-Modified: Mon, 31 Aug 2026 18:52:35 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: oUSPVhwVb\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: TYcAAAAo9q_9jtIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":34502,"size_decoded":35258,"mime_type":"image/png","magic":"PNG image data, 400 x 400, 8-bit/color RGBA, non-interlaced","md5":"c45fceb32a8bcc21f7712fb8d6151cb5","sha1":"3fbd670b8315ab14e57fa832514d88d96c64eb16","sha256":"0c839807cf467c13414c8ce3b4623a37888dab0a937f1578ed971b0db871f169","sha512":"c551a6f615a8416f3e8f487e23fc3112d45ffacb42fbb18eaa68c9cb7708c26fa62054560438590b33f6785ad7e15eb139cefc37fd63a56f9a3837060c66bee3","ssdeep":"768:sxE/rN/n87lAYd16xuV7WeCAQ9QLWUrU03iIraCx:sG/rd896HHT9QdwCx","tlshash":"45f2e1123ffda03b341ee25f174d998ccc6b2554e57e1bfb2144e046b2a0e642a5e9f4","first_seen":"2025-01-29T13:39:14.654878Z","last_seen":"2026-09-07T00:33:21.605079Z","times_seen":233,"resource_available":false,"data":null}},"time_used":1386,"timings":{"blocked":-1,"dns":263,"connect":251,"send":0,"wait":504,"receive":111,"ssl":257},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/527e41402d41440d890c643fd170cb93?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.389Z","timestamp":1788741144389,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/527e41402d41440d890c643fd170cb93?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:26 GMT\r\nContent-Type: image/png\r\nContent-Length: 28795\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 84727\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"527e41402d41440d890c643fd170cb93\"; filename*=utf-8''527e41402d41440d890c643fd170cb93\r\nContent-Md5: yiJVSs0yPqW/oEnDIcUYVw==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FpTAcCwZjvr8-JJs23Q6I6WnWgWj\"\r\nLast-Modified: Mon, 31 Aug 2026 18:52:31 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: yotoKD3k3\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: 4YoAAAD051qJldIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":28795,"size_decoded":29551,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"ca22554acd323ea5bfa049c321c51857","sha1":"94c0702c198efafcf8926cdb743a23a5a75a05a3","sha256":"a38c7f621e386572babe55804bc45f36c1fa04926ea88047c9f12d09ec87810f","sha512":"d1d6eee77c880ff883f4aa831aaf74a9511e7b1d4f590e9cc67cea1ab34131138250a7dc45001ba6f05dafeaed7dfee27aa67a670b9d44ab26ebd84c5dae90d2","ssdeep":"768:xY1Ga+cIF/jwVHzAZU+MmNsFv1vc8qsVE5N:xYnIF/jwVHzO32vlwso","tlshash":"cdd2d0b0daae72e03ecaae277549011db40342cb05c36df9f45ce65f6f242624c9395b","first_seen":"2023-06-18T16:15:31Z","last_seen":"2026-09-07T00:33:21.605851Z","times_seen":95,"resource_available":false,"data":null}},"time_used":2502,"timings":{"blocked":2215,"dns":0,"connect":0,"send":0,"wait":268,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/40c732c7cafa4e7a9912bfba14621849?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.440Z","timestamp":1788741144440,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/40c732c7cafa4e7a9912bfba14621849?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/png\r\nContent-Length: 30398\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 27129\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"40c732c7cafa4e7a9912bfba14621849\"; filename*=utf-8''40c732c7cafa4e7a9912bfba14621849\r\nContent-Md5: uKrbSvRO3rWhUR8wJ32CAA==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FkqoiWfcdydz4mEyplyYXFwIqc-i\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:52 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: M6mHDVc6T\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: avEAAADET67sydIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":30398,"size_decoded":31154,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"b8aadb4af44edeb5a1511f30277d8200","sha1":"4aa88967dc772773e26132a65c985c5c08a9cfa2","sha256":"46672a218515f0b92cc6eddffbd760b010c5ddb1b081a9e30511cac2d55807a6","sha512":"c33ea564eb96579e2ffd22969c9fdcc3b98ae7479a5420f864102cf0415083e9a882c8fe4d2f84f13eb38660c7d7e5b533b6eb7537cfab906f0048a5fc7c613a","ssdeep":"768:9MDrWJHyCeXDiCSFOq9xy0YlHTT2bFRlF/bkBNCfiM/z:qrWgCeTiCSdvi/0RTIBYnz","tlshash":"4bd2e15cdf94e53d9ab0bee6b3ddd94540742d0a92385a054989f9ae13e489cd80ec38","first_seen":"2023-10-21T16:28:24Z","last_seen":"2026-09-07T08:08:08.19313Z","times_seen":51,"resource_available":false,"data":null}},"time_used":5325,"timings":{"blocked":5024,"dns":0,"connect":0,"send":0,"wait":276,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/e6bfdc3f156946338a28323c349f0311?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.444Z","timestamp":1788741144444,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/e6bfdc3f156946338a28323c349f0311?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 2491\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 27129\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"e6bfdc3f156946338a28323c349f0311\"; filename*=utf-8''e6bfdc3f156946338a28323c349f0311\r\nContent-Md5: z/KZfpGX2Y57V3qQgdtkew==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fs7EIa-lpOYq6VIHJcUgUWZd-qxy\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:53 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: YGAJjFSsY\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: TPAAAACiYdDsydIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2491,"size_decoded":3247,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 93x93, components 3","md5":"cff2997e9197d98e7b577a9081db647b","sha1":"cec421afa5a4e62ae9520725c52051665dfaac72","sha256":"8b1c5c14696d3d8c4b89c6e0044761d6001603ca2398e2a6a19baff3f67af364","sha512":"c1f73ab26a74b05610a999be392641f3e5b178a0a31ac54593ab6787303f0473a4e59d6940d4f1611333ea8157b73eb0d3be97d70fc2b31268668245a8fb77db","ssdeep":"","tlshash":"49511aab809fa052f8242fb1999b0e312b20ba55574c0ef908c9c0f98fe65566db2cc1","first_seen":"2025-09-24T13:06:26.291549Z","last_seen":"2026-09-07T08:08:08.248439Z","times_seen":25,"resource_available":false,"data":null}},"time_used":5440,"timings":{"blocked":5186,"dns":0,"connect":0,"send":0,"wait":254,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_bdd30f19-a4d8-4eb3-b2d5-d24180d2e353.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.623Z","timestamp":1788741144623,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_bdd30f19-a4d8-4eb3-b2d5-d24180d2e353.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/webp\r\nContent-Length: 15228\r\nConnection: keep-alive\r\netag: \"6a267f5e09a632be650a3775bc739a4d\"\r\nLast-Modified: Tue, 02 Dec 2025 14:16:53 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 42538\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nQusrI24lwhUao%2BJFLM7yecj1LSoRNFcgyyBxV4%2FParc%2BBwpK3%2FyrNb5NNxKcs0JvMkVFySyTxD%2F%2FxciWLqZd8Mf3nPByDUoVbNZOwFQeeBTmOZpmp11CR%2BXosGmFgLv0TPs2VAIqOuJ60nm3C5iAto%3D\"}]}\r\nCF-RAY: a36d8f505a528536-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8e1a07947e18e77ea\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":15228,"size_decoded":16145,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"6a267f5e09a632be650a3775bc739a4d","sha1":"5289878ed6bc3c5b6b06a9986ec15a3c6946fcc5","sha256":"88151c14f52fcf8359fe0a5b86c3a14bee6df5f37cfccabd75a86a559e3737aa","sha512":"0c3f82afc7a20b69b90d2ca8d6d00e07c5c097353a5a81024069fb7ed724ee50c335e9fed0860cc92d1274939c0476cbf8cc49b058813775df45f96a3028af3e","ssdeep":"384:1jnjswfCwfOcnPcxsiO8JvyITPiO3BBBJRqn0Rf/dzVPC1D:11fCwFnUl1uwRqnc/dxa1D","tlshash":"e862c1c96f1cf1dabc9c9d3c7a944d369d0c4472a4d804e980b69d2bf98eac78501f2e","first_seen":"2026-04-24T23:10:16.724806Z","last_seen":"2026-09-07T08:08:08.425841Z","times_seen":1034,"resource_available":false,"data":null}},"time_used":4581,"timings":{"blocked":4279,"dns":0,"connect":0,"send":0,"wait":302,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/5b73261dcbda458989419b9396c50a77?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.435Z","timestamp":1788741144435,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/5b73261dcbda458989419b9396c50a77?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/png\r\nContent-Length: 39247\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 27130\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"5b73261dcbda458989419b9396c50a77\"; filename*=utf-8''5b73261dcbda458989419b9396c50a77\r\nContent-Md5: /8u9X83X7N7o2f4eT7loKg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FmhlGOc7mcadJ63c8jq1XxX5o8EH\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:47 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: mBcT64uF9\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: dysAAACKFoDsydIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":39247,"size_decoded":40003,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"ffcbbd5fcdd7ecdee8d9fe1e4fb9682a","sha1":"686518e73b99c69d27addcf23ab55f15f9a3c107","sha256":"b13340c9ba2d2260c2d548e18d6c4303438e5999df6acfec21d9f9e86c62978e","sha512":"0a6fdae49bc887c74d556e0931cbc523a2b25eda5025476975d33f36166a6b49836ab4c4d2a46e303dc12010d5ff5edf24a49cde80bb2de54e43a52288f69ca5","ssdeep":"768:Y5TTVoopouDqgY5424WxGsfksiOh/r3n7Nob+yqbqWy:Y9afuD7Y54ioJQrRe+bqWy","tlshash":"ac03f176237010585c9b7dd36271b381702163811cbe12eeeb89da45e5b27dd8cb8d76","first_seen":"2025-03-31T13:06:08.270306Z","last_seen":"2026-09-07T08:08:08.177459Z","times_seen":104,"resource_available":false,"data":null}},"time_used":5003,"timings":{"blocked":4707,"dns":0,"connect":0,"send":0,"wait":264,"receive":32,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/7ca23c84900e40e888b3a794d3b41b45?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.386Z","timestamp":1788741144386,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/7ca23c84900e40e888b3a794d3b41b45?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:26 GMT\r\nContent-Type: image/png\r\nContent-Length: 12207\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 86533\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"7ca23c84900e40e888b3a794d3b41b45\"; filename*=utf-8''7ca23c84900e40e888b3a794d3b41b45\r\nContent-Md5: RQhWE3y9JTxOFvsCZfv9cA==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FsbRVJeRZyPAvIUrEcZAD1JXTB6I\"\r\nLast-Modified: Mon, 31 Aug 2026 18:52:30 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: 8sAN0jr47\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: MbsAAACPQdvkk9IY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":12207,"size_decoded":12963,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"450856137cbd253c4e16fb0265fbfd70","sha1":"c6d15497916723c0bc852b11c6400f52574c1e88","sha256":"17f5a99f25f505fa4c3badabdbfddf32f2b56dc95966516099cc8c9c45f3be11","sha512":"1dc4d6b37c788887741d8f95f563025065f5c9b4f803e71cbf468eb3c302c6e32c873d548348c45d5c39ed738c39c864c1a1af6df8c42a8c4d543cac1b191997","ssdeep":"192:rk5/xJV+JAfr/6VosXf68M2mPv8ZGSbJ7IH2PKMbrjr+pMxsQw/20lIc:Ax7fLc/HmPBqJjSMbr+pyZ0l5","tlshash":"3c42cfd752a6dc2c98ca3b037386c416da1ee62e483b63b0046f7124d23b4bb759f953","first_seen":"2023-06-18T16:15:31Z","last_seen":"2026-09-07T00:33:21.610771Z","times_seen":307,"resource_available":false,"data":null}},"time_used":2335,"timings":{"blocked":2035,"dns":0,"connect":0,"send":0,"wait":300,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/627a616d212e47ecb165ab9cbce74906?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.396Z","timestamp":1788741144396,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /img/fb/team/627a616d212e47ecb165ab9cbce74906?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-09T05:47:36.08732Z","times_seen":18359622,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/img/bj1.17ef2db8.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.664Z","timestamp":1788741142664,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /img/bj1.17ef2db8.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://g36b.top/css/home.1781011881923.38488e2a.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:23 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-e5eb\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nAge: 48518\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c901a07947cb0a8792\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58859,"size_decoded":59387,"mime_type":"image/png","magic":"PNG image data, 1920 x 1299, 1-bit colormap, non-interlaced","md5":"59f1176bd542d042d8ddecbe4ab2cbdf","sha1":"7251e6f8bc0bf8bf3e62e892b34540f8259dcf9d","sha256":"b3bc2f14721d5f84900af66179eb6ad69a9c8d5a89eae36f877cf09fc9872603","sha512":"c4e7f1491686b72482ba26e34fd94496fc71bec2a35ba1d7cf67391e1f47f859465ad9f0c7d286bd35f9a26132fd80012a2cd2f8133cf1c6013db4f4d27a85d7","ssdeep":"1536:jlJ0Z4kwI3cG0YXIPf/OWcFOtk2bnIlfyMcw68vTbD8:gxbsGvYXd8OtTbIsgTbD8","tlshash":"004302d3b5e9f610dd38c157a3d1c9da504483be3e938d0bebbe402629fd56840a6f16","first_seen":"2023-08-17T12:39:32Z","last_seen":"2026-09-08T23:44:55.207976Z","times_seen":2817,"resource_available":false,"data":null}},"time_used":930,"timings":{"blocked":508,"dns":0,"connect":0,"send":0,"wait":342,"receive":80,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/img/SPORT.aab253e7.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.603Z","timestamp":1788741144603,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /img/SPORT.aab253e7.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-09T05:47:36.08732Z","times_seen":18359622,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/img/ESPORT.4f4b51d4.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.605Z","timestamp":1788741144605,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /img/ESPORT.4f4b51d4.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:27 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-101b0\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nAge: 42552\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8c1a07947dc278125\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":65968,"size_decoded":66477,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"29610094acb703084f79c42c17547a7c","sha1":"3c824ba387e36bcce1a5f1d0d14b513fb278db9d","sha256":"8c3dc9ee49224eff4a37ec488ff0a413f3150ec7a62640a466a802750a573146","sha512":"db986acc62bb0d35583a1c298b468e1fa7869269c738eadc82b944b1a8f9b2c0723087db8a065d60495938e834337e72e3c438089d1d02ff90f4983e0d6461fb","ssdeep":"1536:ObUUUNbT8bJcHe4DyC8KLT/KKeRfm4AH7XAlzS7M2Z:rbgNcHwE/eshbE/2Z","tlshash":"b25302e1df60cb022efe65ca89acf12ae204a0a61476453f7a231d6f3744016af973c4","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-09-07T08:08:08.107818Z","times_seen":2454,"resource_available":false,"data":null}},"time_used":3279,"timings":{"blocked":2905,"dns":0,"connect":0,"send":0,"wait":323,"receive":51,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/31098.1781011881923.4108b3dd.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:23.233Z","timestamp":1788741143233,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /js/31098.1781011881923.4108b3dd.js HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:23 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-561e2\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8f1a07947cb417881\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":352738,"size_decoded":65430,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65338), with no line terminators","md5":"3c55e2f7f495cd530603e700dd3bf229","sha1":"fdcabc58e872fde99b7d704711a75bc32cc2b8c8","sha256":"1c38b781ee4a302e955baab7d3306365881227cafc2814e1085f93f4ab0342d8","sha512":"94954c49e71bd95a7543f652e03bf68b5dd26d00b33c91eda9003ef81e37aa5735e846bc9322d52181550f0d010d125479a73d83dec0fe51fa0c4f2489108326","ssdeep":"1536:Z+0YvC9jlTKAUSseG1SY46DCdlBBo3AgXOG9AsqCfCXsvCfCXsLCfCXsyCfCXsfX:sKK5sY4brG7O3SnLJNpL","tlshash":"6174b6f4c248c6fdea04ce0a7e7d6f2d50723783f2ec56c446aaf8865e92857245c4da","first_seen":"2026-05-19T02:14:56.370466Z","last_seen":"2026-09-07T08:08:08.154579Z","times_seen":1195,"resource_available":true,"data":null}},"time_used":544,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":375,"receive":169,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/9171028a2c9545e1bbaeff092c0ac40d?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.494Z","timestamp":1788741144494,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/9171028a2c9545e1bbaeff092c0ac40d?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:32 GMT\r\nContent-Type: image/png\r\nContent-Length: 13903\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 12731\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"9171028a2c9545e1bbaeff092c0ac40d\"; filename*=utf-8''9171028a2c9545e1bbaeff092c0ac40d\r\nContent-Md5: vSZE/i9LnUrljg01jVzxZA==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fjfz7eUfAuFXUTgFTxw9CG0kw6rm\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:36 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: N21c4cxnW\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: w6kAAAD5WcsF19IY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":13903,"size_decoded":14659,"mime_type":"image/png","magic":"PNG image data, 99 x 99, 8-bit/color RGBA, non-interlaced","md5":"bd2644fe2f4b9d4ae58e0d358d5cf164","sha1":"37f3ede51f02e1575138054f1c3d086d24c3aae6","sha256":"a7cd22cb8454b8075a432ebb791be7c95c98334b84f14cd69cf4263a589e5520","sha512":"f611d5213c7ccb31d0185e5adb3bac1b2977240e6d9ea8d502603c9fe2d6e4d4d0e53953914c37a27a42d9eba2fa7ed278b08a236084d193cfe4b9c8416c0211","ssdeep":"384:Guh86aIUHHqiVbkYT2OaBLI3dFa8Bl/5+Zv6+CTA4qRw8Q:fW6aIUHKiht6vMFa8/5+Zc2yv","tlshash":"5352bfc7c12a18c8e11682d8505648efdc6fa4c7a6d40b9e5196dbc5e7120398fa8fbf","first_seen":"2026-09-06T21:31:37.112903Z","last_seen":"2026-09-07T08:08:08.108853Z","times_seen":5,"resource_available":false,"data":null}},"time_used":8103,"timings":{"blocked":7847,"dns":0,"connect":0,"send":0,"wait":256,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/74a6079fba5d49ab900f113ecaca6d2c?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.501Z","timestamp":1788741144501,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/74a6079fba5d49ab900f113ecaca6d2c?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:32 GMT\r\nContent-Type: image/png\r\nContent-Length: 15122\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 5527\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"74a6079fba5d49ab900f113ecaca6d2c\"; filename*=utf-8''74a6079fba5d49ab900f113ecaca6d2c\r\nContent-Md5: lTC2Av0GZi7eoQZW8O881w==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fh3ytv_x6L_V-Or9AQbE8BapJ_7o\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:46 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: o8fXoGaOV\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: 028AAAAiPOaS3dIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15122,"size_decoded":15877,"mime_type":"image/png","magic":"PNG image data, 400 x 400, 8-bit colormap, non-interlaced","md5":"9530b602fd06662edea10656f0ef3cd7","sha1":"1df2b6fff1e8bfd5f8eafd0106c4f016a927fee8","sha256":"b5142a6cc525bcbee91147d9c93e2b579fd58a57726997475e401c5e89216b30","sha512":"99b408b56bbb47be7ae3fd1d2415e7b20ba8f182e87fcefa8559dbae72cd7704f5ceb6addab1d4bdaf8054f0d850a59835ff8aeab6257c6896a2452527afd454","ssdeep":"384:IurpdInmS3hKFcsUDOptffxHgIqiMrYYWewK:LpdImehK7wOpdOIbMrYnM","tlshash":"0e62b091d7e9ab0fdb02f23d0593c86e582b20f784224c7951aafbad15694cf37cd069","first_seen":"2025-06-02T17:30:29.003475Z","last_seen":"2026-09-07T08:08:08.231165Z","times_seen":48,"resource_available":false,"data":null}},"time_used":8522,"timings":{"blocked":8272,"dns":0,"connect":0,"send":0,"wait":250,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_0fa85f10-2205-44f2-82c2-66bd141c7d57.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.644Z","timestamp":1788741144644,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_0fa85f10-2205-44f2-82c2-66bd141c7d57.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/webp\r\nContent-Length: 10174\r\nConnection: keep-alive\r\netag: \"7ac42d17bfd5a06e8fc6a329b7018939\"\r\nLast-Modified: Tue, 02 Dec 2025 15:07:04 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 48494\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pkIxNvbYDRLt2CtP4hDSu57wOu%2B06LgM21lssfXGuXD9Fe9M4HRnfkTDHZ9rPvB4hnmuezbzdy9hv%2FiyXiHrGMM0In397N8S3vCNMY3ByRmGvEPZBXkTOHaFowQuYrx4ytqsWt33xuRlGHtX1LZ3u84%3D\"}]}\r\nCF-RAY: a36cfdeeea5b20e8-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5cc51a07947e72b8b5f\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10174,"size_decoded":11081,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"7ac42d17bfd5a06e8fc6a329b7018939","sha1":"37f26ed9d40765d2f0a2436038a6c772d654e316","sha256":"23d5a3a14c318b6982e98a0e9f7ae7eb6f3658fe842beef7f26850121f84279c","sha512":"8c49c05d03fb49bc2980047e98e2d1759192aedc89ff040050b1c8e007b16007f71bff0f17eaa3584bef6c0b0db5a52b68009463bd3dd2aa43cacd757ad7367b","ssdeep":"192:O5IkarrboesyPUh4c/gp+sIR6RxWiH21vZgiClgKV16Lq1eM9h0K+B5pZrgVWPWb:5k8rboesiUec4p+sIAYkgK7eQ09B5pZz","tlshash":"3c22bfd259d648a4e1d3d63229678a89d3bf3d0f0309b6d4acec74cf9846dbdd4d0a41","first_seen":"2026-04-24T23:10:16.755505Z","last_seen":"2026-09-08T23:44:55.150864Z","times_seen":1171,"resource_available":false,"data":null}},"time_used":6029,"timings":{"blocked":5719,"dns":0,"connect":0,"send":0,"wait":310,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/kc523-1/download/download_nav.png?1781011825626","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:28.052Z","timestamp":1788741148052,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /kc523-1/download/download_nav.png?1781011825626 HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 30 Sep 2025 12:19:27 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68dbcacf-2c05a\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nAge: 48514\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5cc51a07947de148b5a\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":180314,"size_decoded":180878,"mime_type":"image/png","magic":"PNG image data, 820 x 600, 8-bit colormap, non-interlaced","md5":"87eaffe415a7eb41b7b4b8a868bb3b32","sha1":"575618003efbf8dc8ea781379aeff463cd0cc498","sha256":"4264138e0c015e52e3efa14e34ce9c52490316935b4667756ea631b96eca64dd","sha512":"2b06fbacffed6de2fb1d4a6db2cbd0d9c5c790f9b5a10a6dceac64ff69d300f20628c465a720102da9bd857c80be886ab0a37848929741d2bdef6eddbe0de8bf","ssdeep":"3072:iWlCRQlVF5aSW/mUdJSu3405ovKFzkRKcZjF9Km/mKg/hPFsQBhXRU0K:iWM2I405oCRncZHL/mKWBhXRU0K","tlshash":"0f0412cc23773ffbf8a0865a83fbc1599c3bfd0824e56722ea1662b5186053145a59cb","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-09-07T08:08:08.176743Z","times_seen":2095,"resource_available":false,"data":null}},"time_used":938,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":346,"receive":592,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/api/sport/match/list?sportId=1\u0026client=web","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:39.744Z","timestamp":1788741159744,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /api/sport/match/list?sportId=1\u0026client=web HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nx-request-source: https://g36b.top\r\nXign: ns49MlzEmfJi49d1/WhYhm2MmZhTQF1pYjXDGS58J0vyy7MbTIEZn+oPS4RlwjbbxOfNyyzPHAVISFMVfTzDvq3T1D14BiA38lGkOAqkF1cR1KUm6W2zyu9lZfTY5l5KeFH6rREnrBBf582EPnNGcAbkExAuIjS+kaOuTTsKjbY=\r\ntimestamp: 1788741159738\r\nsign: 7b4j617b5q6g3r2s\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: aDntxNnwbrytXeEW4SJfGsaRdsx3tyZ3\r\nlang: zh-CN\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:39 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nCache-Control: no-cache, no-store, max-age=0\r\ncontent-encoding: gzip\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8e1a079480bc777f2\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":43155,"size_decoded":8102,"mime_type":"application/json","magic":"Unicode text, UTF-8 text, with very long lines (41333), with no line terminators","md5":"3b440ce0b34025506039466efadecb45","sha1":"3f85b3595e6500fdbc3ee6784f34e9aba1c8f919","sha256":"f82788589fb4e8328d93a98db6933677ade975e71af899fcfe98f83f7960685a","sha512":"c920d9c4c1de903d14f0234dba4466b4907186abe559a6efc13a123ba58c248be10efda0db8b1127f1620596cc3d3866675a624fdeba3c65e71dd42a48d74cda","ssdeep":"768:eNCrhqfHg2vcycTd1i0hEKpRb3qOv4dxvUwQYRwJCdxtdtgHRsX16sQP2ssc5sj9:es2mp3/JVsUsdslsgR6RiRR00S0D0jHd","tlshash":"64130e5291de28961b9c61d55d1d3f4d887eba0b0a9ef6c9ee4ecf1821b43fb9300d21","first_seen":"2026-09-07T00:33:21.617637Z","last_seen":"2026-09-07T00:33:21.617637Z","times_seen":1,"resource_available":false,"data":null}},"time_used":309,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":309,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/chunk-init-1656f0b4.1781011881923.32336986.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:19.394Z","timestamp":1788741139394,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /js/chunk-init-1656f0b4.1781011881923.32336986.js HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:20 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-21366\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8f1a07947bfdc7874\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":136038,"size_decoded":38049,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (44088)","md5":"149a9a32eef525724cd200e4dce7a032","sha1":"29b091925cae6d90319391653e40685f6e6c5735","sha256":"10fcb7c4e44a141964cb31c527462c6e56f78d95c956fb02c50c61fc576cefd2","sha512":"62d80403786c13019e86e1c6b991d73cf52ff5bd25d4eeaec34ca12125d677604a269fc6c56ef301f074c42798f8e7935df623d6a0a62559d70749e53082085f","ssdeep":"1536:z2twqIPBoVbzfsO9ZuqpiXXIOU6Qgpp6KkB2EnBDsAxdrkm4SgiqvHynjM5TCif9:z2twqhOIK2nCLdyACifMur06/D","tlshash":"6dd3ec54b7d0b4b442cf13e6711b2475e3a61ca22058e8f0e31dee647f35689d26faac","first_seen":"2026-06-12T19:29:57.333908Z","last_seen":"2026-09-07T08:08:08.264184Z","times_seen":1241,"resource_available":true,"data":null}},"time_used":1601,"timings":{"blocked":908,"dns":0,"connect":0,"send":0,"wait":434,"receive":259,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/83ae580406564938909d23590234748d?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.392Z","timestamp":1788741144392,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/83ae580406564938909d23590234748d?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:27 GMT\r\nContent-Type: image/png\r\nContent-Length: 7241\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 37921\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"83ae580406564938909d23590234748d\"; filename*=utf-8''83ae580406564938909d23590234748d\r\nContent-Md5: 6VW7OZABj2cj4slreJndWQ==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Ft_K5PhZXN8dmzZxZSnVCPYY-m86\"\r\nLast-Modified: Mon, 31 Aug 2026 19:02:53 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: JplqsRGpK\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: o-0AAADfXn4bwNIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7241,"size_decoded":7996,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 8-bit colormap, non-interlaced","md5":"e955bb3990018f6723e2c96b7899dd59","sha1":"dfcae4f8595cdf1d9b36716529d508f618fa6f3a","sha256":"df3168aee1923bce895ba52a30ffc0b5955d135542d68dc65b89d0dc255f1967","sha512":"196c0e25fede04ca9d2076587b558bfa8e0cfe977155e24abc26fa9c6cae21a234b89bed381921125b1cab53968007d832cd8f68db6da11c50a2f4a3bfa67026","ssdeep":"96:gWYiCzA7jYMr+3ozdPmpyZWRyJH6NR1C6UvZzf0+M6+bGphIynPn2KJYm3LGpjnD:mogM/5P9W9UvZzfvM3G7SFTpDDMK","tlshash":"53e1ad926c64d9e94dfa7353a582ef5cd0cb208b0c34741a88bcb2486e677b166b8374","first_seen":"2025-10-19T14:21:11.164981Z","last_seen":"2026-09-07T08:08:08.166106Z","times_seen":62,"resource_available":false,"data":null}},"time_used":2759,"timings":{"blocked":2502,"dns":0,"connect":0,"send":0,"wait":257,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/c087dc48cbdf4f268399eff340167d83?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.402Z","timestamp":1788741144402,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /img/fb/team/c087dc48cbdf4f268399eff340167d83?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":8551,"size_decoded":9306,"mime_type":"image/png","magic":"PNG image data, 97 x 97, 8-bit/color RGBA, non-interlaced","md5":"444092e0736fdea9f82625dbefc0fa4f","sha1":"79aecf6118953c8b2d226e63ca0f79b64574ec0d","sha256":"d80e2f5ecfed232c1c86ede5167692d8291341fe570d0542cff1cc72787cf2c4","sha512":"1de63806bf34dca125d8c8bf288e08b696023fa1c1c0a1522ffcc1d3f31c323c022ef60763978a11f67fc280121233582075c0845edd33eca8af585c2cec9651","ssdeep":"192:NsShAXCoFfP4MWHsQOki2rZ5QF6r7psqJP7JdaPwskGXJcZRqsgk:Ns4oFfPE3VZ53ZpQPwY5cZNgk","tlshash":"7b02bfde1eb0b6e7f419c0f54a11b8488ddf1d3b5142be39b62498362980dfaf83200b","first_seen":"2025-01-03T06:47:24.510354Z","last_seen":"2026-09-07T08:08:08.400501Z","times_seen":34,"resource_available":false,"data":null}},"time_used":3254,"timings":{"blocked":2966,"dns":0,"connect":0,"send":0,"wait":288,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/0a01431d28e84b5f959f68f6e18940a4?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.439Z","timestamp":1788741144439,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/0a01431d28e84b5f959f68f6e18940a4?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/png\r\nContent-Length: 111829\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 27129\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"0a01431d28e84b5f959f68f6e18940a4\"; filename*=utf-8''0a01431d28e84b5f959f68f6e18940a4\r\nContent-Md5: tg3lpNEUNYOQqjhAZ1FEZw==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FqxuIn8UYIzrH2r6I96nX8XSnoip\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:49 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: sgVTAwnHm\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: OKAAAADQrKnsydIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":111829,"size_decoded":112586,"mime_type":"image/png","magic":"PNG image data, 1200 x 1718, 8-bit/color RGBA, non-interlaced","md5":"b60de5a4d114358390aa384067514467","sha1":"ac6e227f14608ceb1f6afa23dea75fc5d29e88a9","sha256":"b217846fbff8e58deb785a671ca19a6b6f2eeedb3c52c3397ccf7c3f889eb309","sha512":"55ee242e9862bd03b49199842865f09e68f5f555c57f19deefecbbecba859c19b416b0b67575cbe4939559407748191774f7e0fcdfca4a006925178336dbd751","ssdeep":"3072:qLmPXDuIKrL9LJlVse2WSIOPFk00SueQdTZhygJtu:qi/DuLZVs+7Sd6Z48I","tlshash":"81b30202a17c2921cb7a97f301bea63687b0cf961f6866b05106fd19dd703325d972ee","first_seen":"2023-05-30T11:51:17Z","last_seen":"2026-09-07T08:08:08.291566Z","times_seen":58,"resource_available":false,"data":null}},"time_used":5393,"timings":{"blocked":5003,"dns":0,"connect":0,"send":0,"wait":264,"receive":126,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/e572da1516c44c7ba05ca2b908ac75b5?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.446Z","timestamp":1788741144446,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/e572da1516c44c7ba05ca2b908ac75b5?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/png\r\nContent-Length: 12438\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 27129\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"e572da1516c44c7ba05ca2b908ac75b5\"; filename*=utf-8''e572da1516c44c7ba05ca2b908ac75b5\r\nContent-Md5: NLB/FNPlBnh+tPXiomkrEg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FvkajBOwhhU0yjf3p8tm6A71DRXN\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:56 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: Fn3LZyvdE\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: rQoAAAATs9rsydIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12438,"size_decoded":13194,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"34b07f14d3e506787eb4f5e2a2692b12","sha1":"f91a8c13b0861534ca37f7a7cb66e80ef50d15cd","sha256":"67fd9cde03cd7c232c5fa44afb53c528aabddcefb6b0f5575d56f43491e71fb4","sha512":"d13cfd8367942be88dc1f1ce05aa2afec267ca6d602a68f77aa50a09a747a7362634594d4f9dfcfe264bd79b0d0378d330fcfe512ecf7a943b7e787efd99bd54","ssdeep":"192:ISj4s0KvrboZ/AUIjVhG9BQxyo9clF9dlrxivqR9aSff4H6tvVSKAQc:PDJrboBchdxykc9rcvS9N4aNyb","tlshash":"f742b009f13ff863f97799af37b673ac005b4c045c61712b6e25652ca86069da2cc399","first_seen":"2026-04-09T16:43:24.639684Z","last_seen":"2026-09-07T08:08:08.065148Z","times_seen":33,"resource_available":false,"data":null}},"time_used":5645,"timings":{"blocked":5385,"dns":0,"connect":0,"send":0,"wait":260,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202607/_webp_size656x884_9dd88971-fbe2-4c59-b6ed-834b4a01d4ac.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.625Z","timestamp":1788741144625,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202607/_webp_size656x884_9dd88971-fbe2-4c59-b6ed-834b4a01d4ac.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/webp\r\nContent-Length: 43480\r\nConnection: keep-alive\r\netag: \"d4c1684204e7688eb1e597c220210eab\"\r\nLast-Modified: Mon, 06 Jul 2026 12:02:36 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 53762\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5g8pUTPDl4LawNfJx6gC10olWqEYtN%2B8SzWZQszAmKA1xEWPT4X2CCNXycjCD5%2B0LyysU7LLm%2FTjfuruTLbGqiMXFJmoovzscGWqF7vpmvJHftdIMJEcpj55zOP9cSoOqIWsnL30CVwmpHfTYS2Y8bg%3D\"}]}\r\nCF-RAY: a36c7d49d80d04ab-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c921a07947e26883f8\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":43480,"size_decoded":44389,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d4c1684204e7688eb1e597c220210eab","sha1":"740bdfd6b8755abb7e48a0e1ad00cb564b6166bc","sha256":"a7adbec5ee5a7cecca8489c103edddd0ab12a5dd4fe44a55c1d3c7727e6c50af","sha512":"c430a7c8147db2a2232bb2b1fc1488c172c7fad20802427d0e99cc983f3e45c625dec5c1b9996a672cfca13bc146f1de99adb5ff2cb4b03ff142ae26923ec465","ssdeep":"768:WDe9O0nm9HMggyXN0devNsUd8uWfvlDIXojlYRSHM2btoc06i:1I0n8LN08vNsJ1fv+ElfHMU06i","tlshash":"cf1302674c8731b1f24667fc6a82333ce88159877c97a41c721c8922174af576f1f675","first_seen":"2026-07-06T14:57:55.472099Z","last_seen":"2026-09-07T08:08:08.215084Z","times_seen":525,"resource_available":false,"data":null}},"time_used":4821,"timings":{"blocked":4503,"dns":0,"connect":0,"send":0,"wait":308,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_2cf32c0e-cd2d-4274-8e00-d67d14e5086e.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.640Z","timestamp":1788741144640,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_2cf32c0e-cd2d-4274-8e00-d67d14e5086e.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/webp\r\nContent-Length: 7390\r\nConnection: keep-alive\r\netag: \"f111a1ab6243183e54c8c152a111da67\"\r\nLast-Modified: Sun, 09 Nov 2025 14:10:40 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 42524\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5be1T3x%2Fxcq%2BZ40kw7rfNKVRLTZ4O3AGlKzhjiQdvhJiAaONXb%2FJ1GjepCyl3ptPT5byoQeVAl8%2BkwsvU2K5W6iZy6HB8BXe9XYd9X4QRO7z89Nt%2Fj%2FQbnr%2B9VNzotXrU3jqivev8a0YiyBST294f2g%3D\"}]}\r\nCF-RAY: a36d8fb0afcb02a9-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5cc51a07947e5f78b5e\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7390,"size_decoded":8306,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f111a1ab6243183e54c8c152a111da67","sha1":"64384e28a720752201bdef5fb2d779e3b9c85f09","sha256":"5cc2cf8571b6a9483514b5a6a4624cf867c12addfcffa3ed0ca5b24a2354dda1","sha512":"38c484611e089f275c9cad39c3978fde5cc040959db3de91ae8744ce33f66b4ecf40b01f464e2081395aa408bbbc6a6c7bd845799ae892a8611b04c24c2198f6","ssdeep":"96:0UX6jHvysggvfrPtYvuy3/9Ic5G1SB2P80d2QWAqhs0ufLIbqvfgJ965FkBYUU:vmqsggvf5Uuy3lQ1Yues0uDlngJY","tlshash":"4ae1bf2cec9e39805c1c3cb8a451111c6f08688cadcc8cd55915be29f277beab5d6e41","first_seen":"2026-04-24T23:10:16.706864Z","last_seen":"2026-09-07T08:08:08.421957Z","times_seen":1118,"resource_available":false,"data":null}},"time_used":5719,"timings":{"blocked":5412,"dns":0,"connect":0,"send":0,"wait":307,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/img/heying.d446c85d.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.713Z","timestamp":1788741142713,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /img/heying.d446c85d.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:27 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-591\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nAge: 43145\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8f1a07947d9a97889\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1425,"size_decoded":1942,"mime_type":"image/png","magic":"PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced","md5":"c0d0c516850381dd1ca39dd94b08f21b","sha1":"54522affec52debd9c0bd3784f0ce9bf692f5d6d","sha256":"301cbb9a8c3fae88d732c8b8fdfe40113e3257831d37150e95564cc0f9b8fbe7","sha512":"6d6b1263f2de2b35237c784fd0aa127c469f8b6ebf347ff1987d791611d5b36f0909f3a81f9db6b1571756ecae60454d854e776e5ed782acbdfcce4fda2b9c86","ssdeep":"","tlshash":"dd213b5023742cd0e8ae3457ef12e5fdb823417994f8dd0c99b9bc3e84908b1057a48e","first_seen":"2025-09-04T00:49:32.953523Z","last_seen":"2026-09-07T08:08:08.148473Z","times_seen":2347,"resource_available":false,"data":null}},"time_used":4499,"timings":{"blocked":4203,"dns":0,"connect":0,"send":0,"wait":296,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/d0cc9282c4494c49b77db577c183898e?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.397Z","timestamp":1788741144397,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /img/fb/team/d0cc9282c4494c49b77db577c183898e?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-09T05:47:36.08732Z","times_seen":18359622,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/undefined","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.653Z","timestamp":1788741142653,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /undefined HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:22 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nCache-Control: public, s-maxage=600, max-age=0\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5cc51a07947c9538b56\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24594,"size_decoded":11244,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5777)","md5":"e79ba8d5268f3090203c26b2ec87119f","sha1":"67ec737a939ce7eb32f6c9ab0f6cb36a5d0c5045","sha256":"f03b70608a46781f56d44226537411cfd4da69014f8c6540319977c45398149b","sha512":"378079455a3539b8fa003afc4351f6acd844d704e0f41250b71dda29b445cb99821596e562eed3afea6a7d0b6de1ff61e22754a4c3d9384952d09b90f4dc3e55","ssdeep":"384:21ERlxqNBPJu2VwiYwJvSoVXsp+pa/iZcVk97g6nMusplIiz:1RXqrJuiNYiKop/E6wkpcu2llz","tlshash":"05b2195a9df3497a2423303a1f7fb20869b0d0134309ed803e4de7594f95aaa56f3bd6","first_seen":"2026-06-12T19:29:57.247756Z","last_seen":"2026-09-07T08:08:08.110319Z","times_seen":1244,"resource_available":true,"data":null}},"time_used":480,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":480,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/img/bj2.a8fabbac.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.673Z","timestamp":1788741142673,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /img/bj2.a8fabbac.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://g36b.top/css/home.1781011881923.38488e2a.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:24 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-5809c\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nAge: 43138\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8e1a07947cee077de\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":360604,"size_decoded":359958,"mime_type":"image/png","magic":"PNG image data, 1920 x 641, 8-bit/color RGBA, non-interlaced","md5":"e0fe8ffeed1841f74df53c3b0c1f2db0","sha1":"77bf6dfe664cdc936776654af151f49368479ec3","sha256":"db4d87e8a403e388c54dd5d114b738c82e1d2dbe65b95630fd5782179f0d7d54","sha512":"825bf73262c2b613b6a8a8397f869db6b2cd4118e554689d228503e7a04c4e674d49c5649e4ac8e2423a7b526c0f6621c259566d0e9bb6ebfa0712a7352968fa","ssdeep":"6144:iAHwIFRCiRIygxWS9v34xfZzuwbIYGzl8BPp0eIiOk3Fg7la6RUIs4pU2:rwy0IgxDEfQwbjw8dpmiOiFgpLHFU2","tlshash":"2874238d711d48cc9c9b45003dd82d9e1c55aa2f7aab20b58264fed24d17ddeec0ea3b","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-09-08T23:44:55.134249Z","times_seen":2682,"resource_available":false,"data":null}},"time_used":1889,"timings":{"blocked":1476,"dns":0,"connect":0,"send":0,"wait":305,"receive":108,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/img/service.68be110a.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.679Z","timestamp":1788741142679,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /img/service.68be110a.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://g36b.top/css/index-399e2569.1781011881923.a7b0b4f4.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:25 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-2991\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nAge: 48518\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c911a07947d3817f42\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10641,"size_decoded":11159,"mime_type":"image/png","magic":"PNG image data, 112 x 112, 8-bit/color RGBA, non-interlaced","md5":"993784a38ddc1156572bfc3308055ead","sha1":"becff431867226bf323b5a6535fa383992f107eb","sha256":"abca3af980888b08c6cbd57366b3ac94344d66ea048484c4f9867e300ee8703a","sha512":"48790c6340f273a58295fc6607306353ab69d5a818569fe36ef1bffc8fff084b23d37b401e10502b830c67a5efedca56c1c9d778d6198e4069018d055f1869f0","ssdeep":"192:NdsarkpjwOOmfStcnaHtzB3l2eKD9RdfXtRqi3ln+ojjjKMGlnyL5H7nx+:nJQpjgOz9Dd0orKMGlnA5Hbs","tlshash":"8822c0c41e1be1b6d2ffa916b28543a04b3421fda1a24c342d828c04ccad56ac91f9e7","first_seen":"2023-07-01T07:21:14Z","last_seen":"2026-09-08T23:44:55.076992Z","times_seen":2707,"resource_available":false,"data":null}},"time_used":2972,"timings":{"blocked":2662,"dns":0,"connect":0,"send":0,"wait":310,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/834736b8db684493a383c597d7d62fd7?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.405Z","timestamp":1788741144405,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/834736b8db684493a383c597d7d62fd7?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:27 GMT\r\nContent-Type: image/png\r\nContent-Length: 2540\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 32543\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"834736b8db684493a383c597d7d62fd7\"; filename*=utf-8''834736b8db684493a383c597d7d62fd7\r\nContent-Md5: ZZRJ6UGLdB2CBNNpswOdfw==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Ft5fvwWtv1ErBnNtiRCY11SMk6fN\"\r\nLast-Modified: Mon, 31 Aug 2026 19:03:14 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: hcHk64LM2\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: BwIAAAC4n8n_xNIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2540,"size_decoded":3295,"mime_type":"image/png","magic":"PNG image data, 130 x 130, 8-bit colormap, non-interlaced","md5":"659449e9418b741d8204d369b3039d7f","sha1":"de5fbf05adbf512b06736d891098d7548c93a7cd","sha256":"fbe1feb983e51d099a205a51432524d6f02f2ed351919143d39c43e0c79c82b3","sha512":"313c5333320a5081db0a2c85c0cb14c6b23f2fe8470f5888427b7ca9444fb4adaecca2973ef0d81a33e3ac6658ce76c2cd6f574a3e6348a0eb6db420079707a9","ssdeep":"","tlshash":"8b51396bcb64d6f64dd81b13c8c5cfb4bd01922de58c6c0e6121f24d086d5efd2b992a","first_seen":"2025-02-26T14:48:47.734716Z","last_seen":"2026-09-07T08:08:08.131405Z","times_seen":39,"resource_available":false,"data":null}},"time_used":3458,"timings":{"blocked":3200,"dns":0,"connect":0,"send":0,"wait":258,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/168ab05e3774462689900ced9c5cab1f?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.408Z","timestamp":1788741144408,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/168ab05e3774462689900ced9c5cab1f?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:27 GMT\r\nContent-Type: image/png\r\nContent-Length: 116811\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 32542\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"168ab05e3774462689900ced9c5cab1f\"; filename*=utf-8''168ab05e3774462689900ced9c5cab1f\r\nContent-Md5: Nd82P0dyPLqKjANn3Rh8HA==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fkfz6hcBMBfuFu23z3_iW7uXNhzM\"\r\nLast-Modified: Mon, 31 Aug 2026 19:03:16 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: iw656TZd9\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: o1UAAAAR8dr_xNIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":116811,"size_decoded":117568,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"35df363f47723cba8a8c0367dd187c1c","sha1":"47f3ea17013017ee16edb7cf7fe25bbb97361ccc","sha256":"bdd484963613418561ff3b7baea57c52fa556cb837025a9c950fd2b320b955e2","sha512":"c4369e173bb087ef8dff5f5914bcfaa596d563611ded669461330be23642e5caafc655d5f058a3df6700660ef30c3232a057c4a5d806fefd6c4e999eac20a934","ssdeep":"3072:R8yH1hbElV5+UlAqgy/mgdTLr6pOozgD+3+87rM:1Vhb2ZXJdX+dgi3R4","tlshash":"ffb312a614cbda582b8340dc9cd36954289e6d3f80400ef7394959be351febe72312bb","first_seen":"2023-08-24T20:41:53Z","last_seen":"2026-09-07T08:08:08.251663Z","times_seen":85,"resource_available":false,"data":null}},"time_used":3990,"timings":{"blocked":3253,"dns":0,"connect":0,"send":0,"wait":312,"receive":425,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/d2f61feb6c9341f1ae9116d022fefb44?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.417Z","timestamp":1788741144417,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/d2f61feb6c9341f1ae9116d022fefb44?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/png\r\nContent-Length: 32644\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 30442\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"d2f61feb6c9341f1ae9116d022fefb44\"; filename*=utf-8''d2f61feb6c9341f1ae9116d022fefb44\r\nContent-Md5: 6ey04ZwcJ95l+1J2iI1djQ==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FqdsuFg3ZYqbwOrQgeTHKmuIuVXs\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:34 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: sWlcTyDa9\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: LXMAAABL1RTpxtIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":32644,"size_decoded":33400,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"e9ecb4e19c1c27de65fb5276888d5d8d","sha1":"a76cb85837658a9bc0ead081e4c72a6b88b955ec","sha256":"c58895e8daf9f133570112f03ad5abab2b4d9e5717979e4cd4fb7752d95a05ae","sha512":"c23177631cc435f045e7aebfee05c9d6464fabf2cac20c89250c3750363eb68866b3e657a3be2132bdc0be29534fd20af0f0c01a287f98e62b0d7533a6703667","ssdeep":"768:SgROZWLkGAxyAuK4X8Nw8CNaVa55ytXj8pSVbtt+gIggUt:lR+WL/UosNwfkabyepSptt+g3d","tlshash":"a7e2e1e16911db11d09bcf9da3fd42119137a8cebb84be0ea8ee73f34b6095975960c0","first_seen":"2023-08-17T12:39:30Z","last_seen":"2026-09-07T08:08:08.289828Z","times_seen":36,"resource_available":false,"data":null}},"time_used":4134,"timings":{"blocked":3862,"dns":0,"connect":0,"send":0,"wait":253,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/76b3894656e945c58d571616622d7671?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.492Z","timestamp":1788741144492,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/76b3894656e945c58d571616622d7671?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:32 GMT\r\nContent-Type: image/png\r\nContent-Length: 10848\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 16348\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"76b3894656e945c58d571616622d7671\"; filename*=utf-8''76b3894656e945c58d571616622d7671\r\nContent-Md5: uSgBztISOeQzwEFGUfqLuQ==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FvD690Yy4ymFt1ST9X2-EJpM4uu0\"\r\nLast-Modified: Mon, 31 Aug 2026 18:52:00 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: eB4apEQ2m\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: MNEAAAAyyqa709IY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":10848,"size_decoded":11604,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"b92801ced21239e433c0414651fa8bb9","sha1":"f0faf74632e32985b75493f57dbe109a4ce2ebb4","sha256":"229b6609887ad471f258a8ade2fabeb4159ad008551f14ebb8b557723720ccc4","sha512":"61f80e0a234abe24810152c3496aecc04e68eed9a7b0df25f1dc71b074fe76253da30c1747d3161ef23a54f31804df08ae183b86df2eda02f2a8268308a4b5dd","ssdeep":"192:qjRRYzF957ls9EZZ15IKVkfeanZ/e22AQUmKR+zPx5ubY50m6Tiw7:qjrkV7ls9EZZ1fiU2xJ+zfef7","tlshash":"a822cf4b00261c7c35e1e939852af7adc4baad24bf7f5581ac34a1f9488c93257af438","first_seen":"2025-03-09T20:09:05.560916Z","last_seen":"2026-09-07T08:08:08.243787Z","times_seen":59,"resource_available":false,"data":null}},"time_used":7970,"timings":{"blocked":7712,"dns":0,"connect":0,"send":0,"wait":258,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/chunk-common.1781011881923.b470d60e.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:19.396Z","timestamp":1788741139396,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /js/chunk-common.1781011881923.b470d60e.js HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:20 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-27606\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8e1a07947bff477d9\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":161286,"size_decoded":36727,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"08afa88982cffd7b96a2190cdafe1c42","sha1":"abb87563ff4cd658f4436118c54f3f39c08f74a4","sha256":"8673d3fc3524eb9d8b4020b3da3109aa5ab5e569ed8d0074f2b72b8643f813ae","sha512":"70c9df3dd7b3e3d41a607627c6a2750f43673649dbd55c7a56606a7d3e67382cb2991f146f7ad2359cc5ff1615f9db484b54642917150351017d0fa4385c3d2f","ssdeep":"1536:jBY8bgGcdWUa2UTY6eryXHuLmbErF/G7D1dMI59H64likx/vocGAClVbGD3tFk7u:jBYCRTY6wjFetH64liC/vocGAcgD3t","tlshash":"65f3e8c5b3a0f07e9a1ed53779331499b12f758274c87c60f1a1ade6bf1a704a436ca8","first_seen":"2026-06-12T19:29:57.317434Z","last_seen":"2026-09-07T08:08:08.071679Z","times_seen":1239,"resource_available":true,"data":null}},"time_used":1624,"timings":{"blocked":925,"dns":0,"connect":0,"send":0,"wait":438,"receive":261,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/11da488a58a3492194c505b95dfaf846?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.426Z","timestamp":1788741144426,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/11da488a58a3492194c505b95dfaf846?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/png\r\nContent-Length: 57073\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 30415\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"11da488a58a3492194c505b95dfaf846\"; filename*=utf-8''11da488a58a3492194c505b95dfaf846\r\nContent-Md5: j1YsUF9IAD3WO0Ydj1qEhg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FgNMAwounEIBDwPUdgrJoeB0Pfhy\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:40 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: wcJFjSKDV\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: xWwAAABupFPvxtIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":57073,"size_decoded":57829,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"8f562c505f48003dd63b461d8f5a8486","sha1":"034c030a2e9c42010f03d4760ac9a1e0743df872","sha256":"2b799b55fc4227ab198e0d04015d84dd45952db1a0d13cd804d0180d33acaf7b","sha512":"e3388cd7253a4f1c85f06ad3ee78ad55dcc9b7362725b16e1eaf1c301fcb86f393add6bdf16644e6d57b36723d66b56e626b5a3150d45682e866502178f625dc","ssdeep":"1536:GEmMpJzS//Fbsx9MOgOLAsxbTQ8rW43AltzNTCmQSJJ3:GfKJS3FcMO/AMbM8a43AltzNTCmQ+p","tlshash":"56430212777291b8ccbefb01e447a4d7f4169c621a4d54c8b9e1bcc8eb8adb24fb9144","first_seen":"2023-05-30T11:51:18Z","last_seen":"2026-09-07T08:08:08.182102Z","times_seen":58,"resource_available":false,"data":null}},"time_used":4660,"timings":{"blocked":4322,"dns":0,"connect":0,"send":0,"wait":276,"receive":62,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/00fccca078ee4b7e9854ac92545baf0b?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.488Z","timestamp":1788741144488,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/00fccca078ee4b7e9854ac92545baf0b?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:32 GMT\r\nContent-Type: image/png\r\nContent-Length: 81766\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 18126\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"00fccca078ee4b7e9854ac92545baf0b\"; filename*=utf-8''00fccca078ee4b7e9854ac92545baf0b\r\nContent-Md5: 5ezQVTiF8aOvcxdY3dzi7A==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FgfFTo3q_IS0WIPJGx094i0c0HLU\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:33 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: nq0WSFOiR\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: y1kAAAAYOIsd0tIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":81766,"size_decoded":82522,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"e5ecd0553885f1a3af731758dddce2ec","sha1":"07c54e8deafc84b45883c91b1d3de22d1cd072d4","sha256":"6bbafa08d73b473f020a3276dc719cf890e607168b2591a9d12b4efbe426916f","sha512":"29b4caf8b0c068bb9bced69af1a5db24e404468d08568fa0a1421abd40f41c8f6a99462ae68e90d7d75fbc1480bfa900b56d34b0da2b2e733d247e6038c6f27a","ssdeep":"1536:fDFvjF9e7fVvXWEw83bX79Otjfm5SqQ/djZLKOC/DCm02b:fxvjF9e7l93rktiIn/3hCr","tlshash":"a4831267aa82baa30e73517834f4339ca29534780ff5cc8215561ed4fdf89ed7a2a510","first_seen":"2025-07-30T10:38:02.639508Z","last_seen":"2026-09-07T08:08:08.254462Z","times_seen":239,"resource_available":false,"data":null}},"time_used":7825,"timings":{"blocked":7510,"dns":0,"connect":0,"send":0,"wait":252,"receive":63,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/480f8961f314430f9feee0b9ce04d030?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.497Z","timestamp":1788741144497,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/480f8961f314430f9feee0b9ce04d030?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:32 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 3973\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 2079137\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"480f8961f314430f9feee0b9ce04d030\"; filename*=utf-8''480f8961f314430f9feee0b9ce04d030\r\nContent-Md5: FCRA++mGkuUuvcvBqclmtg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FnAOGFeBQgXMEz3G9yJ_cje_DM5U\"\r\nLast-Modified: Sat, 08 Aug 2026 19:30:34 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: 9uTcsRVDl\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: j9UAAACrrgmjf8sY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3973,"size_decoded":4731,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 125x125, components 3","md5":"142440fbe98692e52ebdcbc1a9c966b6","sha1":"700e1857814205cc133dc6f7227f7237bf0cce54","sha256":"8c8be42015ceb0dcb13d5d1ece2007a84b2175decd05862942845e38634078e2","sha512":"d82f749db876caa2029e82663ea68212dbee83a4bc9fa0198248b7352c1ce07444b9a7448582cd07ed57a9057397328f97c623fd1398756ef27ced31c488bd3a","ssdeep":"","tlshash":"bc814c5e23a2969ddfd5ad787af41341128e070b07af5e0a1bfa43e04267550abf1df0","first_seen":"2025-04-01T11:41:17.744465Z","last_seen":"2026-09-07T08:08:08.255411Z","times_seen":59,"resource_available":false,"data":null}},"time_used":8223,"timings":{"blocked":7970,"dns":0,"connect":0,"send":0,"wait":253,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/img/CHESS.80cb714e.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.605Z","timestamp":1788741144605,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /img/CHESS.80cb714e.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:27 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-e587\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nAge: 42554\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8f1a07947dc00788b\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58759,"size_decoded":59263,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"727b4dc207a4141335b27fa73f76fb10","sha1":"bb63b02e635f5503d76c4fc3532c2c652a06cac8","sha256":"5d840214ae46c94540df7d0a94963cc398b32c7b868edddb6a4f2a2faf113e42","sha512":"c1512f9d9a191ea10e806fe3a8f812f78dec9832568373b7b5362fafe9aef6783947d248deb2fc8d30ba1c61fd3b94f308298e69c1de32686110fa35f7bd4ed4","ssdeep":"1536:gtPCh483gu6aLw9AJeteTzkprgTWEHbP4BzrJ:344U9Xte3kprgKE7gZJ","tlshash":"0543025a13c1159f422f37b8148758a6d8154f9f38f32ea11a9e2afda58cb0af431c3d","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-09-08T23:44:55.115754Z","times_seen":2471,"resource_available":false,"data":null}},"time_used":3273,"timings":{"blocked":2866,"dns":0,"connect":0,"send":0,"wait":323,"receive":84,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_96811f47-5a2c-446d-a8ca-696df160de09.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.646Z","timestamp":1788741144646,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_96811f47-5a2c-446d-a8ca-696df160de09.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/webp\r\nContent-Length: 46184\r\nConnection: keep-alive\r\netag: \"c0ef8343c60fc9c02bde9fb0823e1ef6\"\r\nLast-Modified: Sat, 06 Dec 2025 06:26:38 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 48494\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=o4q5b60%2B2xdYagCVVDGJAYIcvxoOOWLNZswNcgWVOsxAKOGUbF28z5Pch0WT%2BU93JALctJeHeI%2BnmxzFP%2F98IbPF4YRyviphvBgFXgOEQnCp%2Fg%2FYdcvSRUIFnHK0Vahaw77Xu5hNz0NfZMBMiQJ0ekc%3D\"}]}\r\nCF-RAY: a36cfdf11ac38065-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c921a07947e76483fc\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":46184,"size_decoded":47099,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c0ef8343c60fc9c02bde9fb0823e1ef6","sha1":"3a5e1c7a0e16e4df0a591749d4a8a1d01b381277","sha256":"1042e3632605c2e70706209ece9e2b341695afc4e57d5512818e458078c55040","sha512":"950b59f182c21e7d78ac56d6c1cb0f22a295ede2a579f9513c69166b2c227d5ebc4a8e16d5528f530488d5c36d8b88d9c29bb251820627d596156f90445a90f6","ssdeep":"768:fs+YB8yjw8RTKT4uT+QCkrgAEnaCA/RE4qehyRcQsII+IYJxT8sJk2RaA2b:fsDjxR+LT+vkrgAZ/R1hyqQ5IeJxTbR0","tlshash":"182302b81bd5a7b7cec731f89ce2890a4d17c2d5e183b0667d686bd6aa114c1f4c0ed1","first_seen":"2026-04-24T23:10:16.848247Z","last_seen":"2026-09-07T08:08:08.207799Z","times_seen":1217,"resource_available":false,"data":null}},"time_used":6095,"timings":{"blocked":5776,"dns":0,"connect":0,"send":0,"wait":308,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/api/sport/match/list?sportId=1\u0026client=web","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:29.081Z","timestamp":1788741149081,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /api/sport/match/list?sportId=1\u0026client=web HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nx-request-source: https://g36b.top\r\nXign: BYe3kjaPVZh5v+f5imQKAGS9vXM+ZMFmaN0FZZIe3VSALMDS957Y2QrV0fajmRKiB1DfFfopDPL0XDwDoxuWOnCUi81Rm+3Xv12IXsWLNtHMeJihZmjxRYoN98AWzFqTsit6dCI/kwdm+AywWFsy2mkpifoqF4C+VxrEjpQSkDQ=\r\ntimestamp: 1788741149074\r\nsign: 4g1362152f4k5280\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: aDntxNnwbrytXeEW4SJfGsaRdsx3tyZ3\r\nlang: zh-CN\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nCache-Control: no-cache, no-store, max-age=0\r\ncontent-encoding: gzip\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8f1a07947e219788d\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":43155,"size_decoded":8079,"mime_type":"application/json","magic":"Unicode text, UTF-8 text, with very long lines (41333), with no line terminators","md5":"3b440ce0b34025506039466efadecb45","sha1":"3f85b3595e6500fdbc3ee6784f34e9aba1c8f919","sha256":"f82788589fb4e8328d93a98db6933677ade975e71af899fcfe98f83f7960685a","sha512":"c920d9c4c1de903d14f0234dba4466b4907186abe559a6efc13a123ba58c248be10efda0db8b1127f1620596cc3d3866675a624fdeba3c65e71dd42a48d74cda","ssdeep":"768:eNCrhqfHg2vcycTd1i0hEKpRb3qOv4dxvUwQYRwJCdxtdtgHRsX16sQP2ssc5sj9:es2mp3/JVsUsdslsgR6RiRR00S0D0jHd","tlshash":"64130e5291de28961b9c61d55d1d3f4d887eba0b0a9ef6c9ee4ecf1821b43fb9300d21","first_seen":"2026-09-07T00:33:21.617637Z","last_seen":"2026-09-07T00:33:21.617637Z","times_seen":1,"resource_available":false,"data":null}},"time_used":315,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":315,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/ecb/8f83064248a6651521ab9b26970d60fa83f0bf5f79fe68600101b67707c272184849423924c3e9832923a30acedcbfec8ac50fef89fb","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:23.428Z","timestamp":1788741143428,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /ecb/8f83064248a6651521ab9b26970d60fa83f0bf5f79fe68600101b67707c272184849423924c3e9832923a30acedcbfec8ac50fef89fb HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://g36b.top\r\nXign: V3CZBZGAYudBEipk39xI3ChqpsD3/up5jmgAte+HP4f9YAPINVZXwVytfNnEOUS5PVXpPNaV+5cDMcB5gmpEeVAOwXfzz7myeM8bEAyJ4K4IUPKM7WpJtj+0OVjkbVPzcuWDGjF1NXKuA7TElcAHGRt4OprIixbRna5///5VIYA=\r\ntimestamp: 1788741143420\r\nsign: 7275304p4p2s1v5a\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: aDntxNnwbrytXeEW4SJfGsaRdsx3tyZ3\r\nlang: zh-CN\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:23 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Mon, 07 Sep 2026 00:42:23 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nX-Request-ID: 26c1e1b74b454ac59e23f7a1b33cf86e\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5cc51a07947cc048b58\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6691,"size_decoded":7511,"mime_type":"application/json","magic":"data","md5":"56121354bdc384a2e156e5fccada5da6","sha1":"c6a3f5a06cc0d1cc371251af378ac99569df39de","sha256":"ae22232bc509f9bab4be75c3ad4c0c0b3a9e761fd5412c4383c73fadbd1a49aa","sha512":"a4970df4d28be82442ccb2243aeccd35ba02ccb7dabcaf3a08ca91e545b72198b3e3ef99180e4eb6c6d77fe885310235d8119ef5698b3b19d27b8c88778dd6b6","ssdeep":"192:V/XaHYhYBNWN/DTxL4ji6SGv3RY5roc3rLI4irw9bdWagTgAGa+:9qHYGNk/DTr6SGv3RY5rTbw4dWa6Ma+","tlshash":"4d22af970b52d7a036cdd5fca1621cc12a9fa2cc40bc9bd5d37480a42eae75074dc4b5","first_seen":"2026-09-07T00:32:02.794146Z","last_seen":"2026-09-07T08:08:08.078833Z","times_seen":3,"resource_available":false,"data":null}},"time_used":364,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":364,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1884x434_8fe89870-1081-42db-97b7-f8272ac29ae0.jpg","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.028Z","timestamp":1788741144028,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1884x434_8fe89870-1081-42db-97b7-f8272ac29ae0.jpg HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:24 GMT\r\nContent-Type: image/webp\r\nContent-Length: 35652\r\nConnection: keep-alive\r\netag: \"460db28ebf94215162fde2f45aa09227\"\r\nLast-Modified: Wed, 10 Dec 2025 10:48:14 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 31017\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iXq39iKK4UEBh9sg5QPRzL7Fxc6t4a3gbdba5xZOhlO281tGfICk3BljUgoW5Gc4xWG6n3xDJ41rjST%2FlF0OK%2FJOrxsSI1PiZE9L7IBXILtW%2BZ58dlbUyQPgB94rl7EJpjwIr%2FfAo1xSCgPlk2gSY78%3D\"}]}\r\nCF-RAY: a36ea877a88a85f5-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c941a07947ce5b8267\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":35652,"size_decoded":36563,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1884x434, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"460db28ebf94215162fde2f45aa09227","sha1":"0225f7e91dc41547efad18932766b6c015ad8067","sha256":"6f2bb6b02eec8a75b36f50f9a85e80a7153785bb31d41c7204bfd276c6407fcc","sha512":"e95968ce697aedd21f9c2bca132aeb5704265c25d540eda3e4d08832b3d0d0e71e454d137ed5de531807499279ab56121b0a5975f340670b2ece902d60fbcc0d","ssdeep":"768:tNbBFG8Mzu+7ftXGrZ98VqOhCHza3+conChKku0aOwq9J9r7Z1I:bDG8MZh2rZQqYNUkWOR9J5jI","tlshash":"44f2e18ec1c932eee97bc29101be2be0ff89966bf15857662dd2c0c98e51311848fc5d","first_seen":"2026-04-24T23:10:16.885462Z","last_seen":"2026-09-08T23:44:55.15393Z","times_seen":1417,"resource_available":false,"data":null}},"time_used":452,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":359,"receive":93,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/ed77310feb8242d488e2624a85616356?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.378Z","timestamp":1788741144378,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/ed77310feb8242d488e2624a85616356?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:25 GMT\r\nContent-Type: image/png\r\nContent-Length: 7774\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 2479\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"ed77310feb8242d488e2624a85616356\"; filename*=utf-8''ed77310feb8242d488e2624a85616356\r\nContent-Md5: +sjg4MfBnFrNHdaH6REEJQ==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FqGl7LkgN946NwV2xW74CXhkVEIP\"\r\nLast-Modified: Mon, 31 Aug 2026 18:52:28 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: YFj3Am3dP\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: 70AAAABeVwRX4NIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":7774,"size_decoded":8528,"mime_type":"image/png","magic":"PNG image data, 110 x 110, 8-bit/color RGBA, non-interlaced","md5":"fac8e0e0c7c19c5acd1dd687e9110425","sha1":"a1a5ecb92037de3a370576c56ef809786454420f","sha256":"ab24582324a9fe9fa52119ec06c0dba92712e102a848517f4eaab08546a5ac52","sha512":"35cdbfd54d8781a46d6d6c9ba8a1a596a25875aafb52e5c053d39f648579bc8bd5f71e9a393cfdd0bd0facaf55b85bbae34183b724109cf3e7486736be3a9c61","ssdeep":"192:boQ40K0QTB8Wh0G7oEHeG/KqP/uNif5/GLNWkM906Pp:bm0QTB8WL8EHJuNih/GE7L","tlshash":"3af1aedc7e0a93c3c0a5593317bfadbf069d6d9a185712054d92a023cbc37a91ce23a9","first_seen":"2024-10-24T22:52:54.781691Z","last_seen":"2026-09-07T00:33:21.643983Z","times_seen":20,"resource_available":false,"data":null}},"time_used":1668,"timings":{"blocked":1384,"dns":0,"connect":0,"send":0,"wait":284,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/a4dd0f63d0c844a4bd255f65252fd66b?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.388Z","timestamp":1788741144388,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/a4dd0f63d0c844a4bd255f65252fd66b?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:26 GMT\r\nContent-Type: image/png\r\nContent-Length: 220888\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 84727\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"a4dd0f63d0c844a4bd255f65252fd66b\"; filename*=utf-8''a4dd0f63d0c844a4bd255f65252fd66b\r\nContent-Md5: iQoXrRQp9v85mX9P4h3k/A==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fhj68WRHEpsXIjfIxEwBLd-0kugq\"\r\nLast-Modified: Mon, 31 Aug 2026 18:52:31 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: ZDBSDWrAV\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: L64AAAADeFmJldIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":220888,"size_decoded":221645,"mime_type":"image/png","magic":"PNG image data, 1154 x 1730, 8-bit/color RGBA, non-interlaced","md5":"890a17ad1429f6ff39997f4fe21de4fc","sha1":"18faf16447129b172237c8c44c012ddfb492e82a","sha256":"120eb5a915b4374d5dd32eb988be63c2b259bd96b71601a5582933f7e09c2dc0","sha512":"a06cc7a940ae9af9a486dd5cd2b9a916284b865306324538237d7f3503183e8ac78cb4f737b99b394609d90677b22250abd4c0a6678635fd525f80f0f98537fb","ssdeep":"3072:84QRBt63WV33N9RJr/fz4VMvkgCdDKmVBj6WrcrjroAwY86BPA4ojmLc/KQ9WTuW:RQD08NLd/fzkF/2JPwY86O4V4K7KYx","tlshash":"f52401c41ca21cb6e9f27e358d474e4433e5089fe657188ac27f025671e163a2736ebb","first_seen":"2024-08-19T15:05:16.196088Z","last_seen":"2026-09-07T00:33:21.645194Z","times_seen":122,"resource_available":false,"data":null}},"time_used":2600,"timings":{"blocked":2189,"dns":0,"connect":0,"send":0,"wait":260,"receive":151,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/b1cde0d657414233be145b15dfa4d43f?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.436Z","timestamp":1788741144436,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/b1cde0d657414233be145b15dfa4d43f?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/png\r\nContent-Length: 17295\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 27130\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"b1cde0d657414233be145b15dfa4d43f\"; filename*=utf-8''b1cde0d657414233be145b15dfa4d43f\r\nContent-Md5: ogiVOa6WYWu/UDTfELn3cw==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FiivWXZfUYxgcb7PyH6ylToYfAWd\"\r\nLast-Modified: Sun, 30 Aug 2026 19:14:50 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: gVRce2yAr\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: 18QAAADeH4DsydIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17295,"size_decoded":18051,"mime_type":"image/png","magic":"PNG image data, 99 x 99, 8-bit/color RGBA, non-interlaced","md5":"a2089539ae96616bbf5034df10b9f773","sha1":"28af59765f518c6071becfc87eb2953a187c059d","sha256":"e18cd5393b39508370fd44b9affc8736618ef98bd13433bb0a214a8d291a8962","sha512":"d42d9ee5de9d161959beda022fef64208066991d1b010b66aed775b4c15a78276746d31f3558fde8718c1f2f33942174355b2b4c9f5c48d1f87adfe8e8f12b83","ssdeep":"384:d72KQhYYXOBufNnll2JT8xkv+D5pQR0xWtzlbkZvJX00I9fvFs3jobjn:dlQhY+OBkLl2aqGDoR0xkkZxX0/9O3jy","tlshash":"4572d07348b067951492b9dcef247edbc8914f985b5ec4f00d02e9aa2e65ec5188c6b3","first_seen":"2025-09-28T01:17:00.375859Z","last_seen":"2026-09-07T08:08:08.226387Z","times_seen":29,"resource_available":false,"data":null}},"time_used":5140,"timings":{"blocked":4879,"dns":0,"connect":0,"send":0,"wait":259,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/c48d7402381b499aba2a992a3b0d7738?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.499Z","timestamp":1788741144499,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/c48d7402381b499aba2a992a3b0d7738?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:32 GMT\r\nContent-Type: image/png\r\nContent-Length: 16966\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 5528\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"c48d7402381b499aba2a992a3b0d7738\"; filename*=utf-8''c48d7402381b499aba2a992a3b0d7738\r\nContent-Md5: xSMolmNDcTJkLrkm49UcVg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FpShJjcI6FHr6cJDYJ48MiFt_oe5\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:45 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: 2L4DUuYG9\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: fpkAAAD-xeSS3dIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":16966,"size_decoded":17721,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"c523289663437132642eb926e3d51c56","sha1":"94a1263708e851ebe9c243609e3c32216dfe87b9","sha256":"aff0b91e8c316db0df3546c6c7ce84a929076a8c1df8971fa36750e59cdbb413","sha512":"0a82cca27a105472309f202c1a7b7c0ac9095355b834f35a81c8e71545ed68b7853091c65809fb3316362ba0135ddaca5e6c2fcbe738076bbc6b734f9dc32e80","ssdeep":"384:fKwc1JK+3T0pujE37nz3XfTCelEc+Ar+zl9uUQVFg:SwcTP3Y337TXLhlEc+D","tlshash":"9f72cf8cf5228dacd70618c4c5dd1e1f4e7d373a68aa2709e1a43424552caf572aee1e","first_seen":"2025-09-21T04:12:33.87118Z","last_seen":"2026-09-07T08:08:08.176094Z","times_seen":265,"resource_available":false,"data":null}},"time_used":8389,"timings":{"blocked":8119,"dns":0,"connect":0,"send":0,"wait":268,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/7de43c66dfa64f3db9ba230d017fb382?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.469Z","timestamp":1788741144469,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/7de43c66dfa64f3db9ba230d017fb382?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:31 GMT\r\nContent-Type: image/png\r\nContent-Length: 20064\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 25326\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"7de43c66dfa64f3db9ba230d017fb382\"; filename*=utf-8''7de43c66dfa64f3db9ba230d017fb382\r\nContent-Md5: nBNWBxUgNXzkRoM5AD9a1g==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FlE2oo6OK3h-1J5WmnmZwvgLqR1b\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:02 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: sRa7kPcsg\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: q88AAAAdJgiRy9IY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":20064,"size_decoded":20820,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"9c1356071520357ce4468339003f5ad6","sha1":"5136a28e8e2b787ed49e569a7999c2f80ba91d5b","sha256":"ff7b860097b79ef26890cacab58bf4eece0f9c74f245c35bb1b39297c3df063b","sha512":"c86b70d562026ba6a3846d24cae7bb94cd0efb514163f08e09ff607e916b22f63454df3505b464c7ed8a60b4f0fd8448541c763dbed5ac6365ffbfc2ebfcdfba","ssdeep":"384:m6hnPx2t7HGbFAbPbqlG+9Foxr4CNfFHCr5yajWtgVMWcsm+z:tnpkmb67eARxr4CnH4y+egVMVj+z","tlshash":"3e92e14fc7de5f0ca4d24d3fb14f9a7961a2dce8a0499c0d2197ef46154463246336a3","first_seen":"2023-08-17T12:39:31Z","last_seen":"2026-09-07T08:08:08.199258Z","times_seen":101,"resource_available":false,"data":null}},"time_used":6878,"timings":{"blocked":6610,"dns":0,"connect":0,"send":0,"wait":263,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/api/tenant/domain/list","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:23.850Z","timestamp":1788741143850,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /api/tenant/domain/list HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nx-request-source: https://g36b.top\r\nXign: IEoHGBviPn5IP9g1z2HI7jqyX3WTRKMsB1euqKnMXwwn38KlLJSgvxAIpqNhN9rQfnkDYGRm5hBSAva+JKVydqVbK7scK6Nwr1LPENYIZ78IX6cyJyxKK79X/f8Jsuk2IqDhHG8Nf9W8LTXe0mNAmzw2SqUrUS1MudXCr9BD1jU=\r\ntimestamp: 1788741143628\r\nsign: 1h3n6g6q6o5n2v1f\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: aDntxNnwbrytXeEW4SJfGsaRdsx3tyZ3\r\nlang: zh-CN\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:23 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Mon, 07 Sep 2026 00:42:24 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nX-Request-ID: 3112e97e64334b92b4b289b5d02225d2\r\nPragma: public\r\nVary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nX-Content-Type-Options: nosniff\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8f1a07947cdaa7883\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1108,"size_decoded":1612,"mime_type":"application/json","magic":"JSON text data","md5":"5d9e96bd132a2c24281ae50f2b09efe4","sha1":"503ea18100d0f1573baa195933355a1372e93841","sha256":"7f205b18b5deaae96622989dbc8ad73999a9616e96ef26d909f19525deadb328","sha512":"ab5a589dc81944d2fe05d656777e9e490d42a2fd68c7e577387cfdd47c9b0c5276ca2f91a3868407c373e500d00bb5360a5ae035c7c0cb1addf47f20755a268b","ssdeep":"","tlshash":"fb11c6101c6f12c8d6e8d29263503345388d8b76056db91b69d6b74fae0583a32120a4","first_seen":"2025-08-29T11:05:53.144028Z","last_seen":"2026-09-08T23:44:55.210596Z","times_seen":2805,"resource_available":false,"data":null}},"time_used":301,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":299,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/fd9b0f9e177c4091af3c6b1017283b93?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.372Z","timestamp":1788741144372,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/fd9b0f9e177c4091af3c6b1017283b93?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:25 GMT\r\nContent-Type: image/png\r\nContent-Length: 17868\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 5521\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"fd9b0f9e177c4091af3c6b1017283b93\"; filename*=utf-8''fd9b0f9e177c4091af3c6b1017283b93\r\nContent-Md5: ahEgRnuJAAo7smr6Pe3E1Q==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FsLGosvkG4w3Er2sIbdT8QioEeJe\"\r\nLast-Modified: Sat, 05 Sep 2026 04:52:42 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: qeZBic3qb\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: Q98AAADHcsWS3dIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17868,"size_decoded":18623,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"6a1120467b89000a3bb26afa3dedc4d5","sha1":"c2c6a2cbe41b8c3712bdac21b753f108a811e25e","sha256":"8f4c227beacf53de9ece589be654a8fd2f1f960a91a4979ae7044dab9256856c","sha512":"75dd69dd476c366b5e03f3cb07980a06ae9e41aa32f44b6880600368cd9e42350271e36113c23716492d857134ac1499bfa90ecf116824202ee2b2562a977141","ssdeep":"384:t77FLjubdU/aJ0wAzosqeoL4g3r8tXU4HT1I:Wd2afAjbg3rT4H5I","tlshash":"fd82d164d5040df22fa3d32a8c9eb6be5ca863e23857b3f111c950be71d55d82301aed","first_seen":"2025-07-07T01:35:39.831317Z","last_seen":"2026-09-07T00:33:21.651471Z","times_seen":22,"resource_available":false,"data":null}},"time_used":1526,"timings":{"blocked":-1,"dns":262,"connect":252,"send":0,"wait":334,"receive":167,"ssl":511},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/70fc20b34f644aa294d75f2553cc7322?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.385Z","timestamp":1788741144385,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/70fc20b34f644aa294d75f2553cc7322?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:26 GMT\r\nContent-Type: image/png\r\nContent-Length: 14750\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 1970\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"70fc20b34f644aa294d75f2553cc7322\"; filename*=utf-8''70fc20b34f644aa294d75f2553cc7322\r\nContent-Md5: FKkdGcBbGCrEk83wHuzrBQ==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fpz51OeYLpfWHd9_Ps4H2FT53v8Z\"\r\nLast-Modified: Mon, 31 Aug 2026 18:52:29 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: SI9Smf3Jp\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: nwgAAAD6--DN4NIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14750,"size_decoded":15505,"mime_type":"image/png","magic":"PNG image data, 98 x 98, 8-bit/color RGBA, non-interlaced","md5":"14a91d19c05b182ac493cdf01eeceb05","sha1":"9cf9d4e7982e97d61ddf7f3ece07d854f9deff19","sha256":"fd81a487ea609874a03f5112a9da11e5c09d5b7fa9c9e07afe8aa6fbc1bbfb97","sha512":"bb140ad564b4a5d330ee972030b5faac0e386cfd19a40b4f79aeb33c45f1d1c09eda52aae882b074733b0180d63d26be884f36a531144ee7c46d56e68d1f09c8","ssdeep":"384:IxZ3ZfBJSrYDzMjlnDnU6gQ13tiIqu9D2o:IFfBorLj17JLuuB2o","tlshash":"f962cfd5378212f71d31e58cc983a89c209a594879dc147de4a373de24a228fd0215ee","first_seen":"2026-01-13T01:11:20.631787Z","last_seen":"2026-09-07T00:33:21.652817Z","times_seen":28,"resource_available":false,"data":null}},"time_used":2309,"timings":{"blocked":2000,"dns":0,"connect":0,"send":0,"wait":309,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/af8820d4450f49b09a3df06a9efa14c3?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.420Z","timestamp":1788741144420,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/af8820d4450f49b09a3df06a9efa14c3?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/png\r\nContent-Length: 55116\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 30442\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"af8820d4450f49b09a3df06a9efa14c3\"; filename*=utf-8''af8820d4450f49b09a3df06a9efa14c3\r\nContent-Md5: MxEFpxKYhvmh9/u1NVfkAA==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fk81l_8skdDojJdsVCCElBWF-J-P\"\r\nLast-Modified: Sun, 30 Aug 2026 19:12:44 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: nUQV1kOKp\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: rRgAAABvzR_pxtIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":55116,"size_decoded":55872,"mime_type":"image/png","magic":"PNG image data, 220 x 272, 8-bit/color RGBA, non-interlaced","md5":"331105a7129886f9a1f7fbb53557e400","sha1":"4f3597ff2c91d0e88c976c542084941585f89f8f","sha256":"e4b77b7d301216f10cf525c76e412e0102b78683e99f3ff7b114fb0340e9acce","sha512":"a9ee537ad46f57f95355a3ab9fc443ebec55bb32bf1320a5c8d41a716c9e5479b42165da92c3d2dd71869f3dc3b317b8d0a0517a9f0298acab25237365f6615c","ssdeep":"768:dJUTqHnOq9k4kTew8DEl/LeeH1+f9QbeSEnE510S8/kGbMkGzP3tZ2M1KTaU:DUWZk4kTewkiLeDE3mkLkGRZVU","tlshash":"a533029bd6806cea4d85d6f5cf6058c600142db2a03752a39e1646ab14bcf47de4b7ce","first_seen":"2025-06-30T02:18:01.400548Z","last_seen":"2026-09-07T08:08:08.450698Z","times_seen":103,"resource_available":false,"data":null}},"time_used":4323,"timings":{"blocked":3989,"dns":0,"connect":0,"send":0,"wait":276,"receive":58,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/66aae6da13164a66aa514097fb86ca83?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.507Z","timestamp":1788741144507,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/66aae6da13164a66aa514097fb86ca83?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:33 GMT\r\nContent-Type: image/png\r\nContent-Length: 21854\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 1947\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"66aae6da13164a66aa514097fb86ca83\"; filename*=utf-8''66aae6da13164a66aa514097fb86ca83\r\nContent-Md5: rJDKmWNFYU7HdtGMz/Olhw==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fg4XHj_-EClS_7HWIPQpBmnCJAqY\"\r\nLast-Modified: Mon, 31 Aug 2026 18:51:44 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: JZ7xtTJ8R\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: yK8AAABI-uTU4NIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21854,"size_decoded":22609,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced","md5":"ac90ca996345614ec776d18ccff3a587","sha1":"0e171e3ffe102952ffb1d620f4290669c2240a98","sha256":"1accaf8e6953c0f59b38cc504b2eb46867323cd9a294489a330080770e649ea3","sha512":"4dfbb1e9af1358c035f38772b9c1d4cd26709772e1b1e504d576f02e88ed8ac6530a17b6bffc9c5f33cd53cdab9961653f43d8d269c432bcb6770f4661167d92","ssdeep":"384:rQFrJ6nhZqrfjl48LZRk759cCDwug1YcNXyHl+KRkCWa1cmsclF2ArsfZYyy//Jd:cFJ6nin+8259ccwug1twHkQlsclxsBsd","tlshash":"eca2f13afec022989988279e4303f3e66fe457a238c95b01c3f10516f99c9008c7693e","first_seen":"2025-09-16T02:09:07.420373Z","last_seen":"2026-09-07T08:08:08.309615Z","times_seen":121,"resource_available":false,"data":null}},"time_used":8762,"timings":{"blocked":8506,"dns":0,"connect":0,"send":0,"wait":252,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_188684fd-5a0b-43f3-8a6e-b9c558e44ec4.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.611Z","timestamp":1788741144611,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_188684fd-5a0b-43f3-8a6e-b9c558e44ec4.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/webp\r\nContent-Length: 79930\r\nConnection: keep-alive\r\netag: \"bd7f8602db8e332117b1715d58aef000\"\r\nLast-Modified: Sat, 06 Dec 2025 06:20:07 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 48502\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HJqNSk64%2Be6zxwmWQYXsqnzr3nNX9goKEQMcqRLH6ZPxGJuS8EorWPIkYMR9kpKLbnJJPvvKN2L9oL6QHNhb3u60OVvTLopw3LOZTGnlfH4KbKzESonPkQgghqJWeFD%2BqD0FaIMVbbCfAcwTPHgxDL8%3D\"}]}\r\nCF-RAY: a36cfdb29a8de65e-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c911a07947ddb07f48\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":79930,"size_decoded":80837,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"bd7f8602db8e332117b1715d58aef000","sha1":"7e5e353a2493869ab29d7087ed6854d05eaa1dbe","sha256":"289cf0eaed99d77e8ca59df43b5dd2e5a2e28fc8efbf2b4f918bd33293c6801c","sha512":"b3493bc56d6f778167f81e32ba77c61328584255960ca10373c2bccbe8f13b9f886c806142bd05e1e116ccd835870db787ae4225843b1aced6de971e177f90d8","ssdeep":"1536:1Vx1HKbkHPxLc4OWZ0+j0j8R+dWMIFtCTbYgw:1Vx1H6kHZTOWV0kMGsTbNw","tlshash":"cd7302a40e4e35b3dc0bcb7fb59c8e7606fb9be3251da9c00d55674adad81ad13a10c8","first_seen":"2026-04-24T23:10:16.741634Z","last_seen":"2026-09-07T08:08:08.168078Z","times_seen":1049,"resource_available":false,"data":null}},"time_used":3719,"timings":{"blocked":3297,"dns":0,"connect":0,"send":0,"wait":315,"receive":107,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/kc523-1/sponsor/sponsor_nav_web_2.png?1781011825626","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.662Z","timestamp":1788741142662,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /kc523-1/sponsor/sponsor_nav_web_2.png?1781011825626 HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-09T05:47:36.08732Z","times_seen":18359622,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/ecb/8f8306425ab46d0221b2c56ef50f72e487d5bb0255ee7333091abb7c08c465094a574c3c12d0e1812241fe43c0d5f0ea88d857f698a4fd081b","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:23.431Z","timestamp":1788741143431,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /ecb/8f8306425ab46d0221b2c56ef50f72e487d5bb0255ee7333091abb7c08c465094a574c3c12d0e1812241fe43c0d5f0ea88d857f698a4fd081b HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://g36b.top\r\nXign: TuHSA1zmL/GmWk0zic6xN0Mq6Upn5o0mxDA44QT0dYKIRV/EZOPHiOe6hfHo36kkarT5ot/2eHhua8Osr76AzHlXwouJpydHDoYDbRz/GrRxg6pvXPmj1zeR230v6+20WRF7nwSvAbGwKQ2TL6dVRhtHqOrAO5j4PvKsKEuZTfM=\r\ntimestamp: 1788741143420\r\nsign: 79373f246e1l4e7i\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: aDntxNnwbrytXeEW4SJfGsaRdsx3tyZ3\r\nlang: zh-CN\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:23 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Mon, 07 Sep 2026 00:37:23 GMT\r\nCache-Control: public, max-age=300, s-maxage=300, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nX-Request-ID: d5943c715c00439e8b81133179f73c19\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c911a07947cc067f3f\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":35443,"size_decoded":36273,"mime_type":"application/json","magic":"data","md5":"095ffb23e80f8206842f90301cf2879e","sha1":"68af40b53703a7583fc785cec737af4b06d5d175","sha256":"f1c417a7a5de349aaaa8468236e3efcffdeb9704a439bd0ddc2462fa78f8292f","sha512":"26887e9de127b9e21281ed8b6955a7cc080e6219663fdfdc14eb4d91903b509e0e6088b7e13afaf334b71f7e157a2669245854af7ac22a493d7df87994b2d3d4","ssdeep":"1536:OOCJYIv9OTOWK+lqiz1s+mFtAkRJD8t1nDCpd9uDBEHUz6:rCJYIET4iz1s+mFtAkRd2C39uDBGw6","tlshash":"5c33e1144222f3b09236f8f76b1942d442146f95a697fdf1d620da310ede02ea39f9c2","first_seen":"2026-09-07T00:32:02.764815Z","last_seen":"2026-09-07T00:33:21.658459Z","times_seen":2,"resource_available":false,"data":null}},"time_used":704,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":437,"receive":267,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/b41f24cfac384883bab0eab0b4185f48?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.508Z","timestamp":1788741144508,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/b41f24cfac384883bab0eab0b4185f48?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:33 GMT\r\nContent-Type: image/png\r\nContent-Length: 98476\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 1042\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"b41f24cfac384883bab0eab0b4185f48\"; filename*=utf-8''b41f24cfac384883bab0eab0b4185f48\r\nContent-Md5: hHEh09ibJUfpRxwwCZqH7w==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fn_tJpm_Inyov3NaAjtgZZ8Kx53D\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:47 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: 8yWZL8vuS\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: R5sAAADuYHOn4dIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":98476,"size_decoded":99231,"mime_type":"image/png","magic":"PNG image data, 1200 x 1375, 8-bit/color RGBA, non-interlaced","md5":"847121d3d89b2547e9471c30099a87ef","sha1":"7fed2699bf227ca8bf735a023b60659f0ac79dc3","sha256":"22a48288e217cc8364a647e45da910bedbed06303c47c7b40fb085c486355665","sha512":"afdf72ef73ad59d8a0183c8b19db8967d504d4bbbf46ac3608333d4443be7cc173c0a1e57e1251e28c163abd3f7f2d890cc245880328070bd608d4031bfe2eec","ssdeep":"1536:emZY4ZcMG+DGDcxvCJtKOhMhkgA36aSjGuED4eoNeEMFelE5Vc8wfGokLxwtsums:eIcMGu3FhA36TGVDEkQMVc8wfGjLWmud","tlshash":"4ca3cfc277dc84d1e5dc3933aea4c70d5ca9c7eb7b904d1859909043a65bef4fa688c2","first_seen":"2025-01-29T13:39:14.864552Z","last_seen":"2026-09-07T08:08:08.213376Z","times_seen":148,"resource_available":false,"data":null}},"time_used":8897,"timings":{"blocked":8584,"dns":0,"connect":0,"send":0,"wait":258,"receive":55,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/img/LIVE.88ccbf98.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.604Z","timestamp":1788741144604,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /img/LIVE.88ccbf98.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-09T05:47:36.08732Z","times_seen":18359622,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202606/_webp_size1298x1156_317f68a9-d367-4c78-837b-bba9a02cccbd.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.615Z","timestamp":1788741144615,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202606/_webp_size1298x1156_317f68a9-d367-4c78-837b-bba9a02cccbd.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/webp\r\nContent-Length: 104872\r\nConnection: keep-alive\r\netag: \"7225fe319e0063733dc28dc3cc064ba5\"\r\nLast-Modified: Tue, 09 Jun 2026 11:46:19 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 42542\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9jxg0FrsoM%2B7HdSRXBenfHeOPCb6HRkWfzFk3TzEthj08fGmPQLVGubGC74ghOEb48ZL0moo7TSIHsf%2F1x%2FY4v%2BD87yFQbtFXGcDZwn9CbxNbKM%2FPTFPBRFUlNhM8fjM3bkY7eqSwGsOPjIWqOI8YMM%3D\"}]}\r\nCF-RAY: a36d8f331d241787-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c911a07947df647f49\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":104872,"size_decoded":105786,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"7225fe319e0063733dc28dc3cc064ba5","sha1":"3ace9d566c5ba5d7547e966b52a7718aba214871","sha256":"8512dfacfdccfbee2dcd4b545bfcf151229cf83d6f5ea6d4762d9fa1dbb52724","sha512":"6fc35795ed02e0af6d9e8593948460d2d159871ef64d68fcdb6c3849e1d04e095df2f083e371ad185dec337852c56fe8772e51ba5c23127db88ca78d2b887c20","ssdeep":"1536:Lbtnypjj4aiFU6CcwUrT7oxzAjzIVbxV6FscOAlMIUZdH6/8JEfuI1Q/QY:J8jpAU6iUn7oxzAjzIVbOVlhUZdH2T1","tlshash":"47a312041207b12ef9eecc769e4f92c16d190c357cde1a676abb74c8e206e174d4e8ac","first_seen":"2026-06-12T19:29:57.257753Z","last_seen":"2026-09-07T08:08:08.351046Z","times_seen":699,"resource_available":false,"data":null}},"time_used":4193,"timings":{"blocked":3732,"dns":0,"connect":0,"send":0,"wait":315,"receive":146,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_392325e1-efd7-4953-83f1-410dea55a03c.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.617Z","timestamp":1788741144617,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_392325e1-efd7-4953-83f1-410dea55a03c.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/webp\r\nContent-Length: 13178\r\nConnection: keep-alive\r\netag: \"38581a2c1fb9355639ffb5a31aa0642d\"\r\nLast-Modified: Tue, 02 Dec 2025 14:07:28 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 48499\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=heAgmwr%2FDVXnp6YfOAyUDqfCElk7WzPgJfahRGev0TYahvZyyt3CxnI6B6%2BOBlZwwWv8gdlze4pytaH2vZSiyPClG8qWdxEfo7sVYOdF2Nkp006LabkItfUFE1xHpUudprL7okwFj9qtWPiMdRAYDXY%3D\"}]}\r\nCF-RAY: a36cfdc3ee2a86a7-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c901a07947e01c879b\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":13178,"size_decoded":14085,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"38581a2c1fb9355639ffb5a31aa0642d","sha1":"dc4eee50f114bf0f120b50766fd207ec5522e9dd","sha256":"88d44a033517e73fcf97528b670ccfa16743d61b2c0c7deca8d7fc247e2595d3","sha512":"e1757677642582409db9344003b4c9454757755bf157f2491aabdf2b1c454d3d0073f4b0012faa1e9681397e7004428f087b8a1e338f3812137007909ed9ed89","ssdeep":"384:yPsoyVYHcsbr84JZQ4zAogmntgxn7uxj8+4n:toyVUbrXDQ4UogKWlWQ+u","tlshash":"3542cf151f4044575ecd7aeb108a5ebcc9450918e63cac716493bc388ef09bf4aeb6ed","first_seen":"2026-04-24T23:10:16.737591Z","last_seen":"2026-09-08T23:44:55.118226Z","times_seen":1031,"resource_available":false,"data":null}},"time_used":4242,"timings":{"blocked":3909,"dns":0,"connect":0,"send":0,"wait":333,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_b0506ddf-52e0-4b2d-8f59-16f795505312.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.629Z","timestamp":1788741144629,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_b0506ddf-52e0-4b2d-8f59-16f795505312.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/webp\r\nContent-Length: 47302\r\nConnection: keep-alive\r\netag: \"69bae2574526d5faae2cab421295d6fb\"\r\nLast-Modified: Sat, 06 Dec 2025 06:22:22 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 48498\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ykVu098ihXL%2Fv%2FRfPYEZbn%2FWZNd2SicCqjhqjFlAQiRWexo66MVSanRaBD%2Bk5AfxOxJmifKtXj9W4FUzqBlW4tN1v1Z4oStACE%2F2guOLFV6vbU%2B1cani9XiYpoV9ZgM%2F2DAB7d8yjZ5dT2Jy6IsSivY%3D\"}]}\r\nCF-RAY: a36cfdceb848dd9c-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8c1a07947e339812a\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":47302,"size_decoded":48219,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"69bae2574526d5faae2cab421295d6fb","sha1":"9fbb080feb70d0129b259ee1836a307e2f43a7a7","sha256":"24dc34c37f47f8b318cd186472dfb0aba29bc601bb589497d9131322abf3f12f","sha512":"b6b43f6f2a27bf41323dab6e956cf9e581be28a51078e3ec6568b79a145135dba1644d3e3b8e0a5bb8e7c8fdc132ea34c5002e2c81fa15a9e29e581767b9ad00","ssdeep":"768:3ZnM3sRPLsymAdeJz26xNEyuGpVt/5NS6xUdP8Hx3JZa1pASN7ZWjcTH:JnusBypuGLZnStl8HcjASN7ZW","tlshash":"6223f2c4856c2f711255d3f8ffa06b48c6783940bff8afb69f360a65186d2d2c90a44e","first_seen":"2026-04-24T23:10:16.805393Z","last_seen":"2026-09-07T08:08:08.24576Z","times_seen":1036,"resource_available":false,"data":null}},"time_used":5067,"timings":{"blocked":4711,"dns":0,"connect":0,"send":0,"wait":323,"receive":33,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/d2250eb262974e82bdbe403f778df33e?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.470Z","timestamp":1788741144470,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/d2250eb262974e82bdbe403f778df33e?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:31 GMT\r\nContent-Type: image/png\r\nContent-Length: 106336\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 23549\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"d2250eb262974e82bdbe403f778df33e\"; filename*=utf-8''d2250eb262974e82bdbe403f778df33e\r\nContent-Md5: 4qwMw9CE3DM5QBwOvN3RHg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FtkFLT3DM7kz6p8yaZbVMmO-zdJc\"\r\nLast-Modified: Mon, 31 Aug 2026 12:48:07 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: Hv8Idwiu2\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: E8MAAABrYM0uzdIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":106336,"size_decoded":107093,"mime_type":"image/png","magic":"PNG image data, 293 x 339, 8-bit/color RGBA, non-interlaced","md5":"e2ac0cc3d084dc3339401c0ebcddd11e","sha1":"d9052d3dc333b933ea9f326996d53263becdd25c","sha256":"f39fe9d83c4391875d8da9f46d1fa5bb4d4d785a9f77707f0492eb3c7d084cb5","sha512":"c324d18adb045d07b94502def4ad55f2df88c31404dce7bd26345a17119bee876c3ba4fe7a804557fb33b836e7592f6ce5080cf607ba02308f414d0cdf266b60","ssdeep":"3072:GLt0rIUKwNB67gHOLU2wCYRmmYsjnNtjqwwJS:QOzA7guLUfCYRmmYsjN5q3S","tlshash":"7ba3126b6fcab4c116e40fdd43ddbfcf289e20a54b0e8eabc458a0465407ac15b7ec80","first_seen":"2026-03-14T23:53:38.337678Z","last_seen":"2026-09-07T08:08:08.265997Z","times_seen":77,"resource_available":false,"data":null}},"time_used":6943,"timings":{"blocked":6617,"dns":0,"connect":0,"send":0,"wait":266,"receive":60,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/b47b9c7b3d6d46ac8ee3734c13c8d45a?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.458Z","timestamp":1788741144458,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/b47b9c7b3d6d46ac8ee3734c13c8d45a?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/png\r\nContent-Length: 18151\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 27128\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"b47b9c7b3d6d46ac8ee3734c13c8d45a\"; filename*=utf-8''b47b9c7b3d6d46ac8ee3734c13c8d45a\r\nContent-Md5: RgaP6OoGk4mdJ3bjxpmRkw==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FgKVAq46SJlA6IY1z206jxQzu86n\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:51 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: ALxE8sqlR\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: XVQAAADSdSjtydIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":18151,"size_decoded":18907,"mime_type":"image/png","magic":"PNG image data, 140 x 165, 8-bit/color RGBA, non-interlaced","md5":"46068fe8ea0693899d2776e3c6999193","sha1":"029502ae3a489940e88635cf6d3a8f1433bbcea7","sha256":"940b34ed1a624dc430bc65373362ecea78b4e034f0fc8c28edc930ce59731469","sha512":"9e979c7da385e6bdce83b8e2f9d0f0e0b3ed6a3ab09f45696b083de2d48c008290d243663a54f1918081f597a36aed45e347b7733e81dcb43525dff5b3abb1b8","ssdeep":"384:mZBs3VhR84Li9zjljKfsbwFIEgrCQoEcIkRMGgJ6JVg32t:mZS3vR8FJ1bcIEvQo7RM5cuA","tlshash":"ff82d0ed9bd090ddafbe7a9b0b02225815f27ab5e17609c43d0be2b30471ade5847c58","first_seen":"2023-08-24T20:41:52Z","last_seen":"2026-09-07T08:08:08.115899Z","times_seen":54,"resource_available":false,"data":null}},"time_used":6232,"timings":{"blocked":5971,"dns":0,"connect":0,"send":0,"wait":259,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_b82399e1-d771-428f-9811-f7e15cda0f21.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.648Z","timestamp":1788741144648,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_b82399e1-d771-428f-9811-f7e15cda0f21.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/webp\r\nContent-Length: 103194\r\nConnection: keep-alive\r\netag: \"f704aac32ea52a31d6fc3ed2cf265934\"\r\nLast-Modified: Sat, 06 Dec 2025 06:26:28 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 42521\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=K9SzKMlNrPVaHW7Sf1DNJUyk4Ewo19F9ND0XXzFIoGsmcm9p77NxdvDifpGB7nNvHnnIEISkwDJ4uPp5BylW8WMziB%2FZCkQhwPuig5pBUDseBfyFSWK%2Buppm5eGcgcptYrliM9c6HYpgyAzxbsYWlZE%3D\"}]}\r\nCF-RAY: a36d8fc50bdfdd57-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8e1a07947e7b077ef\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":103194,"size_decoded":104102,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f704aac32ea52a31d6fc3ed2cf265934","sha1":"45282832d890a7ff431a3e080bf45820996e1377","sha256":"0177775ecd75f420bfdca35ff7886a7e7c2be56137652084986057b7e1566a09","sha512":"6f0b988c4ffe01ea848e549c9856a39d00f127a59b0bee21b29601f055eb98ef5fd349d6b7290257bb3845ecc7ea55a6d103173ba7e689c1d4303fe1c0e8ff9e","ssdeep":"3072:CgsNR4fWsUvdSDU+qlX2KtmzD/CbIGM1:Cg8R4fWSVKYibIG","tlshash":"1ea312850993c5f1bb7598259f7acb20a51a7d70f392ef21cfa94f3ec0b50799a14242","first_seen":"2026-04-24T23:10:16.761671Z","last_seen":"2026-09-07T08:08:08.3004Z","times_seen":1206,"resource_available":false,"data":null}},"time_used":6174,"timings":{"blocked":5845,"dns":0,"connect":0,"send":0,"wait":302,"receive":27,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/45f87a7bfb2d42399acf550a791ed449?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.421Z","timestamp":1788741144421,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/45f87a7bfb2d42399acf550a791ed449?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/png\r\nContent-Length: 39150\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 30442\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"45f87a7bfb2d42399acf550a791ed449\"; filename*=utf-8''45f87a7bfb2d42399acf550a791ed449\r\nContent-Md5: GqHljGMMS0WXCbN9xkS+3Q==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fn3QpJl3X_G14nzpX5_gFBaU8icE\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:33 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: E6sjbNHgh\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: s6wAAADmuSfpxtIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":39150,"size_decoded":39906,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"1aa1e58c630c4b459709b37dc644bedd","sha1":"7dd0a499775ff1b5e27ce95f9fe0141694f22704","sha256":"2c5cee97443e4057fa0af320bed82532c8ed8338023addca8775696eafb66632","sha512":"7e1f6f8fbd9e24566389da5a29b693f2dab36185244f2eee362d6f95948b31bd55daf6795e031403e18f6f49bf11a0fc0557fd807f6b2552445763e8ad5c0118","ssdeep":"768:unYPkYCk+6jPkGo46P1iz5fIsPvzWRae4iwhgx1k8pdZGQzuVzc82:unEkYp+6jG46PpsCce4iwhgrF4QzuVAh","tlshash":"5e0302e53638d9001ebd8e64fea2208fe3aa8c334745fe808fe451b5d25511e58f74aa","first_seen":"2025-12-25T05:46:19.642941Z","last_seen":"2026-09-07T08:08:08.395499Z","times_seen":11,"resource_available":false,"data":null}},"time_used":4291,"timings":{"blocked":3989,"dns":0,"connect":0,"send":0,"wait":268,"receive":34,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/30077e0993104d59b71a99471ac6923f?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.424Z","timestamp":1788741144424,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/30077e0993104d59b71a99471ac6923f?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/png\r\nContent-Length: 62962\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 30441\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"30077e0993104d59b71a99471ac6923f\"; filename*=utf-8''30077e0993104d59b71a99471ac6923f\r\nContent-Md5: kLFJBLpaaJVIS7pz69/diA==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fo7XGpJ8QXlyOUy7dckJloHu5eqt\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:38 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: pQXw9OYDx\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: HxAAAAAPdjrpxtIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":62962,"size_decoded":63718,"mime_type":"image/png","magic":"PNG image data, 296 x 336, 8-bit/color RGBA, non-interlaced","md5":"90b14904ba5a6895484bba73ebdfdd88","sha1":"8ed71a927c417972394cbb75c9099681eee5eaad","sha256":"ebc4285c2ded91a1574e2a864fa1f59a3523fd040b9da90f353409caca01c281","sha512":"8cdcdcd5886ece371ef477a42d32921626a3e8b9b9c60f7df2de2d2cfc424475c843709ffba435cbb11fa8498078dafe0d5b0c8aa1cf82052a410ff56f74f298","ssdeep":"1536:WT1FV1TyccN96rvN92ZBJ+2wl7pZuOf930ccMJB19+I+yW2Z:WT1j5cNkTToJalVZ150cc4BD+I+O","tlshash":"485302edcecb24a7b3d7542145574fb74cb4bb9b4660868a7cecc3501864a1ed060e5c","first_seen":"2025-02-26T13:00:34.791821Z","last_seen":"2026-09-07T08:08:08.184688Z","times_seen":30,"resource_available":false,"data":null}},"time_used":4562,"timings":{"blocked":4271,"dns":0,"connect":0,"send":0,"wait":259,"receive":32,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/88f3b65411a24a4f934212dcff60a4ab?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.457Z","timestamp":1788741144457,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/88f3b65411a24a4f934212dcff60a4ab?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/png\r\nContent-Length: 24735\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 27128\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"88f3b65411a24a4f934212dcff60a4ab\"; filename*=utf-8''88f3b65411a24a4f934212dcff60a4ab\r\nContent-Md5: deA4r3mWuNgC0ORHDWdkuw==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FrKfGJAfMbGGrfes5ryEaD6jT8cI\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:51 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: 9MKmMg1yi\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: V8AAAACVIybtydIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":24735,"size_decoded":25491,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"75e038af7996b8d802d0e4470d6764bb","sha1":"b29f18901f31b186adf7ace6bc84683ea34fc708","sha256":"175855ae9f161e907172bf8fe42b07370d52c70d40134e804e5e8d9355e0379c","sha512":"42c5ff44eb452aaa32f3179bdeb6c0fe4eb3f56fd151844eeaadebc090cba2c9e7695bbe94466a5bfb0af3aaa7c7276e9445829911e49c37d33bd10b15e1d6f1","ssdeep":"384:gcGtSsa7iolIr5uqL+7h4aCD1RXGDElpm7ebHufzEL6+jZ8Sj8x6cDdr0Lltsf:ZqrwqL+aamRVyCbOfzEL6+tRjgdr9f","tlshash":"c0b2f19bf810e9c134746d74a0611ba81d9dcbd8e0832d95796f8709baf438d0e2b17e","first_seen":"2025-09-14T12:41:24.902398Z","last_seen":"2026-09-07T08:08:08.068482Z","times_seen":47,"resource_available":false,"data":null}},"time_used":6184,"timings":{"blocked":5908,"dns":0,"connect":0,"send":0,"wait":263,"receive":13,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/0a22d9c1176548278d5340b9b4e90141?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.478Z","timestamp":1788741144478,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/0a22d9c1176548278d5340b9b4e90141?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:31 GMT\r\nContent-Type: image/png\r\nContent-Length: 15567\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 21742\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"0a22d9c1176548278d5340b9b4e90141\"; filename*=utf-8''0a22d9c1176548278d5340b9b4e90141\r\nContent-Md5: QXpVjflqJPl+6WFXsiJn3g==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FgzAFKitrbv-Pn7jQ-SwRTUMX0AM\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:17 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: cKRMT4Wr7\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: arUAAAD_1WzTztIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15567,"size_decoded":16323,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"417a558df96a24f97ee96157b22267de","sha1":"0cc014a8adadbbfe3e7ee343e4b045350c5f400c","sha256":"6608076eb315606a38f4c461ff1afab265279cfa23981aad774af4fb892ffa92","sha512":"8411684598c8cfea1bfe9ee1a0ddeebfc78d92f8987d3a14d65a2f51ef9dfe0528ebe72cf37912120fb284f775e3ffb2a43f00cd19a4531c0299116e9af6d622","ssdeep":"384:CeoZxsPVDbitN4GOvaFFtfqpMmBHUUne0qmoYbOUX:CeMsdDbWF7yppe0QMX","tlshash":"e462d19779c224146a30b1d7bf7e94388219823a1cd12de2d8dc84b1ffd9d60aa7c368","first_seen":"2025-08-25T20:56:20.891943Z","last_seen":"2026-09-07T08:08:08.157046Z","times_seen":31,"resource_available":false,"data":null}},"time_used":7328,"timings":{"blocked":7056,"dns":0,"connect":0,"send":0,"wait":272,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_e50c5112-b480-4217-95c2-f187843fa431.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.630Z","timestamp":1788741144630,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_e50c5112-b480-4217-95c2-f187843fa431.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/webp\r\nContent-Length: 54466\r\nConnection: keep-alive\r\netag: \"d564e11aa2a3009b6985896da404739e\"\r\nLast-Modified: Sat, 06 Dec 2025 06:22:05 GMT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rb7MBxYqqvUlYUUD6hL5z9DmSU8E9W1jpK0f0H%2Fz3U6x3J5dzvqDX6QeulezicM3RikVSQp5LPT66iZyz0XFyNpP8akXVjigO923G2ZE8mT3Uh%2FCDsi7%2BZ%2F4qCxxa1XOr%2BPdk2KAURlmayrvXi%2BiiFs%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 48498\r\ncf-cache-status: HIT\r\nCF-RAY: a36cfdd05ac706e4-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c921a07947e3a783f9\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":54466,"size_decoded":55381,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d564e11aa2a3009b6985896da404739e","sha1":"5701d82c9e2fd24ec69db4bdc9ee3e32cffca139","sha256":"75d785fba01e17e56ae0ba404eb302e8537d3a7b7f84d11128164946a3987384","sha512":"1f6a7673f6ccb42f0f1e5135154db412145225615504419fcd52655726f8ac4c85ec419c54167c1d4e71c60cfbd30f87f7bc07d53858adb3e30e184f2fdb5623","ssdeep":"1536:+USdyAD4v4ReUeNhO2po1VPvBu3czLES5WjB6lieR:Wdym04TGeLvlQAC6geR","tlshash":"fa330269024c6463719556f833feb42aa760a7c63801a4799a8f3594fe24ce874cfd6c","first_seen":"2026-04-24T23:10:16.721458Z","last_seen":"2026-09-07T08:08:08.143587Z","times_seen":1043,"resource_available":false,"data":null}},"time_used":5144,"timings":{"blocked":4821,"dns":0,"connect":0,"send":0,"wait":309,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/13575.1781011881923.cda1d494.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:19.399Z","timestamp":1788741139399,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /js/13575.1781011881923.cda1d494.js HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:20 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-2f964\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8c1a07947c1f8810e\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":194916,"size_decoded":59956,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65535), with no line terminators","md5":"65e5fffbcacf52710ad963a4aeede3be","sha1":"f9c16a3c86649aeacf18e736faacff0cf78192e7","sha256":"36f42498ee253b0d1d5e7ec8bdf406f05c4c91e72f64169b1ff67435d2069099","sha512":"96e8263c115ca75ff63f6ce70ba8ad5af370662f86c2f95a8960a5aa5a30ce4134fa01d7fbd1694ce37f111b69e3e418f0542a7ab1bae4cec570c8c3d8d08986","ssdeep":"1536:917BBHFeKRKp+3ELSPtj6x2DgJoG7PIDmj9VA+s69JAFdE6WIzl+Ik1+eXMa7a4H:7jHoKRKphCnDgJoec+IDWIzls+7Xr0X7","tlshash":"23141a84764170b8c396a165322f601ae22f789650dd9c24f3789ba47f7470df26fabc","first_seen":"2026-06-12T19:29:57.266361Z","last_seen":"2026-09-07T08:08:08.0914Z","times_seen":1236,"resource_available":true,"data":null}},"time_used":2109,"timings":{"blocked":1448,"dns":0,"connect":0,"send":0,"wait":389,"receive":272,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/img/left.34013cd8.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.670Z","timestamp":1788741142670,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /img/left.34013cd8.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://g36b.top/css/home.1781011881923.38488e2a.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:24 GMT\r\nContent-Type: image/png\r\nContent-Length: 237\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nETag: \"6a281707-ed\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nAge: 48513\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c921a07947cec783eb\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":237,"size_decoded":691,"mime_type":"image/png","magic":"PNG image data, 14 x 44, 8-bit colormap, non-interlaced","md5":"5ecca260da6fc5e2843405c20ac69817","sha1":"3918cfad7493b6860ded9e259ba90bc6a853f1b1","sha256":"078a4aac39c49a33cbabf23cda7579fa7b76e875e6b6d24d16cfcbf9f8b250df","sha512":"b76a870a79a87a450e5d30a218d75093b57415c563e64a8ffd6839a31b36379dbc08398698b9c1368ecda671d65045d5cfebe3363b98d746d89dcaad15bcd8ce","ssdeep":"","tlshash":"6dd0a99be2076faed1c70bb3732e0ca18a8124e892944b088042c622ca663a1dd82042","first_seen":"2025-08-29T11:05:53.221032Z","last_seen":"2026-09-08T23:44:55.114767Z","times_seen":2774,"resource_available":false,"data":null}},"time_used":1767,"timings":{"blocked":1463,"dns":0,"connect":0,"send":0,"wait":304,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/24a4855f9a2a4334b3105c8028f4430a?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.418Z","timestamp":1788741144418,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/24a4855f9a2a4334b3105c8028f4430a?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/png\r\nContent-Length: 71471\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 30442\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"24a4855f9a2a4334b3105c8028f4430a\"; filename*=utf-8''24a4855f9a2a4334b3105c8028f4430a\r\nContent-Md5: ewIkBXvs3iVy3+NXuGfkZg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FuO5jLPNnPsGL5E189LPjYPwhSY1\"\r\nLast-Modified: Sun, 30 Aug 2026 19:12:44 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: sh8FkEFKE\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: T5wAAAAoJhnpxtIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":71471,"size_decoded":72227,"mime_type":"image/png","magic":"PNG image data, 316 x 316, 8-bit/color RGBA, non-interlaced","md5":"7b0224057becde2572dfe357b867e466","sha1":"e3b98cb3cd9cfb062f9135f3d2cf8d83f0852635","sha256":"3e5f35ad7e8fd2b1bce3019ae404f4377cf2618c073affeff983e9d992b5aecc","sha512":"118d2df31abff38dd2e58a989a1bcc5476432648bee41676d687eed5c949a1696ae578afaec41baa2aa5c1adecae795a2a10ad59daa8988aab33dc42a49d9171","ssdeep":"1536:0KTgPllt35/l0o0N/lhVlEY7yMg7eS+3vdJq+x74UJ4M3k:hTgdP35ylhVlEY7VweS+3v7CUJ4/","tlshash":"7a6302a4f246a166bf4178f12a627d150fc43474bc7ac230dcb5b862369c2a7e1297e7","first_seen":"2023-08-17T12:39:30Z","last_seen":"2026-09-07T08:08:08.342586Z","times_seen":245,"resource_available":false,"data":null}},"time_used":4329,"timings":{"blocked":3967,"dns":0,"connect":0,"send":0,"wait":272,"receive":90,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/e7062f58d1a54bca9c38dcc38f290372?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.450Z","timestamp":1788741144450,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/e7062f58d1a54bca9c38dcc38f290372?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/png\r\nContent-Length: 16100\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 27129\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"e7062f58d1a54bca9c38dcc38f290372\"; filename*=utf-8''e7062f58d1a54bca9c38dcc38f290372\r\nContent-Md5: BDhAIWlIr+aebJzfGMCRog==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fnhxev8qJGXlW4ZhRlKhaD-63-ot\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:49 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: 8Hs0ZiTI5\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: UWoAAAD8xvnsydIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16100,"size_decoded":16856,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"043840216948afe69e6c9cdf18c091a2","sha1":"78717aff2a2465e55b86614652a1683fbadfea2d","sha256":"c888759f8c1afd81525a1c5d706b5c96d5424d68327361196fd3b3e4770c8b2b","sha512":"2302b6a8ac8618d683afa05ff2531ebddec66e07dbd7d3170737279cde6e296e9db88c2289c78e5c74077740785bd1f1e9fc9c90e44e87286e9b39bdce7a4ab0","ssdeep":"192:TGmxf94W4+fejIbrrf3WGZ20MTeiQtuATswAyK9LbvVt2ziQssF+JAKRwhS0Gt9w:jF4W76IbXv49jAHAy8t21sM+JziS0/","tlshash":"e672c00d96470b32cb7076f58e46a15d315089d1a3b00f6b0c9aa93c71d7be8757c3a6","first_seen":"2025-02-04T17:13:00.905748Z","last_seen":"2026-09-07T08:08:08.194673Z","times_seen":32,"resource_available":false,"data":null}},"time_used":5910,"timings":{"blocked":5644,"dns":0,"connect":0,"send":0,"wait":263,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/api/sport/match/list?sportId=1\u0026client=web","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:23.433Z","timestamp":1788741143433,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /api/sport/match/list?sportId=1\u0026client=web HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nx-request-source: https://g36b.top\r\nXign: Wz+xzw/J8qwFJK/K/lOBPLyduvltskj46dabzvKm4yoyAH7TpHkPFTWI7nnBQjQFMZW/buweavAvjoQLRPuNKTUKoxoyov2DC/zcCKprimtR/OywjiSoS7lKB45xhVdb6tycu2LTM4RmFJ02O4TCCdwI0J6u3CSaGLYnQK3eFWQ=\r\ntimestamp: 1788741143418\r\nsign: 7h1f3f2b1s684926\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: aDntxNnwbrytXeEW4SJfGsaRdsx3tyZ3\r\nlang: zh-CN\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:23 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nCache-Control: no-cache, no-store, max-age=0\r\ncontent-encoding: gzip\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c921a07947cd4683ea\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":43155,"size_decoded":8084,"mime_type":"application/json","magic":"Unicode text, UTF-8 text, with very long lines (41333), with no line terminators","md5":"3b440ce0b34025506039466efadecb45","sha1":"3f85b3595e6500fdbc3ee6784f34e9aba1c8f919","sha256":"f82788589fb4e8328d93a98db6933677ade975e71af899fcfe98f83f7960685a","sha512":"c920d9c4c1de903d14f0234dba4466b4907186abe559a6efc13a123ba58c248be10efda0db8b1127f1620596cc3d3866675a624fdeba3c65e71dd42a48d74cda","ssdeep":"768:eNCrhqfHg2vcycTd1i0hEKpRb3qOv4dxvUwQYRwJCdxtdtgHRsX16sQP2ssc5sj9:es2mp3/JVsUsdslsgR6RiRR00S0D0jHd","tlshash":"64130e5291de28961b9c61d55d1d3f4d887eba0b0a9ef6c9ee4ecf1821b43fb9300d21","first_seen":"2026-09-07T00:33:21.617637Z","last_seen":"2026-09-07T00:33:21.617637Z","times_seen":1,"resource_available":false,"data":null}},"time_used":628,"timings":{"blocked":315,"dns":0,"connect":0,"send":0,"wait":313,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1280x294_3ce652c0-55c8-48f5-a72d-a300accd6573.jpg","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.030Z","timestamp":1788741144030,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1280x294_3ce652c0-55c8-48f5-a72d-a300accd6573.jpg HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:27 GMT\r\nContent-Type: image/webp\r\nContent-Length: 33078\r\nConnection: keep-alive\r\netag: \"0a0135f97e5634a3589065dc1f4203a2\"\r\nLast-Modified: Wed, 10 Dec 2025 10:48:35 GMT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aHoDH5RSze7pDA%2F0%2FmaliAr13d9WM74Xg8hDJ%2BVeDYo0HX8ixjuiuUzk7JaBFL8jPZERmXuUm7wwEH%2FOoN6zi0lX%2BfSJ17eVJ0HHMqR8vT%2F%2Fq5L9riLx3%2B6ExQbyPziKNIYwG1reD5UIN5GBY8Ye3Zg%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 31020\r\ncf-cache-status: HIT\r\nCF-RAY: a36ea8783e318579-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c921a07947dce983f4\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":33078,"size_decoded":33997,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1280x294, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"0a0135f97e5634a3589065dc1f4203a2","sha1":"0606b7a4f7dd769e8f68c0b444764bfdabd584dd","sha256":"b615b66587167edb3c9283e97940d3fc3f1f1bc910e6d3c98c55015a6bb3fd94","sha512":"bacaeaae43764c19a7148549deea3aad9d04df47cc2f25ce0db95d356b2c6fb46884ed4e9b16f6ef3e3467392fd71343509495dd68eef11cccc779dcc1b35ae4","ssdeep":"768:rWixhnCoTUtb7DBUFrJLDUJmEBsReZrbHf4K:rWivRTUt3DI1cJmEBs8ZrbHt","tlshash":"aae202d5b06953b1fe1439d3fe5cae680b2810b7edc74ce59e1bc95e819c2805ae1918","first_seen":"2026-04-24T23:10:16.804529Z","last_seen":"2026-09-08T23:44:55.193872Z","times_seen":1009,"resource_available":false,"data":null}},"time_used":4038,"timings":{"blocked":3723,"dns":0,"connect":0,"send":0,"wait":308,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/72ba9b74fd4a4f95b6548763536cfb98?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.456Z","timestamp":1788741144456,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/72ba9b74fd4a4f95b6548763536cfb98?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/png\r\nContent-Length: 21756\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 27128\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"72ba9b74fd4a4f95b6548763536cfb98\"; filename*=utf-8''72ba9b74fd4a4f95b6548763536cfb98\r\nContent-Md5: yxNMWsR+RtYW0bVzt1fprg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FglYaITzo8EEx7yKdoOSM_mn5HGQ\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:57 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: 0G5tGnrAB\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: 6-IAAADn9xvtydIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21756,"size_decoded":22512,"mime_type":"image/png","magic":"PNG image data, 149 x 149, 8-bit/color RGBA, non-interlaced","md5":"cb134c5ac47e46d616d1b573b757e9ae","sha1":"09586884f3a3c104c7bc8a76839233f9a7e47190","sha256":"45769fc965270edc6d0d1616ea94fa6815fe39a9c863a83fa8cec077784133d4","sha512":"344cd6bc3d5350a9e310e2138aadb034a8e0f420397e0b9961e3db4ebc1ae6d585aecfd515e89e1a6dd73087f9f9c7a0353e20c3c2df1cb9eedb7bff8a56aba4","ssdeep":"384:fBLw+lg3YZgDh9zq7UzK29zKJ7fww+8VQMkKXHKrx:fBLwwwhJqIz7dKZYDSkKXKt","tlshash":"22a2d09c74f051eb152fe91229cee6dab3f3b197140b8abeca5775208bfd008063a5d5","first_seen":"2024-08-19T14:24:45.256534Z","last_seen":"2026-09-07T08:08:08.381355Z","times_seen":92,"resource_available":false,"data":null}},"time_used":6170,"timings":{"blocked":5906,"dns":0,"connect":0,"send":0,"wait":259,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_04beb05f-bdcc-4bf4-a35f-b560e45e45b0.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.635Z","timestamp":1788741144635,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_04beb05f-bdcc-4bf4-a35f-b560e45e45b0.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/webp\r\nContent-Length: 73676\r\nConnection: keep-alive\r\netag: \"41e79b39dc26bbaf7f40e04fea71c634\"\r\nLast-Modified: Wed, 10 Dec 2025 11:53:06 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 48497\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1A%2BhLq1367mhdq1RMBdg9%2FSSrtUhgybKKu0uZqYEiZ4Im72L8i7gsEMkVXBpNWbqXif6lhhjjQnn0GK8TsgYn%2B%2Fk0ccgwiFHH9cGR7wb%2FQD5ahR3PFwqxUVYF%2F2wMRmHenoANG6Bp6lRBmp7bAC878Q%3D\"}]}\r\nCF-RAY: a36cfdd70e8cdd53-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8c1a07947e49d812b\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":73676,"size_decoded":74591,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"41e79b39dc26bbaf7f40e04fea71c634","sha1":"477586286821f2dab7b013e04ff4921b7719f121","sha256":"a6091cb61f7968a02345dfef2905c4f62f401345fb3fd5d2bdf5306416b50d90","sha512":"5fd2068c26d3d5e6995cbe847edecc9145c7abcdfee76ed94e1db9b97da7abb651e8dc990d06f05d2bc9b04cfbaa5c9cb41fa32da479554d64e47eb91e01fe56","ssdeep":"1536:Dsmee6MaqRp352dNFckeb6yTb6Kpmd4xIccPip688s23Z72HuJjJrl:gEaqRfoeb6yTb6KsdiIccuE3Rfrl","tlshash":"c7730143ccff7298de2c687e0d5e0caa191442443f8c0ab3e6e5615571697af36b32b8","first_seen":"2026-04-24T23:10:16.752534Z","last_seen":"2026-09-07T08:08:08.222337Z","times_seen":1058,"resource_available":false,"data":null}},"time_used":5447,"timings":{"blocked":5066,"dns":0,"connect":0,"send":0,"wait":323,"receive":58,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/css/chunk-common.1781011881923.90261a1c.css","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:19.384Z","timestamp":1788741139384,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /css/chunk-common.1781011881923.90261a1c.css HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:20 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-34c8\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8e1a07947be9c77d8\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13512,"size_decoded":4507,"mime_type":"text/css","magic":"ASCII text, with very long lines (13512), with no line terminators","md5":"18db28ed82e6a8aa84b4ca311e8effc9","sha1":"19d1c3f13ce483b564653631f2bd6a340017a84b","sha256":"8d0fd3816e0960390ac6c9757e98a97c96597871468e74a8dcb81f170ad98303","sha512":"dbee6bb335fe964df137f44bbd9752844d5baeeec889ffb5c21c9979a8ce51018f81dadd4a66b2016a30874962c6e4fd2243325fa60958d45d06f34bdee72b87","ssdeep":"192:4dQK/X4cBY4mZGX1lsUTLA7gYER7/i//LN4hHSQZA2VxM2XwKjv0:M8oTGER7/i//LihHBrxP0","tlshash":"c952a631d634b53ce57be226f9d09adc6024d417e2730baeea643b3ac5ca4d215332c8","first_seen":"2026-06-12T19:29:57.231975Z","last_seen":"2026-09-08T23:44:55.111675Z","times_seen":1244,"resource_available":false,"data":null}},"time_used":950,"timings":{"blocked":-1,"dns":0,"connect":297,"send":0,"wait":345,"receive":0,"ssl":308},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/theme.config.ef94991b.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:19.388Z","timestamp":1788741139388,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /theme.config.ef94991b.js HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:19 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:10 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281706-1a62f\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c921a07947bd7383e6\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":108079,"size_decoded":16524,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (38260)","md5":"90d279a2980268d2835cec593c23d286","sha1":"4374bf6da5cbdf8f025434137487bda68077cddf","sha256":"1679f19badc24dea0edab376edfb8583714645e18f705fb849037af6cf0b3ff8","sha512":"362ec1b73cebe1ad224a5b745c9ceebf2b86301deab27e35d6517d499499328b34c24d76a72e5b348d623e64a4d17bfa0ab08d2aa012f02af23c6a72df51817f","ssdeep":"1536:D2JREobVmtlIRM4Sb2mcTa2mnzyJog9CcHWHA:qEtlGu1Jnz45HT","tlshash":"c0b3bb7ae20c963a6177a8bfb46ce111d12f9c0c9b1d5fdef03e60a25710669c831de9","first_seen":"2026-06-12T19:29:57.324936Z","last_seen":"2026-09-07T08:08:08.216605Z","times_seen":1248,"resource_available":true,"data":null}},"time_used":745,"timings":{"blocked":290,"dns":0,"connect":0,"send":0,"wait":445,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/index-399e2569.1781011881923.9d909473.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:19.403Z","timestamp":1788741139403,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /js/index-399e2569.1781011881923.9d909473.js HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:21 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-5cdf\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c911a07947c2f17f39\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23775,"size_decoded":11125,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (23775), with no line terminators","md5":"a89a32dae8cc80557b581a69e02f0d02","sha1":"00f9cfeca127af0a139c0670ed8d2e2e7ccf673b","sha256":"6f97c8ce9605a8e9e80a699696c70ec26a4b9bce20badaa6947bf4e5ac52e9d2","sha512":"2ca5bc054575932085e6cd6529613a94f145aa9a3b7731fb85b97b27286a882043110ab45b7eb4673228185ce1560b47968d3aa7b77492f17abf82e778076a9b","ssdeep":"384:pZTANHmDGIaVPkrTBTcK8K+Ehn6A3zgJ9Ks/fT5qZsxbt85F3oWf0Af/nwtU8Zci:znDGIYPkPVf8K5hn33UnKofy5FYxAfPY","tlshash":"e2b2b6e63392bdb8c24f9676f23a58ecc43f9141c30fc4f8d265bd947d98644aa92784","first_seen":"2026-06-12T19:29:57.227313Z","last_seen":"2026-09-07T08:08:08.428383Z","times_seen":1211,"resource_available":true,"data":null}},"time_used":2015,"timings":{"blocked":1696,"dns":0,"connect":0,"send":0,"wait":319,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/5a6b98ef45d84a4db8947dafba0fa8f5?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.400Z","timestamp":1788741144400,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /img/fb/team/5a6b98ef45d84a4db8947dafba0fa8f5?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-09T05:47:36.08732Z","times_seen":18359622,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/8e0b4708584649639eaf06ccd543d376?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.425Z","timestamp":1788741144425,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/8e0b4708584649639eaf06ccd543d376?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/png\r\nContent-Length: 72761\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 30441\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"8e0b4708584649639eaf06ccd543d376\"; filename*=utf-8''8e0b4708584649639eaf06ccd543d376\r\nContent-Md5: 8TCs5nXTD09zQmkhUpcbpA==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FuxoD3QIQDBAq4ks4aHz01Ho8zpu\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:38 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: jrmAaiTFe\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: sRMAAAB-Uz3pxtIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":72761,"size_decoded":73517,"mime_type":"image/png","magic":"PNG image data, 311 x 320, 8-bit/color RGBA, non-interlaced","md5":"f130ace675d30f4f7342692152971ba4","sha1":"ec680f7408403040ab892ce1a1f3d351e8f33a6e","sha256":"f2073cc39556a683a5e26bdbccd0ceecf725a95952e3ed5e1d400f9089f3c7cd","sha512":"b2a28dbc1f2ce27b9560098dc11f7f18c38e1fb8a23ab86fafc219f9faffeda0edf475cf741436aa17dcd865929ea619793c557d10c9ea4057b26d528ced95d6","ssdeep":"1536:7wK1N2HqC3TPozwCJkqEmYKAq3sr6UCxBgDCsRW7lWFBUR:73v2zTPaneqEi13sr72KZW7l6g","tlshash":"0f6312ee104b609046f0b507e16b61dac91387e1698ec94662efcbcce6c31fd9498c3b","first_seen":"2025-02-24T02:30:01.47674Z","last_seen":"2026-09-07T08:08:08.230339Z","times_seen":59,"resource_available":false,"data":null}},"time_used":4640,"timings":{"blocked":4291,"dns":0,"connect":0,"send":0,"wait":268,"receive":81,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/4784e379dc2346aca287ccb96aca9166?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.487Z","timestamp":1788741144487,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/4784e379dc2346aca287ccb96aca9166?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:32 GMT\r\nContent-Type: image/png\r\nContent-Length: 135637\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 19030\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"4784e379dc2346aca287ccb96aca9166\"; filename*=utf-8''4784e379dc2346aca287ccb96aca9166\r\nContent-Md5: BN5ZJKRqzOP7YpU0xOA5vg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FjwQ-074IqL8NZevS49DHu-aJsNL\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:32 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: hCQsGMqSM\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: CtEAAAA1gRVL0dIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":135637,"size_decoded":136394,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"04de5924a46acce3fb629534c4e039be","sha1":"3c10fb4ef822a2fc3597af4b8f431eef9a26c34b","sha256":"13e5ba6fd73a21dd08f0e5473251d6a7368ff47028bcb5e26f6c3f45b35bfc70","sha512":"bed3b2316c8a7e6af8fe963b9646acc5126a3bc5b663faad417edf2afa27a96aa964666ebb753f60b7cc1d7d96826e71f41d9a1e5fc67651db26d40c3d070a4f","ssdeep":"3072:ysucMLA7D6MLRiWe0ehJqgut11JJecLUi+zNVE5HEUPnELyTyFeqY:yacA7eMot0jbpey5+x4fvWK","tlshash":"29d312a0d2edcb0d088ed99951d9a5145aa21d88bc844cb3716fd2f09edee1fa9d7220","first_seen":"2023-08-17T12:39:30Z","last_seen":"2026-09-07T08:08:08.163381Z","times_seen":31,"resource_available":false,"data":null}},"time_used":7830,"timings":{"blocked":7485,"dns":0,"connect":0,"send":0,"wait":267,"receive":78,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/b90e115abce84465b46214612061b57c?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.506Z","timestamp":1788741144506,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/b90e115abce84465b46214612061b57c?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:33 GMT\r\nContent-Type: image/png\r\nContent-Length: 26325\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 1947\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"b90e115abce84465b46214612061b57c\"; filename*=utf-8''b90e115abce84465b46214612061b57c\r\nContent-Md5: z8otA7LegCMEShDBSOimhA==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fr1sd9PNh1XNi6T6hzCSFKpdT0Dx\"\r\nLast-Modified: Mon, 31 Aug 2026 18:51:44 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: beRKkBr3z\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: rCIAAAC8COPU4NIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26325,"size_decoded":27080,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"cfca2d03b2de8023044a10c148e8a684","sha1":"bd6c77d3cd8755cd8ba4fa87309214aa5d4f40f1","sha256":"ff5921cde947e77f1fcbd9b9940228969e3a6b3d9066144782d7b636acfc1a16","sha512":"392936824524bbb06f4e68fc918d6a205deb38a2d9be6e6d94c90cd983f7ef1abb4edba10fb9f8675a108a49ddceb40aee1be751fae4c66bed51b6463aa80506","ssdeep":"768:KNdYKAhijOchKgEHx+EWKfjiP+SI1BR1RZ/HnTYWgNJY41zmnI:8yKi5v3Hx+BKYpIp1bn0veI","tlshash":"b1c2cf7002fb71d4ac27d2aef7fb8090aa5a80c2756c41aa8e8b5489036f551df61de9","first_seen":"2023-08-17T12:39:31Z","last_seen":"2026-09-07T08:08:08.204566Z","times_seen":254,"resource_available":false,"data":null}},"time_used":8752,"timings":{"blocked":8485,"dns":0,"connect":0,"send":0,"wait":260,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202502/_webp_size328x442_27f7b303-88a3-4b2c-aaf9-2bc0106b5d62.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.622Z","timestamp":1788741144622,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202502/_webp_size328x442_27f7b303-88a3-4b2c-aaf9-2bc0106b5d62.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/webp\r\nContent-Length: 22168\r\nConnection: keep-alive\r\netag: \"04f8fffa2b2bc694cfc7174078dc54f1\"\r\nLast-Modified: Tue, 02 Dec 2025 14:17:04 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 48499\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uj7uelYh%2F36i6iLfj4bOa5jeM0Ge2YVfpTHerI530WN6vQ2IgeRG8d8m4Lvqo41VQMGeMW5B%2BV%2FSqtF2rxByCCvnyyULLQwynIbLCgAZgzuir8B%2BMoZgR5ULYvi1E2IdIyBa9dtsM6GH8SGUn2PLvHw%3D\"}]}\r\nCF-RAY: a36cfdc8eeddf9ad-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c901a07947e168879c\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":22168,"size_decoded":23079,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"04f8fffa2b2bc694cfc7174078dc54f1","sha1":"ebfaea4761ce72105a95c0241ca87bf998a81338","sha256":"9900ec116e5fa903d64f9cfc38a6855fbc19c42bbad46c2690e2a50920abf030","sha512":"599c14c0dd6eabf0aacdf250e366075584c9086dfe71ab9f4cab55301c2a16efecba29d8dd9b14be7472766ebe2618de9559ca7a20fe3550e9ae564fe12aed05","ssdeep":"384:+Jq0Vf96zLIvbNpNUU2tDeOouLf5GslLXGdB3Rk1SV14Hdyd/2U3lMezZD:+Jq9ENuyOp5G0WdlRkQB12k","tlshash":"d1a2d14f988244a9ddeca9d6e2cf7a5c44f39cc012bea4668eb455c8b04f5163ef1059","first_seen":"2026-04-24T23:10:16.784958Z","last_seen":"2026-09-07T08:08:08.214249Z","times_seen":1039,"resource_available":false,"data":null}},"time_used":4590,"timings":{"blocked":4241,"dns":0,"connect":0,"send":0,"wait":337,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/2e574d31de6d46ae9ebb778a37f672ce?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.374Z","timestamp":1788741144374,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/2e574d31de6d46ae9ebb778a37f672ce?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:25 GMT\r\nContent-Type: image/png\r\nContent-Length: 19071\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 91321\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"2e574d31de6d46ae9ebb778a37f672ce\"; filename*=utf-8''2e574d31de6d46ae9ebb778a37f672ce\r\nContent-Md5: rCnh5jh/UoJjqZ0o7SbnqQ==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fm48k8UEkQrjFMXo_oe-U4WiAbiZ\"\r\nLast-Modified: Mon, 31 Aug 2026 18:52:23 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: q6dasgaET\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: mEUAAAA95tSJj9IY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19071,"size_decoded":19827,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"ac29e1e6387f528263a99d28ed26e7a9","sha1":"6e3c93c504910ae314c5e8fe87be5385a201b899","sha256":"20be5854e7d0478b931a1029a97daa686458bb3594abc400e71cb777a9eba732","sha512":"f484b6e5ce0d1cb5ec9fdcf1be6d7b450a72d073d68cf618dec8641feb4089af6dbc6c760900960917d086b9c3c946abcc2a22c31786ed9b6525a8d744eed7dc","ssdeep":"384:PXxWGBx9g6Ki0Vd7Vxfsg2xVU2BFJRY9w/HFDQ/58i0Ij:PXoGBxS6z0XVxfslUEFJHpQ/58ilj","tlshash":"f182e19ff1e37a5cd0226d842a8071bd45e77b3870706425508d236f7d71059eee8b06","first_seen":"2023-08-31T00:31:19Z","last_seen":"2026-09-07T00:33:21.711938Z","times_seen":57,"resource_available":false,"data":null}},"time_used":1479,"timings":{"blocked":1144,"dns":0,"connect":0,"send":0,"wait":308,"receive":27,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/2b34d7567b9d4cea9b72e5aeb3afaec7?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.402Z","timestamp":1788741144402,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /img/fb/team/2b34d7567b9d4cea9b72e5aeb3afaec7?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-09T05:47:36.08732Z","times_seen":18359622,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/cccfd08226654398ae58eb3003302991?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.431Z","timestamp":1788741144431,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/cccfd08226654398ae58eb3003302991?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/png\r\nContent-Length: 52072\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 28943\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"cccfd08226654398ae58eb3003302991\"; filename*=utf-8''cccfd08226654398ae58eb3003302991\r\nContent-Md5: d30IQAZjE9qMD4WXfpF4vg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fn0VuVFSJSk9ycJhmLkvjYg7kwvm\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:42 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: rWGpgWMIN\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: nAUAAABlWGhGyNIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":52072,"size_decoded":52828,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"777d0840066313da8c0f85977e9178be","sha1":"7d15b9515225293dc9c26198b92f8d883b930be6","sha256":"dffae05be078c98701954523fc9ae0a2134db709e98aa4249774fcb053ef0d83","sha512":"6974ed8abfb08e6010409b25e6b0c59dd14fb284b4e51b5e1a050e2cc102f3760006368c221216404ff69fcaffa7cb919aa6d180921af70e69798b4de7997202","ssdeep":"1536:o9pZoNIy3hwK/Ua2YOv1khDpYsEXoDCB5UO:o7ZoNR3/Ua2kdqZo2BSO","tlshash":"223302f64d629d0f3288c309e7072f36975cc26aa4e932a5b609345f45e83ab45f16c2","first_seen":"2025-02-21T06:40:25.573447Z","last_seen":"2026-09-07T08:08:08.210237Z","times_seen":285,"resource_available":false,"data":null}},"time_used":4929,"timings":{"blocked":4595,"dns":0,"connect":0,"send":0,"wait":272,"receive":62,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/4ad6618117ac46e392b35adbc27b0e11?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.455Z","timestamp":1788741144455,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/4ad6618117ac46e392b35adbc27b0e11?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/png\r\nContent-Length: 76840\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 27129\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"4ad6618117ac46e392b35adbc27b0e11\"; filename*=utf-8''4ad6618117ac46e392b35adbc27b0e11\r\nContent-Md5: k9eSXaqI+SJ0BJwKvqqusA==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fk7H1WQsRBCXjqKWSinUE3dLVTr3\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:48 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: rHdOxhduJ\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: 7TEAAABGXw3tydIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":76840,"size_decoded":77596,"mime_type":"image/png","magic":"PNG image data, 250 x 382, 8-bit/color RGBA, non-interlaced","md5":"93d7925daa88f92274049c0abeaaaeb0","sha1":"4ec7d5642c4410978ea2964a29d413774b553af7","sha256":"b89d43033bf84b2f882d37ec6ad1855fb7a4f64698ba7e877db5a48582a3d779","sha512":"7b4ac47672302806df91edfea543122053e2c4209ab822fa42dff99fb226f738aa1395da0151ba724ab27ee6b5bc51d2c6df347fb10a2e1719bc7738cbd913d1","ssdeep":"1536:vKNYHxn2rKi0uiqU9ZmfxO4MzN1c51lhhPNaZ4lkPI77PYXacAM:iNYxWfUHmfxhUTcblzPkSliIgXYM","tlshash":"3c730288b699b5a7a9cdfb73cb00b32121d9fc54c2b243717d01d764563e0ec39e929a","first_seen":"2025-08-04T14:54:36.035982Z","last_seen":"2026-09-07T08:08:08.451618Z","times_seen":158,"resource_available":false,"data":null}},"time_used":6027,"timings":{"blocked":5715,"dns":0,"connect":0,"send":0,"wait":252,"receive":60,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/8c90ec740f4d42f3befa03faae01a0bf?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.486Z","timestamp":1788741144486,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/8c90ec740f4d42f3befa03faae01a0bf?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:32 GMT\r\nContent-Type: image/png\r\nContent-Length: 51587\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 19030\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"8c90ec740f4d42f3befa03faae01a0bf\"; filename*=utf-8''8c90ec740f4d42f3befa03faae01a0bf\r\nContent-Md5: /ZYTmMs5EU6YCbV5mvcC3w==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FuBcjuEzksMSrumA36c-CPt_Tcxg\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:32 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: B8pvS42Yy\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: 9lMAAAAnFRVL0dIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":51587,"size_decoded":52343,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"fd961398cb39114e9809b5799af702df","sha1":"e05c8ee13392c312aee980dfa73e08fb7f4dcc60","sha256":"2dcb37ec49633003f76303fb86c14464822017812865348eed42ae5552ccacd4","sha512":"39636eeaf1ab1c9b608456a11ebc7045c02ea6cb92b63b3d389722f581b8d01b0eb669d8a25dfa94fb078c509cc8283acd34c2e4ec74cf579286e1a43210c9b5","ssdeep":"768:gguzCbD3sNgIkpwNESvjM7CJ2pkPFhCg4yN1RBLpvILg4pmwtEOnh030K0s:gjo3YpDvw7QekdhmyrW8eEyhBs","tlshash":"403302be29521dec7a5152151269cd89cac02ed3428492bddbd0e0fbb74357c7d3067b","first_seen":"2025-11-01T10:11:19.770301Z","last_seen":"2026-09-07T08:08:08.262399Z","times_seen":25,"resource_available":false,"data":null}},"time_used":7712,"timings":{"blocked":7428,"dns":0,"connect":0,"send":0,"wait":259,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202505/_webp_size656x844_f676ec47-4b6f-4d37-b476-fd69f2381a1a.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.641Z","timestamp":1788741144641,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202505/_webp_size656x844_f676ec47-4b6f-4d37-b476-fd69f2381a1a.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/webp\r\nContent-Length: 31452\r\nConnection: keep-alive\r\netag: \"2c3c63fd994d8d3c68a43ab204dc29af\"\r\nLast-Modified: Fri, 24 Oct 2025 10:14:42 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 48496\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FZzUmPiClK1MvotCL2cMYbZKNVK%2F1HiH1AI7b6EeYu8vflapiWBoEwaIknve%2Fm6IBzWwsWZXfzio2Xl40J0zFtX90k2WaF34wBPy1ix9x3yZef4oXejmniJaz4eGxjgf3%2Bz1dVElPp7NGddd0Lrazfs%3D\"}]}\r\nCF-RAY: a36cfde2c88f2119-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c921a07947e62a83fb\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":31452,"size_decoded":32363,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"2c3c63fd994d8d3c68a43ab204dc29af","sha1":"f5da9ac11b57d67e7b0a21bdf3d2d5134eae1e2b","sha256":"b38e08c497bfb9faec2e112ff1a093f8938984e5c098484f7eca99900d1e1c72","sha512":"e83fd01696f5a79d5b2ef7ad13a442455c94977c810bceb5a6a656e08927f8a160a5b6be8e8e04bf10c0b2b721254319cb5fe15982a7ae0f7272a25a61f56127","ssdeep":"768:JXiQbj17p1iaPPQUz4ATG+Qkx5UL1ot3u3QO3xOBiw9urQ8:VdJp1iuPXECXUJ6e3QOBRwYQ8","tlshash":"74e2f1f968c3c9342ca43ed546ff15d58dd8b3d475e60863eb222d049137822e9c9e2d","first_seen":"2026-04-24T23:10:16.870222Z","last_seen":"2026-09-07T08:08:08.427552Z","times_seen":1138,"resource_available":false,"data":null}},"time_used":5777,"timings":{"blocked":5463,"dns":0,"connect":0,"send":0,"wait":309,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/css/46431.1781011881923.bc5df1d1.css","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:19.385Z","timestamp":1788741139385,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /css/46431.1781011881923.bc5df1d1.css HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:19 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-552d2\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c911a07947bd697f37\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":348882,"size_decoded":87205,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"93f90e3733fc4af32a4ef4b34416c531","sha1":"bbe0b8f50268073f57565c76a1ac45b46f6c668e","sha256":"ce07d563179018eb4ccfcaf005a871d6baee3ad2ac4400e6e4768a2d35c5aa1e","sha512":"664e0ea56bcf02d80d7e148c8c999493c6501c5b8b6138fb0c5a05c0c0a9c3b5facac9d711aa2ce216eb335328be867456dbbbb2864f99531faffa5fb74eaade","ssdeep":"6144:z4+4r0H8Tu4+4r5cRlGuEQUQ929srbnpTP4T:z4+4ZTu4+4yaT","tlshash":"b774fa6caf1030ae15a7cb27b660f5199c36a443f9bfde9af3e53d580789a510623c13","first_seen":"2026-05-09T01:34:22.507922Z","last_seen":"2026-09-08T23:44:55.136697Z","times_seen":1359,"resource_available":false,"data":null}},"time_used":1276,"timings":{"blocked":-1,"dns":0,"connect":314,"send":0,"wait":421,"receive":551,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/index-a3dad144.1781011881923.1093b11d.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:19.402Z","timestamp":1788741139402,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /js/index-a3dad144.1781011881923.1093b11d.js HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:21 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-570e8\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8e1a07947c2b777da\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":356584,"size_decoded":117378,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64562), with no line terminators","md5":"0fc0f4a0379e369b442d93ffb72561fd","sha1":"497d95fced30bab2efe9ad3a561c35cd40ad5e9c","sha256":"da926a537d946d3158d41a8531082a740aec7a6a4e3b98599d35546182f20806","sha512":"ef5664991d7fb472281b2696b3b25a322bf51f9bcbccf2043f77fdb67ca9a84d90b893029e93bedea935724bbc4b58a77154b35ac40b15f8e691b539cc3102e3","ssdeep":"6144:LrbhFOufhu/LHEY/T8CPis7lVV4YlRlNsmq9D7:3zBw/LHEY/TBas7lVVhsp9X","tlshash":"ed742b90f76ce1bd875e55ff7a329094902c1b41b0c89e58d29e2944fe6b385eeb04bc","first_seen":"2026-06-12T19:29:57.253128Z","last_seen":"2026-09-07T08:08:08.266828Z","times_seen":1193,"resource_available":true,"data":null}},"time_used":2484,"timings":{"blocked":1624,"dns":0,"connect":0,"send":0,"wait":373,"receive":487,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/css/60024.1781011881923.0ab0fca2.css","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.456Z","timestamp":1788741142456,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /css/60024.1781011881923.0ab0fca2.css HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:22 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-1439\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c911a07947c8b07f3b\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5177,"size_decoded":1748,"mime_type":"text/css","magic":"ASCII text, with very long lines (5177), with no line terminators","md5":"a0ef4268641ef0b005737ce8cc0c4b44","sha1":"9bb50b9000a419e7a701392b0d7d6c992cf585bb","sha256":"f64c7a7e6ecd620d1c7f8cc67e1eda83a0a115a8d86f3954efdaba3c09d62e66","sha512":"07605ebd7e16aef28f0ad5ed406f29ea9b77e8ba6b2079c810aacf8faf0b4a8d18d4f7775c62860cbf6d4379729a60076103a4daa833c860ddebeee3793ccbe2","ssdeep":"48:ZSPkOO2s2L5Pukasq+nArLkrL4QuQKhUjUkM5P6CdRDRWURcWaTHR/:iOvyP2r4rEDFP61LR/","tlshash":"d1b1412f01703349641bad6807dc67098325d8b399eb37da259d2a0dcbc3f861eb718b","first_seen":"2025-06-26T16:31:28.933081Z","last_seen":"2026-09-08T23:44:55.143309Z","times_seen":3909,"resource_available":false,"data":null}},"time_used":504,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":502,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/d20614f7be8844929ed406b96ecd1905?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.434Z","timestamp":1788741144434,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/d20614f7be8844929ed406b96ecd1905?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/png\r\nContent-Length: 77345\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 28037\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"d20614f7be8844929ed406b96ecd1905\"; filename*=utf-8''d20614f7be8844929ed406b96ecd1905\r\nContent-Md5: xvA8Y6AhiS2OCx74s7z7vg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fm2goeqRIhWmlEWAT0lwuTzMrj-v\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:44 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: NlpBT6PBE\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: SrQAAACZ6lsZydIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":77345,"size_decoded":78101,"mime_type":"image/png","magic":"PNG image data, 300 x 291, 8-bit/color RGBA, non-interlaced","md5":"c6f03c63a021892d8e0b1ef8b3bcfbbe","sha1":"6da0a1ea912215a69445804f4970b93cccae3faf","sha256":"f38f866adeee80d34ee495c7fa2cdc09f0ebd140bd0eeeccb7d8a248342fb13a","sha512":"3d0ca03e6aa94f6e29146a61e9be0a821994f8602390fff52d3d3434177a4dde387d15d5735c243ce9c4d9ee3f9df2c1e4f40c530ce186ad8b85eb8a5b0ad5f5","ssdeep":"1536:D1PccR+h2krOJe3e17RicaczEykxNVOHa2kz2ezK7M8O:RP3+Ns8e50CDkSqM7M8O","tlshash":"3e7312b202ea1548c18c5e40abbb7da9dd14e020e8192b378cc79cf9a2573dde15dd7b","first_seen":"2025-02-24T02:30:01.492391Z","last_seen":"2026-09-07T08:08:08.261464Z","times_seen":26,"resource_available":false,"data":null}},"time_used":5025,"timings":{"blocked":4658,"dns":0,"connect":0,"send":0,"wait":276,"receive":91,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/adc067ff34404e2eb14ee0c689e08048?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.441Z","timestamp":1788741144441,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/adc067ff34404e2eb14ee0c689e08048?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/png\r\nContent-Length: 59844\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 27129\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"adc067ff34404e2eb14ee0c689e08048\"; filename*=utf-8''adc067ff34404e2eb14ee0c689e08048\r\nContent-Md5: 8FuUViolKV24Acc9kv8b4g==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FryMEQgpfgjL-r8gnoV3-QVpojO3\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:52 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: 3NBcD42LW\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: I10AAACYVL_sydIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59844,"size_decoded":60600,"mime_type":"image/png","magic":"PNG image data, 316 x 316, 8-bit/color RGBA, non-interlaced","md5":"f05b94562a25295db801c73d92ff1be2","sha1":"bc8c1108297e08cbfabf209e8577f90569a233b7","sha256":"ac9de211eb9d493ad87ee5eb96068cccd4f237490d354e3a95c0e3408130cf5e","sha512":"4b7b329446a54f866e45c5575ab6f60dbffc53d51412a335a0e58653151658fa8efa58b1d7969de20de67198fad2747dbd53abd7cae22a0ab3eec021c7ee09d7","ssdeep":"1536:v8WrSHjWCZFXqKKXgk5PprSgWG+FiBplgtBmKXtY:v8Rl1NKXt5RrSgm0s/9Y","tlshash":"984312724e05cae279ba7cb34ba01c43e9e3d417608e964ff26213e693a578d35cdd24","first_seen":"2023-05-30T11:51:17Z","last_seen":"2026-09-07T08:08:08.349774Z","times_seen":48,"resource_available":false,"data":null}},"time_used":5427,"timings":{"blocked":5138,"dns":0,"connect":0,"send":0,"wait":259,"receive":30,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/2cc339156cd4490f94c6d61bce4fe9ef?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.447Z","timestamp":1788741144447,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/2cc339156cd4490f94c6d61bce4fe9ef?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 3470\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 27129\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"2cc339156cd4490f94c6d61bce4fe9ef\"; filename*=utf-8''2cc339156cd4490f94c6d61bce4fe9ef\r\nContent-Md5: TVOievQv+D5HmpPsNenEjw==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FmhA4JQWMS7Ckiz4YGM8x4GjOrU_\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:57 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: aXnSzcdBq\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: YzoAAACKWeDsydIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3470,"size_decoded":4226,"mime_type":"image/png","magic":"PNG image data, 130 x 130, 8-bit colormap, non-interlaced","md5":"4d53a27af42ff83e479a93ec35e9c48f","sha1":"6840e09416312ec2922cf860633cc781a33ab53f","sha256":"c1a21779884de1a10bb2dbe0018d877adc0cd43b6f6a7494ac9ee6dacc3d0833","sha512":"f73c15d00349ee390e364968f017e3f7fcc30cce342eb3a17de7a2c20796e35827572b9dda7aedb88d046d6609573fc410bcbce0ade3d9ff7bf18f070e201d39","ssdeep":"","tlshash":"55616dc483216425e9ba7e2d6c0b72ae889b2187d5151c3fce80da07ab171b4f62595f","first_seen":"2026-01-12T16:16:26.464933Z","last_seen":"2026-09-07T08:08:08.160813Z","times_seen":9,"resource_available":false,"data":null}},"time_used":5652,"timings":{"blocked":5400,"dns":0,"connect":0,"send":0,"wait":252,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/83e761c6bd624ce081f808359e754f8a?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.451Z","timestamp":1788741144451,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/83e761c6bd624ce081f808359e754f8a?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/png\r\nContent-Length: 271675\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 27129\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"83e761c6bd624ce081f808359e754f8a\"; filename*=utf-8''83e761c6bd624ce081f808359e754f8a\r\nContent-Md5: +6s8jPXNPbCFxRLmcV1P0w==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FjJyK3L5FMsDP-Ii7xGHdvAInype\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:45 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: j0QaooXST\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: pnUAAAA8cPzsydIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":271675,"size_decoded":272432,"mime_type":"image/png","magic":"PNG image data, 1200 x 1170, 8-bit/color RGBA, non-interlaced","md5":"fbab3c8cf5cd3db085c512e6715d4fd3","sha1":"32722b72f914cb033fe222ef118776f0089f2a5e","sha256":"bf8808b67d822ea40c09c11bd9ba8a5b718be3026bd55e5509bf6256c0eac1ad","sha512":"fc02721b87254d4c2d3582c2098376d9fae5d9404c268089c50f6d68039474031fcc64b2f1530791abdac06e1b7a412c9cdce4324c562673ad81e9953efcfebe","ssdeep":"6144:fXjnaApYUKwym/bZocoIB7oWu37zz3Kbuyz8O9KTW6H/Ba6Q:DnpYUKnm/locoeoZ/zad9KJHW","tlshash":"36442360d3c3b246f819ccf19f235b763830aae594594eaf29634c4c8da4b772e29f54","first_seen":"2024-08-19T18:55:15.299409Z","last_seen":"2026-09-07T08:08:08.18307Z","times_seen":139,"resource_available":false,"data":null}},"time_used":6353,"timings":{"blocked":5650,"dns":0,"connect":0,"send":0,"wait":275,"receive":428,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.esportsdata.cc/202/1/534dd5f364fa0b029a4293cf454ba750.png?win007=sell","fqdn":"img.esportsdata.cc","domain":"esportsdata.cc","tld":"cc"},"ip":{"addr":"104.26.3.221","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.485Z","timestamp":1788741144485,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esportsdata.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 09:01:04 GMT","end":"Mon, 12 Oct 2026 10:00:52 GMT"},"fingerprint":{"sha1":"02:2C:76:E1:47:AB:DD:DF:78:F5:11:A8:4B:B9:89:0D:00:17:5A:00","sha256":"38:CC:62:D9:EA:20:2D:41:D0:01:77:C5:A3:E1:31:1D:2E:4A:68:8A:C9:01:14:FB:56:DB:59:4E:F0:B1:B5:08"}}},"request":{"raw":"GET /202/1/534dd5f364fa0b029a4293cf454ba750.png?win007=sell HTTP/1.1\r\nHost: img.esportsdata.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Mon, 07 Sep 2026 00:32:24 GMT\r\ncontent-type: image/png\r\ncontent-length: 55191\r\nserver: cloudflare\r\naccept-ranges: bytes\r\netag: \"d7387e08b10525bdd2280c80c87bb845\"\r\nlast-modified: Mon, 13 Jul 2026 13:11:40 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Origin, Accept-Encoding\r\nx-amz-id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8\r\nx-amz-request-id: 18D2D8A6E6D8820D\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nage: 3344\r\ncache-control: max-age=2678400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=v7JD6oU4eOgyXD7B4MllbLvYI7R3SPwQMySJm2XbUnLqnvhPF%2Fjm5upU%2BEY4K4XZRBmLw8SJpGT9zwgNlSLx%2FO%2FBBT89RJgNHjjsu0SqXrvCICIdnzU4hvS7SUF3kLwBfxL7Yg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3719db90c5056b4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":55191,"size_decoded":56142,"mime_type":"image/png","magic":"PNG image data, 285 x 350, 8-bit/color RGBA, non-interlaced","md5":"d7387e08b10525bdd2280c80c87bb845","sha1":"4c4028cdef74d33a460c7472464b176880941ffd","sha256":"f812189ea93f72f3c759cbb36ea5ba5f3d114c8c802a1e11f156cbca5739187c","sha512":"f3d8f6fb80f6b667518a22e99f5fa05e3a92831a846995319b9f5274d25a9e39435939218d4d459c9c381d9d474a625df07391a76f9a084b5b1fe72940f8c1ae","ssdeep":"1536:N3ehWoEBG09BK0iocR/vFzi6FynCd2uxDXu+d:yTt0QocR3FO6FynCcuxDXD","tlshash":"3e4302ce4af0cc8c71de44a5653faf4da0763403a0749ba1d58aff522b7ea5dac10899","first_seen":"2026-06-27T23:32:46.217663Z","last_seen":"2026-09-07T08:08:08.344985Z","times_seen":115,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"img.esportsdata.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/img/partner.dca3fc6e.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.681Z","timestamp":1788741142681,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /img/partner.dca3fc6e.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:24 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-7129\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nAge: 48513\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8e1a07947d07a77df\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28969,"size_decoded":29115,"mime_type":"image/png","magic":"PNG image data, 480 x 151, 8-bit/color RGBA, non-interlaced","md5":"7374b72d05130af2d77119eb0eb4ba10","sha1":"5b3e5e621329685de250121b2fd9c798f46f7d65","sha256":"059a622a7f1f0f1f239d624f19b0f5531c0f0aedadb8ccd40d2570a76dd56752","sha512":"c2d0f744838a882c8ac15de6bb0bfbeb3dd2f31550cc7a259b9890ea38eddf835902171c1346ed7e1d2005ba18b929d598002d60b7355df72073d955521b18b0","ssdeep":"768:tAAoY1X4ITISUWhiqmMiuCaUENwHoacq8zqWx6:abaX4SIYIdMMow8zqi6","tlshash":"a2d2e0ecdc3058f1f533894dc979813a6f3886ba05e359817a36f92bddc3e8506491e6","first_seen":"2025-08-29T11:05:53.287538Z","last_seen":"2026-09-07T08:08:08.3551Z","times_seen":2566,"resource_available":false,"data":null}},"time_used":2187,"timings":{"blocked":1881,"dns":0,"connect":0,"send":0,"wait":302,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/f7a3c22f1ddd41a9b2551e5941cb50f1?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.375Z","timestamp":1788741144375,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/f7a3c22f1ddd41a9b2551e5941cb50f1?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:25 GMT\r\nContent-Type: image/png\r\nContent-Length: 115255\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 91321\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"f7a3c22f1ddd41a9b2551e5941cb50f1\"; filename*=utf-8''f7a3c22f1ddd41a9b2551e5941cb50f1\r\nContent-Md5: iL8qEP5+jT+aIbc/P3f83g==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FhJrs_p4bAtLQBy6FQ_VubwB5OSl\"\r\nLast-Modified: Mon, 31 Aug 2026 18:52:24 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: Aeg0sjrXD\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: B6YAAAAQTNWJj9IY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":115255,"size_decoded":116012,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"88bf2a10fe7e8d3f9a21b73f3f77fcde","sha1":"126bb3fa786c0b4b401cba150fd5b9bc01e4e4a5","sha256":"38e85a410a93ba89cf1b5104e7606a76ede66975d58ad7c7eaf166569f378c02","sha512":"17a16107e51a02a4a010b31318e50f84b99e7d5e1b154df2d87f92d016917bcd89e8e976b78c9a6e194f87c21ead5e0613016dfca1772ce4bc9ee2b1cc6c7580","ssdeep":"3072:3dnhl1pFGahQM6+NnG/YD3VcaLQoPv6IfCW:3hh/dRnvDlcEPv6OCW","tlshash":"07b3122d6b1d1fc4eaaa61c264a34cf2f992d6df84d18c2235d55437210e72fe1eda18","first_seen":"2025-09-28T02:06:34.041145Z","last_seen":"2026-09-07T00:33:21.737315Z","times_seen":80,"resource_available":false,"data":null}},"time_used":1961,"timings":{"blocked":1157,"dns":0,"connect":0,"send":0,"wait":327,"receive":477,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/8725eb0b288e42efb8abe5e239226d92?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.398Z","timestamp":1788741144398,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /img/fb/team/8725eb0b288e42efb8abe5e239226d92?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-09T05:47:36.08732Z","times_seen":18359622,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/c7b6fd2e14cd4fffaf37413b262d79b5?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.426Z","timestamp":1788741144426,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/c7b6fd2e14cd4fffaf37413b262d79b5?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/png\r\nContent-Length: 12241\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 30415\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"c7b6fd2e14cd4fffaf37413b262d79b5\"; filename*=utf-8''c7b6fd2e14cd4fffaf37413b262d79b5\r\nContent-Md5: K7yc3QEUgINc7ywcHa9LPg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FjQ9O1C84lVGRXQJTQKT27gxNwL6\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:40 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: G4snw2qvI\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: ItUAAAD7dVTvxtIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":12241,"size_decoded":12997,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"2bbc9cdd011480835cef2c1c1daf4b3e","sha1":"343d3b50bce255464574094d0293dbb8313702fa","sha256":"203c90e159ff264fecf3e9c71c1d9bb1f843f0bedf5ac76665db4b6596d5a094","sha512":"44be03ac64f5f8f4aeddebd707537bb85c8c86b4607f236fe01f3a97a4de5be5ce71108784ad6f9fa2e2f5b2bb097127b2ee7334cad25b5bcc48a271b5a03ac9","ssdeep":"192:iZV3YsnjWSe1xv4Pse1Nx2BOx8C3RrVM68LxWTZOrhqTp5juMHirxXGlQv:iZ/jWSe1xv4EM2B+3p2xdrQp5jWrxXG8","tlshash":"7142cfe6ce9c945df7eacf59d6350d28d2fe4e8aee0ab253aec91520c63081421c7385","first_seen":"2023-10-31T11:08:25Z","last_seen":"2026-09-07T08:08:08.260463Z","times_seen":43,"resource_available":false,"data":null}},"time_used":4596,"timings":{"blocked":4329,"dns":0,"connect":0,"send":0,"wait":267,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/d7ebf966920f4659907a6dc3685ec08d?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.466Z","timestamp":1788741144466,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/d7ebf966920f4659907a6dc3685ec08d?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/png\r\nContent-Length: 21217\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 25325\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"d7ebf966920f4659907a6dc3685ec08d\"; filename*=utf-8''d7ebf966920f4659907a6dc3685ec08d\r\nContent-Md5: EhOmjtv8P9xucghRdTfisw==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FuFoqGb9buvpPEyrkEAUt87sEamt\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:03 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: iTm8cKVQ8\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: K8AAAACroduQy9IY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":21217,"size_decoded":21973,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"1213a68edbfc3fdc6e7208517537e2b3","sha1":"e168a866fd6eebe93c4cab904014b7ceec11a9ad","sha256":"7505c3b5bda713a5dbc8c090849879478d1aae579b1eae95d3fb90e3a7d9f9b4","sha512":"6031cde56e885f3d8e855fd96d64f0c5571cd0534b4e765f4c309406e78a730fcd5e577ca4b52bb1fe8ac6cd9a569695a92964118bc7bb674ba3046192cf4f3f","ssdeep":"384:QaXIblZHLGwvul2CwjRbh0SfnhCMAUbTEnQfcjUeeh3mHj9KUJ5/:Qa4rHKl2Cwj9uSPInuN5vmHj9KU7","tlshash":"b092d11e1a7cce330b4f569a57f294b0a2a3014192bbfe90099046c454dd6e127fbefb","first_seen":"2025-03-31T13:06:08.136201Z","last_seen":"2026-09-07T08:08:08.32975Z","times_seen":147,"resource_available":false,"data":null}},"time_used":6628,"timings":{"blocked":6349,"dns":0,"connect":0,"send":0,"wait":274,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_465faf5d-2f6d-44ba-896b-8d6bffead8bd.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.621Z","timestamp":1788741144621,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_465faf5d-2f6d-44ba-896b-8d6bffead8bd.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/webp\r\nContent-Length: 10758\r\nConnection: keep-alive\r\netag: \"1be21ba94f35a4ac4384d8d158cc42f6\"\r\nLast-Modified: Tue, 02 Dec 2025 14:08:05 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 31022\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kqDEIDkchUhPX6qi%2ByAnq4bY9Vrpnw1Xr29ztJLkWiqeEZoyyz8lXHDOthRk3MGD4u2EK7P8PanbjNN1tCBuH%2FcUMniOJeZjIYmuJwpgxzNIZc7eava%2Fo0WkDebn%2F3DtbJaV3nhlW1NH%2BL8%2BZNAX1zw%3D\"}]}\r\nCF-RAY: a36ea86f885a7eb7-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c921a07947e13483f7\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10758,"size_decoded":11673,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"1be21ba94f35a4ac4384d8d158cc42f6","sha1":"3dc86d6c7bd530771ada51859a6c47c39258402b","sha256":"e2322e5c3f299528f388653e9dee3d3ca69e9f0006d1d0530cad7062dc2c3cbb","sha512":"40ce1b1f21df22b5ff6df16248f358d1cf0eb862f764bccf75cec2bb7cebae008ed8452e6fba25c2e091fe61c36fd30d25e6d3b46fd107985140debd9dacb09f","ssdeep":"192:jQnnxvnAz9rf9dKD/x0vFIcyKAY7MLUnEpeiqd6ufnQD4rVdg9NpEDy2lc:4A9r76/xEycyUkLuID6Hg9zey2l","tlshash":"dc22c09b145b3135fc1664bdbd5e5b0250ad8cc102b886290cbe44ba808f9caadbfb05","first_seen":"2026-04-24T23:10:16.865837Z","last_seen":"2026-09-07T08:08:08.089953Z","times_seen":1020,"resource_available":false,"data":null}},"time_used":4503,"timings":{"blocked":4196,"dns":0,"connect":0,"send":0,"wait":307,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size750x590_1103f977-5f3c-414d-8305-ab6884e8769c.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.650Z","timestamp":1788741144650,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size750x590_1103f977-5f3c-414d-8305-ab6884e8769c.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/webp\r\nContent-Length: 43614\r\nConnection: keep-alive\r\netag: \"f0558545ac271256cf9e2e089c4b5d7b\"\r\nLast-Modified: Sun, 09 Nov 2025 14:30:08 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 48492\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bZzffXPAx7BOLXZXAKG9AlhydmmZFfl9aGYDjEdU%2BPM0MV0GJxBi1CY0il%2FLhrGwAZhqqI%2FqD3K5eUORfK5IJ4F99aTiP82R4mbjIy3NNFUChyWmmwU5SqxIxf08tIwFSTuXuxjP1%2FQWjkt0Vqrsg1A%3D\"}]}\r\nCF-RAY: a36cfdf8ffc3852e-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5cc51a07947e8618b60\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":43614,"size_decoded":44525,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f0558545ac271256cf9e2e089c4b5d7b","sha1":"9594bc20fca63f0cfc8d31eeda8158bab7c54139","sha256":"cdd8fa33c321da25e96a0fff96453673d60d6c59c309aa7a2048e32b78f29e75","sha512":"e9a34139f7f091d9269ef1b87c11fa7900523ac4d286fddb7843e64afb1ea084064441c836ca8460185a800378cfe5153141613f0807d84e0687a1ef41f027b6","ssdeep":"768:c8urDr4gpwG3TMvUToCKvqwP9bDPCqO45+V0D63GQu54vlb:c8urDr4VGj9KPPh3+y2Dvvlb","tlshash":"b41302a684b210b1cc6db573dda010661bb07cb8ad6d5d1e0690e60fadbcdf12ca3e90","first_seen":"2026-04-24T23:10:16.765262Z","last_seen":"2026-09-07T08:08:08.238507Z","times_seen":1227,"resource_available":false,"data":null}},"time_used":6371,"timings":{"blocked":6029,"dns":0,"connect":0,"send":0,"wait":315,"receive":27,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/fd1cbb46fd4947dc9c074c6c75106ce7?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.423Z","timestamp":1788741144423,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/fd1cbb46fd4947dc9c074c6c75106ce7?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/png\r\nContent-Length: 33564\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 30442\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"fd1cbb46fd4947dc9c074c6c75106ce7\"; filename*=utf-8''fd1cbb46fd4947dc9c074c6c75106ce7\r\nContent-Md5: XypZ8Bdc/EaUid2mFl7jqw==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FvE65nzhbr1HGLPvwpJv5MHGuDRu\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:30 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: TxWAyA86d\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: IQ0AAAC8pjbpxtIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":33564,"size_decoded":34320,"mime_type":"image/png","magic":"PNG image data, 219 x 219, 8-bit/color RGBA, non-interlaced","md5":"5f2a59f0175cfc469489dda6165ee3ab","sha1":"f13ae67ce16ebd4718b3efc2926fe4c1c6b8346e","sha256":"1c4491fe66d627a7961509cc24e2356edf093bb0f692efba3fc7ace4ce43356c","sha512":"dec8a8d934f6534d626293a4d97d7177ec097bba16dadf9dbeb5480ea2f144ba815a3f0b0c56e8ed4ebe1441446cf965dea53ce63f633e5e0c2fe0df9597a4c3","ssdeep":"768:lAPXuV+KmfTHk53zBhdycjCnDjWRtBOUU5Fc+FB7Y:+fuIxHi3zjccMCBRU5W+FBk","tlshash":"e6e2f1d893c05388db09a0426f657bcef4df7e59be0ad6463c7d8a806ffc1149216e68","first_seen":"2023-10-21T16:28:25Z","last_seen":"2026-09-07T08:08:08.408853Z","times_seen":151,"resource_available":false,"data":null}},"time_used":4405,"timings":{"blocked":4133,"dns":0,"connect":0,"send":0,"wait":253,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/c5547138a18d4af4a5c749a447bf13d3?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.464Z","timestamp":1788741144464,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/c5547138a18d4af4a5c749a447bf13d3?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/png\r\nContent-Length: 11276\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 25927\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"c5547138a18d4af4a5c749a447bf13d3\"; filename*=utf-8''c5547138a18d4af4a5c749a447bf13d3\r\nContent-Md5: 9fY5lRXV2578oVP77TdImg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FnuBCR0LwYnwMO3Xn8nKyhFJIag2\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:06 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: sPKblVvby\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: aIsAAACNpuQEy9IY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11276,"size_decoded":12032,"mime_type":"image/png","magic":"PNG image data, 163 x 163, 8-bit/color RGB, non-interlaced","md5":"f5f6399515d5db9efca153fbed37489a","sha1":"7b81091d0bc189f030edd79fc9caca114921a836","sha256":"322d7218f477dc330a903f579c9079b39dfe6acd2c45b8fbf484eba7b7d005e6","sha512":"9a1be42e3f7ec1cc7b01ebaa28a044dd3ffc5d59a5e88f29682bb84bb83ce0ab60db89ab2cc9fa4fc355ce56f7b7ba124a0d1dc30c63bb30fdb7e85b0cc921b5","ssdeep":"192:9gAOa+CjX2gmBpZVAZU0RY9ufApiWE2kcsfoCwy8Wcmqq5Ra95/M+cqvBIW1a:9+a+Cr2D78ZU5FpiWESPY8WzU/aQZa","tlshash":"8732d0c793713d43a6c1f886c4e611e6892659a3894ac2c3360274ba84cdd4718767ef","first_seen":"2025-01-29T13:39:14.858792Z","last_seen":"2026-09-07T08:08:08.220702Z","times_seen":30,"resource_available":false,"data":null}},"time_used":6501,"timings":{"blocked":6234,"dns":0,"connect":0,"send":0,"wait":267,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/api/sport/match/list?sportId=1\u0026client=web","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:50.408Z","timestamp":1788741170408,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /api/sport/match/list?sportId=1\u0026client=web HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nx-request-source: https://g36b.top\r\nXign: SsIzRwMDQ/NP6a9IyFWD+IZqrZ/kLsgDhaK/9Majr1VFeBmQy+z5QyrZaIquA/hVpTqy7BginkhfadPDXYDhNXrG3ab3YzCXYSUdfM8cKJj+EAv6PX+d6Cb+GJPwK9w7KFCvWfnnLadIhqgDdi8HMpdngD33ZaQgGoZXkOpYMTo=\r\ntimestamp: 1788741170402\r\nsign: s4j1t3h4s7i693jv\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: aDntxNnwbrytXeEW4SJfGsaRdsx3tyZ3\r\nlang: zh-CN\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:50 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nCache-Control: no-cache, no-store, max-age=0\r\ncontent-encoding: gzip\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8e1a07948356f780e\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":42603,"size_decoded":7956,"mime_type":"application/json","magic":"Unicode text, UTF-8 text, with very long lines (40799), with no line terminators","md5":"189edd7b36728ce5854d50a049f4f301","sha1":"01c1375fed34f164ffd51f3a67c3c53c325c0b64","sha256":"591c3a4999841c09fc14bbceefc3158044a01f2ad9cc77c3c7d40d759e509ba1","sha512":"3175de9c6219992e9198b05c21259beecdf68ed605a92d4b276736c2f7124cad43576ad3adb23db023dfcb77517e9cc4e1230e4eeb845ccbcad96aaf25303f94","ssdeep":"768:eNCrhqfHg2vcycTd1i0hEXqOv4dxvUwQYRwJCdxtdtgHRsX16sQP2ssc5sjx2eDn:es2R/JVsUsdslsgR6RiRR00S0D0jHjHZ","tlshash":"6113ff5291de28961b9c61d55d1d3f4d887eba0b0a9ef6c9ee4ecf1821b43fb9300d21","first_seen":"2026-09-07T00:33:21.752006Z","last_seen":"2026-09-07T00:33:21.752006Z","times_seen":1,"resource_available":false,"data":null}},"time_used":309,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":309,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/img/sports.60212fd6.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.668Z","timestamp":1788741142668,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /img/sports.60212fd6.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:23 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-1c734\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nAge: 43138\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c911a07947cbe77f3e\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":116532,"size_decoded":116898,"mime_type":"image/png","magic":"PNG image data, 666 x 541, 8-bit colormap, non-interlaced","md5":"fc82aa907334f929011fc2a6ec906f55","sha1":"f76bd75b9d1235807c70c7d763a1865d7c3f8d4e","sha256":"2ae1d61176960d7ddfddcb30a69d22b9da893687370d8cd26f4917d129a1bf3b","sha512":"12ef7a828d7d4228596b0db0ad77b200e8ffcfe2457d12821a4e9778b62668ebeef075c2bc79076e36291e3015afbfe276a2ca230ead018b38e2d3fd803dd31f","ssdeep":"3072:/ZEgiWqpGRwEyiwX0wgOZzbKoSxNiSvrUeO4h:/ZLf/R2iVwgAKoSPiSvVOy","tlshash":"76b3021c79775a2083c6bcb40b583aeae09b3dc19d169808d68b7791993df43c970bed","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-09-08T23:44:55.176469Z","times_seen":2862,"resource_available":false,"data":null}},"time_used":1265,"timings":{"blocked":728,"dns":0,"connect":0,"send":0,"wait":321,"receive":216,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/ecb/8f83064248a6651521ab9b26970d60fa83f0bf5f79fe68600101b67707c272184849423924c3e9832923a30acedcbfec8ac50fef89fb","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:23.467Z","timestamp":1788741143467,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /ecb/8f83064248a6651521ab9b26970d60fa83f0bf5f79fe68600101b67707c272184849423924c3e9832923a30acedcbfec8ac50fef89fb HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://g36b.top\r\nXign: USe5atNS8cwwTjX+XTQph2qWcSUsgHRwvBKbI3nqSr9c/uZmqYbaqQgMJ9f+0UF7JR0lamuPKTCQzrquse1NjvHyQrkhts5n86Rjsq6xnh9f6WQSF0JhsaDJHkvkQwDExuCoL2tdB43Wcak5ohqwC6hCHk0tR3Ti3NONYoUeDZg=\r\ntimestamp: 1788741143463\r\nsign: 2j2b753a636c7s59\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: aDntxNnwbrytXeEW4SJfGsaRdsx3tyZ3\r\nlang: zh-CN\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:23 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Mon, 07 Sep 2026 00:42:23 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nX-Request-ID: ac4b13ec4e6c4537b47a451331a6c5b0\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c901a07947cd768793\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6691,"size_decoded":7511,"mime_type":"application/json","magic":"data","md5":"56121354bdc384a2e156e5fccada5da6","sha1":"c6a3f5a06cc0d1cc371251af378ac99569df39de","sha256":"ae22232bc509f9bab4be75c3ad4c0c0b3a9e761fd5412c4383c73fadbd1a49aa","sha512":"a4970df4d28be82442ccb2243aeccd35ba02ccb7dabcaf3a08ca91e545b72198b3e3ef99180e4eb6c6d77fe885310235d8119ef5698b3b19d27b8c88778dd6b6","ssdeep":"192:V/XaHYhYBNWN/DTxL4ji6SGv3RY5roc3rLI4irw9bdWagTgAGa+:9qHYGNk/DTr6SGv3RY5rTbw4dWa6Ma+","tlshash":"4d22af970b52d7a036cdd5fca1621cc12a9fa2cc40bc9bd5d37480a42eae75074dc4b5","first_seen":"2026-09-07T00:32:02.794146Z","last_seen":"2026-09-07T08:08:08.078833Z","times_seen":3,"resource_available":false,"data":null}},"time_used":656,"timings":{"blocked":325,"dns":0,"connect":0,"send":0,"wait":331,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_2a74177b-d024-4ea3-8b58-fce53f91051b.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.626Z","timestamp":1788741144626,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_2a74177b-d024-4ea3-8b58-fce53f91051b.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/webp\r\nContent-Length: 65510\r\nConnection: keep-alive\r\netag: \"1841972db1eb6b1b08f2b8849b98ffad\"\r\nLast-Modified: Sat, 06 Dec 2025 06:23:06 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 48499\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tA6MbZUk5mvkzauoj7JxGS20Lu1FzeV%2FOlg5Sxoitm3lziDf2i%2FISxMjohefg22JMN5A0gyFR3wZG9vDXIOVtJ4aDsMSizcHyGficax%2FYYobJCKY4TZpDYeCdtEeeMujKMApW9r7pFrlrRgK6Fp0Fuo%3D\"}]}\r\nCF-RAY: a36cfdca08c3aec4-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8e1a07947e2bd77eb\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":65510,"size_decoded":66419,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"1841972db1eb6b1b08f2b8849b98ffad","sha1":"6194c3f706be3f6aa4cf9042d0cc4b9c2a77a1a4","sha256":"0b162dd98f34fc830303fa40c47a002b14c2b6f4947a7378247db3c924bb7fac","sha512":"e9fb0eff09d46b3c88de962b1d6a020fd55f98d777e56ee4a0ac8aa615d14faa3d95de3ac35a92451ef4be5c8141532327b97c6fa95d5090aa61847b2b24d370","ssdeep":"1536:HsAMZEDXiepWzfRKc7nC3BQkbf9ptwv+AOtedy3JMw:HsAMZwMrC3BVTtAy3iw","tlshash":"5a5302765eef65629bf42eeb0331c6856fcb5a10803814b83059e1e5ee85c29f61d372","first_seen":"2026-04-24T23:10:16.852267Z","last_seen":"2026-09-07T08:08:08.256356Z","times_seen":1042,"resource_available":false,"data":null}},"time_used":4899,"timings":{"blocked":4581,"dns":0,"connect":0,"send":0,"wait":302,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/22872.1781011881923.153832d9.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:19.401Z","timestamp":1788741139401,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /js/22872.1781011881923.153832d9.js HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:21 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-2679f\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8f1a07947c2927877\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":157599,"size_decoded":50647,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"f9ee602f8eeb24db94a45e276eb229fd","sha1":"add3d7dea3c94842531e4e52db7b334a705c5e6b","sha256":"3d79813c4166473dcbe19eb56d456a226f183993f5aa4108a4fccae156001245","sha512":"8ad5674af4bbf338d1188a8108d0984786a4c94afddefbd592dbc428928dae301e40d4a936d73d0e29ba68989ccd13abee0988a8a6938495736115c80a53eae7","ssdeep":"3072:XHW7tB4Vgj5tNlxyU5YegxYffj7TEOiGzZl+DJVkzEcx1nKs:XHW7tBwgttXxyUtffjAGzT+DJVkzEcxF","tlshash":"21f31bd4f2c071f6475f45f2a22b0075b26f4d92318c98b0e15ba6597f21a48c7abeec","first_seen":"2026-06-12T19:29:57.267326Z","last_seen":"2026-09-07T08:08:08.15899Z","times_seen":1208,"resource_available":true,"data":null}},"time_used":2111,"timings":{"blocked":1601,"dns":0,"connect":0,"send":0,"wait":377,"receive":133,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/60024.1781011881923.e9a203dc.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.459Z","timestamp":1788741142459,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /js/60024.1781011881923.e9a203dc.js HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:22 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-11f9\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8c1a07947c8b38115\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4601,"size_decoded":2277,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (4601), with no line terminators","md5":"ac04ba4305a374571b2d241fe1f50dc2","sha1":"e559b9a0a338e35fb6605942f7d14e96c031ae71","sha256":"788282499d13bd0bb6207ed41a15a3d0b2058ca97003d1e1a872e81401f02aa7","sha512":"6edc613a3f8585bf6cfb8c034199265c1c1daf368d0d3a6e2c41bf441a334a7f93139c0b0fb4147b98264567be9b135fab3cbe923e8fe040ec553e9fec04c8ae","ssdeep":"96:UR4NFRSZqe65bD7RM/Rsxkw9usN6tKex9sX2NaenPdqUDDEz:UR4NFRSZqesbD6Rgks0RxeX2NbnPdqUE","tlshash":"3491cbd876d2f071426f9678862f285fe27bead074ccb415d1c1e690aef062d8933d68","first_seen":"2026-06-12T19:29:57.341024Z","last_seen":"2026-09-07T08:08:08.185422Z","times_seen":1164,"resource_available":true,"data":null}},"time_used":515,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":513,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/kc523-1/noData/cms_moren.png?1781011825626","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.719Z","timestamp":1788741142719,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /kc523-1/noData/cms_moren.png?1781011825626 HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:27 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 30 Sep 2025 12:19:27 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68dbcacf-4d14\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nAge: 43144\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c901a07947dcb28799\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19732,"size_decoded":20250,"mime_type":"image/png","magic":"PNG image data, 215 x 214, 8-bit/color RGBA, non-interlaced","md5":"f3c825751a70d4aad8da2ce57f76acf6","sha1":"732da443668abb03a79a70df2d0ea8d801158655","sha256":"c395f4c1941459ef620f6df95fabd39f9ac98e03f6a389886bf224157557ce41","sha512":"a3b3fa2a216c10d331fea4771b916825d0605b94e21ac242d152d7c5e4b984cf3baad7a3fd071dde3432162037514d756cce1a0f699baf3dc98eaf75483c91b0","ssdeep":"384:64pTwcIHFqFpIlD8SqhwFLW/na2PvyQXSOKvOi58KUezsTT5ZOon:67XlROe8WvOAPHQv","tlshash":"a592d0d8abcb6705bb132b43b941a3558e0dfd6a130b9bb131782805ee16151e8d7e3f","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-09-07T08:08:08.225563Z","times_seen":2336,"resource_available":false,"data":null}},"time_used":5320,"timings":{"blocked":4971,"dns":0,"connect":0,"send":0,"wait":340,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_1d28b817-0c00-4339-b666-213943a7b1d3.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.632Z","timestamp":1788741144632,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_1d28b817-0c00-4339-b666-213943a7b1d3.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/webp\r\nContent-Length: 91938\r\nConnection: keep-alive\r\netag: \"d4f654e067ee701e55c386cad6b53574\"\r\nLast-Modified: Wed, 10 Dec 2025 11:50:44 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 48497\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iIqeXd%2F1s9skUAlYyrrGQR%2Fo4Ylv9GYF6AYC7AVeUntnn287YVM3PM4b97khmu0jEaNrr3SJlo%2BIDlqNeKtpmw954KEjSktz3YaaML%2BE7Hnr7CntFbROQ2HczYx159Ph2%2BWAo2o1KUQpf64MMrm7KxI%3D\"}]}\r\nCF-RAY: a36cfdd38bdf25d4-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c911a07947e4277f4c\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":91938,"size_decoded":92851,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d4f654e067ee701e55c386cad6b53574","sha1":"a0f6315ed37b1a5d5da601adfbcb44cad2d9f5cb","sha256":"cd9f33e85a633a73214e9e94255ec27a3d272cadf2389345b6d240d4e36c53ab","sha512":"701a8be639fbb3dbc5670d9789cf01c3175d632a7902e3cfbb769e80fff9f420c10befecfa030adcced409dd26c2ae2afa1fcf617c7371bc6984b378685d184a","ssdeep":"1536:XsUxLKKnLpw8UtfepacmJUm70Cweits6VTpJz39R9s8dBmdEbi/pS4l8KjVIVAMo:PBLpw8UtfqyJUeueitTVbFs8dpbQSvK5","tlshash":"df930205f84d4f1dd86a31e6e142309c9472e0a83213cefb25b3f53997935d52ea6f48","first_seen":"2026-04-24T23:10:16.740253Z","last_seen":"2026-09-07T08:08:08.413409Z","times_seen":1054,"resource_available":false,"data":null}},"time_used":5381,"timings":{"blocked":4949,"dns":0,"connect":0,"send":0,"wait":314,"receive":118,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/img/bj3.a7dbd558.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.674Z","timestamp":1788741142674,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /img/bj3.a7dbd558.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://g36b.top/css/home.1781011881923.38488e2a.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:25 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-16cb\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nAge: 48514\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c921a07947d31d83ee\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5835,"size_decoded":6203,"mime_type":"image/png","magic":"PNG image data, 1003 x 171, 8-bit/color RGBA, non-interlaced","md5":"b79234bcd23ce7e063481b3605bcdd45","sha1":"eace4c48cc352cfb10fb6fcffed50748f18aa78d","sha256":"2dbca2ee9a515b178cb6a5ce670a5dafa30941ad8c753fa3e94642f8dacca13d","sha512":"40fa685181391f1ca805440f53683045d1fbd5c0f36cf471f53641c6f289481f42fefc4d1f2b2fdfe8a20d7488ef0537f10352492e46af76770b49fe8876def7","ssdeep":"96:brOIaX7VK+RUSrZ3rnZ1L++y+hsVoK4CBVVikox3n0muoE7Nqh7zwGto:K7VK+RBZ3l1i+y+3peikr3oEJqh7MCo","tlshash":"91c18f03f313ed339b875f190abe4dc3498b2f9a4725a7d6285b5aa89654819c062e82","first_seen":"2025-08-29T11:05:53.328141Z","last_seen":"2026-09-08T23:44:55.101276Z","times_seen":2749,"resource_available":false,"data":null}},"time_used":2873,"timings":{"blocked":2568,"dns":0,"connect":0,"send":0,"wait":305,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/a4344e73147a4163b6555220d8746637?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.418Z","timestamp":1788741144418,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/a4344e73147a4163b6555220d8746637?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/png\r\nContent-Length: 5745\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 30442\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"a4344e73147a4163b6555220d8746637\"; filename*=utf-8''a4344e73147a4163b6555220d8746637\r\nContent-Md5: /wB8Q7fbnpfklBt56z9u+A==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FvyHz6PS2ohk5BXmeyGMvkj3WUCT\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:34 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: Nzy3UYrmB\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: aZ0AAABoohfpxtIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":5745,"size_decoded":6500,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit colormap, non-interlaced","md5":"ff007c43b7db9e97e4941b79eb3f6ef8","sha1":"fc87cfa3d2da8864e415e67b218cbe48f7594093","sha256":"5b0a7c4461f5643af9570b6d46802b139a94836d57a60e9dc157794c38e34ef5","sha512":"2274e6317e9f26a8fd699133f237f0a6e0cf10b956d8ba1399bf08998219de53bf08d8cc0a15bb8d88180291a7cf64a819e6e526cfa044764551feb1cf4c078a","ssdeep":"96:R7qVPiROhlLSFcZLKF4ov444sR0tKWctrLn24+T0uRnJe5iUEYSCW5mXngt:cUOhVQ1F744rcErjb+AinJe5iUEYSdUU","tlshash":"64c18d8d1b2686de928736682747bac08f573939539aecfe1368469c3803416515b238","first_seen":"2025-10-15T16:18:35.678116Z","last_seen":"2026-09-07T08:08:08.084919Z","times_seen":34,"resource_available":false,"data":null}},"time_used":4127,"timings":{"blocked":3873,"dns":0,"connect":0,"send":0,"wait":254,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/77c5168755aa4e6f9c86ba2d692b7757?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.490Z","timestamp":1788741144490,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/77c5168755aa4e6f9c86ba2d692b7757?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:32 GMT\r\nContent-Type: image/png\r\nContent-Length: 10889\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 16348\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"77c5168755aa4e6f9c86ba2d692b7757\"; filename*=utf-8''77c5168755aa4e6f9c86ba2d692b7757\r\nContent-Md5: 0HZJSL2jvVy6TYhk4ZnbeQ==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fssli7xklZ8C2S8e-7j3Qd5TBB1P\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:44 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: 3zWmkkKtJ\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: N2MAAAA7-Je709IY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":10889,"size_decoded":11645,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"d0764948bda3bd5cba4d8864e199db79","sha1":"cb258bbc64959f02d92f1efbb8f741de53041d4f","sha256":"9a2daa5d81c761a493fc826839268ee51154b1c54bcd7d2b2f415eb74da5f6f9","sha512":"57c3eec3c848342b7492fa1eaa482fc55457e2a5edc6832c4de4f3507fda721203106c302f7ef2233b972e96f28b56dde254df2622a59a40b7ed1ab8837f17b4","ssdeep":"192:BV53iEycfl2UXR9I+othPhZQ9uthB0m0IkPQTFB4N7BUfkVcrhRi3aMHysL2P6IG:AE7xX/BoPPTZ0iF+N7BkkVcVaSsL2PDG","tlshash":"6322d0af30355416d7d19a4e440cafef8c914c11d31990f21c64b2f5bfa13405ac66de","first_seen":"2025-02-24T02:30:01.453806Z","last_seen":"2026-09-07T08:08:08.270437Z","times_seen":108,"resource_available":false,"data":null}},"time_used":7847,"timings":{"blocked":7593,"dns":0,"connect":0,"send":0,"wait":254,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/img/EGAME.d289cd48.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.607Z","timestamp":1788741144607,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /img/EGAME.d289cd48.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:24 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-e89a\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nAge: 42546\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c901a07947d0a58794\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59546,"size_decoded":60074,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"eb8991eb9e0db175522c914343f0a10a","sha1":"ce2d41b154df64421d46bceaeb9878da455592dd","sha256":"b837b4e9fc693e5c65eb049c56547caefe1cf73ea31ae59f95ae46d052fd36b2","sha512":"7d2a886e3ac412f6ea1b1ba290064373e1d07a0751bdd7f546af3116ad057d1f17bbe4847179cdf87297a967c0290280ec0c51ab9bfdeb1da0b881e366eb19a8","ssdeep":"1536:hvA9R/SReJczzaRBd6s3DhCDnQcvyFVWGDnmhKYNa67:hIPVczevUIhCDnQc21C7Na67","tlshash":"dd430276882a8fcd499304944bf9afe164eaf19097b3cf91f24c5fe0423d184d881b6b","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-09-08T23:44:55.129964Z","times_seen":2434,"resource_available":false,"data":null}},"time_used":425,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":341,"receive":84,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/kc523-1/sponsor/sponsor_nav_web_1.png?1781011825626","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.661Z","timestamp":1788741142661,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /kc523-1/sponsor/sponsor_nav_web_1.png?1781011825626 HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-09T05:47:36.08732Z","times_seen":18359622,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/962f772abaff4ca382f9eb19a8e17706?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.331Z","timestamp":1788741144331,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/962f772abaff4ca382f9eb19a8e17706?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:25 GMT\r\nContent-Type: image/png\r\nContent-Length: 21887\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 5551\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"962f772abaff4ca382f9eb19a8e17706\"; filename*=utf-8''962f772abaff4ca382f9eb19a8e17706\r\nContent-Md5: 3I4/m+oWvsNmJae3ukUiHA==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fg87u7efPIg7mkbxRGIHf_XR0qz0\"\r\nLast-Modified: Thu, 03 Sep 2026 06:49:06 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: k21zs3qrq\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: mGoAAAAgms-L3dIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21887,"size_decoded":22642,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"dc8e3f9bea16bec36625a7b7ba45221c","sha1":"0f3bbbb79f3c883b9a46f14462077ff5d1d2acf4","sha256":"74fd32fc1517d3562fa9abfea01613e497d7fa7ff5f6a9ac800f953bdf125cb3","sha512":"be0a6f1f5962f57d15f030d819b481a99ed27627a93a9b34f87722a11c31668b63ad6b4dcbf06e3abbd52d96877a13307bc2d75818a6adade88aa4d7c16f6ac9","ssdeep":"384:czFwzAwuPMueLoRIOOd9u0dSaS9rn3eud47aFtsZdGdmQdTCbGiVAWJI8Vt5ED2b:oXYueNj/uMI9y447WKEMQhezVt5siXv","tlshash":"cda2e05ad65b08fb6240c8eb246826b048c4cdcce3f555c7a19abecc06e5e8dd66063d","first_seen":"2025-10-05T20:13:27.698283Z","last_seen":"2026-09-07T00:33:21.768716Z","times_seen":7,"resource_available":false,"data":null}},"time_used":1338,"timings":{"blocked":-1,"dns":303,"connect":250,"send":0,"wait":501,"receive":26,"ssl":258},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.esportsdata.cc/202/1/90bd122c05e09296e95748276c395f3e.png?win007=sell","fqdn":"img.esportsdata.cc","domain":"esportsdata.cc","tld":"cc"},"ip":{"addr":"104.26.3.221","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.427Z","timestamp":1788741144427,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esportsdata.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 09:01:04 GMT","end":"Mon, 12 Oct 2026 10:00:52 GMT"},"fingerprint":{"sha1":"02:2C:76:E1:47:AB:DD:DF:78:F5:11:A8:4B:B9:89:0D:00:17:5A:00","sha256":"38:CC:62:D9:EA:20:2D:41:D0:01:77:C5:A3:E1:31:1D:2E:4A:68:8A:C9:01:14:FB:56:DB:59:4E:F0:B1:B5:08"}}},"request":{"raw":"GET /202/1/90bd122c05e09296e95748276c395f3e.png?win007=sell HTTP/1.1\r\nHost: img.esportsdata.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Mon, 07 Sep 2026 00:32:24 GMT\r\ncontent-type: image/png\r\ncontent-length: 10629\r\nserver: cloudflare\r\naccept-ranges: bytes\r\netag: \"63ad1abacf9c2a999e432fddb4c82833\"\r\nlast-modified: Mon, 13 Jul 2026 13:20:16 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Origin, Accept-Encoding\r\nx-amz-id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8\r\nx-amz-request-id: 18D2D8A86366ED6A\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nage: 3345\r\ncache-control: max-age=2678400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Nh%2BZGQN%2BESqliNVyNRh%2BaafYtmHCNz%2BOLbsxxqPEU45VAxirIUGcGPJ1LjcI64AP%2F3lXmhoF68v5wjdyEdHN%2B5q9pxopOyscefMEvmKc05Z3suqlYUu1q01G%2FMnvhzLe3z%2BcAA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3719db8cc3b56b4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":10629,"size_decoded":11588,"mime_type":"image/png","magic":"PNG image data, 125 x 125, 8-bit/color RGBA, non-interlaced","md5":"63ad1abacf9c2a999e432fddb4c82833","sha1":"3760a0d14d46133f0d5dc19b46a6765a84e4ab9b","sha256":"4cb218d9ad8b9b603a5aea5b81a6fa9ddafc23cda0733a2826006fca995081d8","sha512":"953d920691bf44fada09b60ed3fccb99cec292fed5e99dfe6466c250dc25031362632095ba589512548fc17aae85448a1777fbe14c245d5b68325e5e6675620f","ssdeep":"192:2BFWUrS++uOpBMjSGK46GO+3BaWtX3NTQ+Yv6iRoEaZlknzSbCSyN1n:2bl7+ZISGK4m+3s+i6ooEaZlyzSxw1n","tlshash":"cf22c09127958ea1757038a19eb00961d1c2dda25be172154fb8e21f0c2fa53ec1f97f","first_seen":"2026-06-16T01:23:41.975839Z","last_seen":"2026-09-07T00:33:21.771283Z","times_seen":49,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":-1,"dns":3,"connect":1,"send":0,"wait":20,"receive":0,"ssl":14},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"img.esportsdata.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/22f68dcea3b1459184eae4c9d586a501?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.459Z","timestamp":1788741144459,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/22f68dcea3b1459184eae4c9d586a501?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/png\r\nContent-Length: 8697\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 26831\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"22f68dcea3b1459184eae4c9d586a501\"; filename*=utf-8''22f68dcea3b1459184eae4c9d586a501\r\nContent-Md5: GW31JU6Vt0aZXd8hsY3NOg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fmg6CYykdeXc0Aamv4GEwyhyFzBY\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:58 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: 8YSGjPWEA\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: GaIAAABPXVkyytIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":8697,"size_decoded":9452,"mime_type":"image/png","magic":"PNG image data, 204 x 204, 8-bit colormap, non-interlaced","md5":"196df5254e95b746995ddf21b18dcd3a","sha1":"683a098ca475e5dcd006a6bf8184c32872173058","sha256":"e2a44ce2e74284fe9d382d6c205333316751c80cb10d9c0e94f3628b847ae4a8","sha512":"fe61d32431a52e6ca3ec279eaa2a5564e54d8f9a61712f0b5a57eecf916b7df261df7a5a2d8e7038f8314b36bbfb733257e667f9d179fc434efeb4b6146aaccf","ssdeep":"192:35GacZA27rMqiwFOq0+kOdXnRCiDHMNZMAxjU6SR4xhr1M8:3J2/WFq0+trCDgA+RSM8","tlshash":"f802bfa44b0e33276204c27b12c6326f987fa1593820c3a5e5436a58ba9f747943c1c6","first_seen":"2023-07-08T08:51:56Z","last_seen":"2026-09-07T08:08:08.104539Z","times_seen":102,"resource_available":false,"data":null}},"time_used":6235,"timings":{"blocked":5972,"dns":0,"connect":0,"send":0,"wait":263,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_50b16c20-cbfb-4c4c-ba8a-249055c85af3.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.618Z","timestamp":1788741144618,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_50b16c20-cbfb-4c4c-ba8a-249055c85af3.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/webp\r\nContent-Length: 18518\r\nConnection: keep-alive\r\netag: \"aa3d869158cd9f4a691ab5256b366ce1\"\r\nLast-Modified: Tue, 02 Dec 2025 14:07:39 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 42540\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=swJT5hurMz2lRQYY7Y2G9LNNQtxHKPPMbC5h5sD2s8T9Ss3aCIfsVXilMGPY2x2BJ1dTQzMbRJ0OeK05aQ1B3qFem%2FYXkxc4EEl22cR3j7JH8NowCq5lae8SSlQl1Gca12SEVrk%2BJjlJX9ZlxERIHIY%3D\"}]}\r\nCF-RAY: a36d8f3dfeefb472-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8e1a07947e05e77e9\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18518,"size_decoded":19425,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"aa3d869158cd9f4a691ab5256b366ce1","sha1":"46a9a87daa6c88e7055d5286cbc30e5a30bf34d2","sha256":"cacdf3b3bb35cc05bcdbadac055a705917d7ef2e422198f081e2482ba755eb5b","sha512":"d791059c03544004a3eb112223fdc6f44828e2ac740fc99c53aec39007ab4af73c6bdc3af541c57cc2805993d9f938bc1aaa46b1252c28c55d68fd135ac89ead","ssdeep":"384:+/SrnnTDDsTm3Dgi6CrYqpWrWrM5LW7A1zNb+EIItGXfeXCq:+/SrnzsS3zJiK81hS4","tlshash":"fc82d07a08094e73b16953616be5e8648b174f58100da7bf3d0166c9e32de6f74b80bc","first_seen":"2026-04-24T23:10:16.832516Z","last_seen":"2026-09-07T08:08:08.07712Z","times_seen":1021,"resource_available":false,"data":null}},"time_used":4280,"timings":{"blocked":3976,"dns":0,"connect":0,"send":0,"wait":303,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_bbac9ff6-d09b-48f7-9e60-77639d6ba1ec.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.620Z","timestamp":1788741144620,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_bbac9ff6-d09b-48f7-9e60-77639d6ba1ec.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/webp\r\nContent-Length: 10174\r\nConnection: keep-alive\r\netag: \"786d2731ac4145dbdb474c2ef236dbe0\"\r\nLast-Modified: Tue, 02 Dec 2025 14:07:48 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 48498\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HiVhJ9DVkRVZt%2BEswBv0yDEeyd6e9p0LlTTZvsd2yc7ZnYe3bfZiUNIIX%2FFLZapEGfYXAh58S7eOpBoYG1HE1Y4RwVZGorpRS%2FUvJPA4jKaJhFseNAz%2BKkw6my7X3QwmKKtzo%2B5zw82zXzBiqGWukkQ%3D\"}]}\r\nCF-RAY: a36cfdc6df042107-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c911a07947e1317f4a\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10174,"size_decoded":11087,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"786d2731ac4145dbdb474c2ef236dbe0","sha1":"e25bf96d16a7d8c9ba8cb8977c5223823b576354","sha256":"a5582288a05ad90cab5e153a954cc868cbf69672d5811c24564ed2292638b772","sha512":"aab8876381867a1eca57b4f3b8c18c5244840ce1283a71b3387e80ea096b2c956dd8cd3461861cf6be2d063f980a1c59495aa8d3c47f1579017239ac07ecd1c3","ssdeep":"192:Oz8jXYXj6SZFy5siAvpSdg/2OwNHKThGZ0G9g1/5gqWLbG0X6YqIsyT:nXbMFy5siMSdNQh3oSe6Ye","tlshash":"1c22afa5b4ff3f61484df1f1f78ad342559a697432be475d79b5467218082988c303f2","first_seen":"2026-04-24T23:10:16.833619Z","last_seen":"2026-09-08T23:44:55.13265Z","times_seen":1031,"resource_available":false,"data":null}},"time_used":4503,"timings":{"blocked":4193,"dns":0,"connect":0,"send":0,"wait":310,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_ebfde7c7-fdc6-4b58-9f46-2e709f79d7d7.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.628Z","timestamp":1788741144628,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_ebfde7c7-fdc6-4b58-9f46-2e709f79d7d7.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/webp\r\nContent-Length: 52382\r\nConnection: keep-alive\r\netag: \"d82815d2e1685b08148f834895263ba3\"\r\nLast-Modified: Sat, 06 Dec 2025 06:31:00 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 48498\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ym7F8IOBJeWwaGUjIjrsYWdTPutgKQSgL0gAJ1NQsePXHclwHlC012YyoDcTK%2FjapZQGY9ahTjkzBah7mffzSmTnERnnwng7O8ekgYUnvjJPF%2BhbmbtdJI3vHys4vyACMHb%2FOxBTzFBEfjOYYIzmgJk%3D\"}]}\r\nCF-RAY: a36cfdcd3c1d983b-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5cc51a07947e2f78b5c\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":52382,"size_decoded":53291,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d82815d2e1685b08148f834895263ba3","sha1":"77d1ecea682ed9c5c6be0f1644f2314eb3db64e2","sha256":"4dfee4506bce2de57a4d8d608edd295e0f8233b44b869f6d94481d17931a42d6","sha512":"9941cf4ea9abb6631c519ddd7067d21ac74afd06329b64581be00aa28b89e4ae7dd9750fcec2913df15a4f5fd7209a2049ae62bfec1c802d304a710105ed5d0c","ssdeep":"768:i2/E0Y/tLxLsxLHzZGHtzwzzxgHi5hUOjl7pE1+J1r5k+A8okW8winHfG1HL:xEHVNshHzIIxEuh7q4JxqXPin/G","tlshash":"a13301689c11db25d8805a2dd62fbfce984330e2231f0bca5b13d95e0bf1a852f44c9e","first_seen":"2026-04-24T23:10:16.886375Z","last_seen":"2026-09-07T08:08:08.206165Z","times_seen":1032,"resource_available":false,"data":null}},"time_used":4996,"timings":{"blocked":4645,"dns":0,"connect":0,"send":0,"wait":314,"receive":37,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/api/sport/match/list?sportId=1\u0026client=web","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:45.073Z","timestamp":1788741165073,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /api/sport/match/list?sportId=1\u0026client=web HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nx-request-source: https://g36b.top\r\nXign: wJGw6KdnjjXGHeaEOpLxVV7tiwXBn+xJ9ZFC7Nq5sc6pXUrk6TEXCurgnji5RF82aJ3SC9x8haxGLZyUFS/QSmZkpQfSfYwt09ZW2mW2OSyRJN7A5w4WzzGCVVJyg0VWBK51zpNRQDmGeKqfJg8SMk4FH05aAsCDLuQx8tawHd0=\r\ntimestamp: 1788741165068\r\nsign: 57d6v2ub6b2f3i3n\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: aDntxNnwbrytXeEW4SJfGsaRdsx3tyZ3\r\nlang: zh-CN\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:45 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nCache-Control: no-cache, no-store, max-age=0\r\ncontent-encoding: gzip\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c921a07948209283ff\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":42603,"size_decoded":7961,"mime_type":"application/json","magic":"Unicode text, UTF-8 text, with very long lines (40799), with no line terminators","md5":"189edd7b36728ce5854d50a049f4f301","sha1":"01c1375fed34f164ffd51f3a67c3c53c325c0b64","sha256":"591c3a4999841c09fc14bbceefc3158044a01f2ad9cc77c3c7d40d759e509ba1","sha512":"3175de9c6219992e9198b05c21259beecdf68ed605a92d4b276736c2f7124cad43576ad3adb23db023dfcb77517e9cc4e1230e4eeb845ccbcad96aaf25303f94","ssdeep":"768:eNCrhqfHg2vcycTd1i0hEXqOv4dxvUwQYRwJCdxtdtgHRsX16sQP2ssc5sjx2eDn:es2R/JVsUsdslsgR6RiRR00S0D0jHjHZ","tlshash":"6113ff5291de28961b9c61d55d1d3f4d887eba0b0a9ef6c9ee4ecf1821b43fb9300d21","first_seen":"2026-09-07T00:33:21.752006Z","last_seen":"2026-09-07T00:33:21.752006Z","times_seen":1,"resource_available":false,"data":null}},"time_used":314,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":314,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/c573cae7692a4927ae2802425d6b0f29?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.380Z","timestamp":1788741144380,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/c573cae7692a4927ae2802425d6b0f29?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:26 GMT\r\nContent-Type: image/png\r\nContent-Length: 27930\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 88341\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"c573cae7692a4927ae2802425d6b0f29\"; filename*=utf-8''c573cae7692a4927ae2802425d6b0f29\r\nContent-Md5: Zz/Q8jpC5I2AXhSagmipkg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FhCB2n0sieVErtlpeA568XMyynyB\"\r\nLast-Modified: Mon, 31 Aug 2026 18:51:40 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: t1DMWFxwg\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: kG8AAADCSRdAktIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":27930,"size_decoded":28686,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"673fd0f23a42e48d805e149a8268a992","sha1":"1081da7d2c89e544aed969780e7af17332ca7c81","sha256":"ba27e386ab8baba9af9ac1d8e6af1cdcbef047272cce629fa1210fccfebbcaa4","sha512":"4f16c966ec6d46584beb8199869f6d2c73e0f7211fa1f21d1f0934bdafd70f5e96e56f99a93d9f4a599ab4b7c694b7860ff59781574b438879daf0ed6624d965","ssdeep":"384:Wp1sHvBAkV2PtPedXXcF0xwt2acQlm5fQhIgxfF/wfG0EQDiciQkxEKl4atiVKJR:u1sHUtYQ0Ct2ab8QmSdCG0+XF4rk5Z","tlshash":"38c2f183c0a1c6d4051c047064a765ebde81d9efef3c065606fdb3dada3e865cc09aad","first_seen":"2023-08-17T12:39:31Z","last_seen":"2026-09-07T00:33:21.775328Z","times_seen":171,"resource_available":false,"data":null}},"time_used":2035,"timings":{"blocked":1661,"dns":0,"connect":0,"send":0,"wait":313,"receive":61,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_79864bfb-d71a-4513-a524-8823b86ee01d.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.637Z","timestamp":1788741144637,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_79864bfb-d71a-4513-a524-8823b86ee01d.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/webp\r\nContent-Length: 69284\r\nConnection: keep-alive\r\netag: \"1f023b2fde7cad748f40bc1d26f7bcf5\"\r\nLast-Modified: Wed, 10 Dec 2025 11:51:05 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 48495\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rVnuH2DXfcAbwLMJRkewH9xrlatRBf75bEaeOFrotic7dX%2F5sY%2Fq6m9dzrrs6kzJxPYiCzWhdnF0u%2BZlJPkwu7%2FoFMkEeT8F0xBFCZmv9V8fFNjAC4bcY2InNO%2BKrpgVhxc5ujt4g0cls38Qdxo1gwM%3D\"}]}\r\nCF-RAY: a36cfddf9b15d76d-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c901a07947e50787a0\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":69284,"size_decoded":70197,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"1f023b2fde7cad748f40bc1d26f7bcf5","sha1":"b6f87014c3efd309dd208adbde662efd12ed1630","sha256":"37500d21d34445843f3857ddc61970168d68b86f1f37208f3e0b05b5fe1575ee","sha512":"afc994859a75b3a91939974cdd03b6973f68d7e5be316f8a67ac60412782cb748d7ad3b7b7f62d931496e61c198098e6ff42f280ec5c5ed40164f5351dde15af","ssdeep":"1536:LQyDg35QNQHWhyCUVgapIL88bSxgjfxjgS1xnVluzXj1/7qLE0rOFXrb:8qm5MQvC4gapxxgFjgQn7ax/kE0rSH","tlshash":"d66302cf2367021ed8f7a779922a46dda041f25ed16a73acfc919d45f88221726ec09c","first_seen":"2026-04-24T23:10:16.798872Z","last_seen":"2026-09-07T08:08:08.179864Z","times_seen":1076,"resource_available":false,"data":null}},"time_used":5589,"timings":{"blocked":5165,"dns":0,"connect":0,"send":0,"wait":337,"receive":87,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/config/initGeetest4.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:19.381Z","timestamp":1788741139381,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /config/initGeetest4.js HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:19 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-3a7f\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c911a07947bc357f36\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14975,"size_decoded":4830,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"87855e19802d75b55afa7bcf3af515c1","sha1":"4af373375728a98d623f2299a68a91e150f2672e","sha256":"9ec8a5ef8c8ffe369dd1a5c4730dce6570c0d90955798c0be4ac04ef1c8f4baa","sha512":"3baa6d9e916abfb3d38b7ebb9372c5987e8f10534bb978383751c0094f8f5a3e764f9b8e44a73d9d4871cbaeca7e1939f0ffaf9499af5c4a71f64c3588167d85","ssdeep":"192:23aP8Ha0D+Nu5dq+EvNiqc4K25MB5VYaiQwSL4SScQVy8QRHIsGiz0iX9rES6Myy:2fe61w1iXKb2sMGUI+KQTwwHlB","tlshash":"00621d0d68f764534553b4388b9fb014b5388a53042cde41be9ce354afa843d9bbabdc","first_seen":"2026-02-16T20:32:40.162764Z","last_seen":"2026-09-08T23:44:55.19034Z","times_seen":2213,"resource_available":true,"data":null}},"time_used":308,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":308,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/kc523-1/sponsor/sponsor.json?1781011825626","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.650Z","timestamp":1788741142650,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor.json?1781011825626 HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:22 GMT\r\nContent-Type: application/json\r\nContent-Length: 646\r\nConnection: keep-alive\r\nLast-Modified: Tue, 30 Sep 2025 12:19:27 GMT\r\nETag: \"68dbcacf-286\"\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c881a07947c94f8133\r\nX-Cache-Status: BYPASS\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":646,"size_decoded":1048,"mime_type":"application/json","magic":"JSON text data","md5":"10d2161de8cf99c474812f4c43645a26","sha1":"71884ef7281cdcb5084088f16d4550ce8790e634","sha256":"bb02fd7438bb49dd4decb6f76a71f11e93355332fd9f965d6f9f13bb8175aeca","sha512":"bf0fd1232309fcc5582d5c42644e1c7b4b8d235b1066e988ff55e0dd94a956f89742401f00c2d904359041c8e0c2bac8e9316252fab60db5eb0a3b4c935172f0","ssdeep":"","tlshash":"d8f0f44ad8b25b93211fb57c58cd050470294a8f0eccaac4baac987c4f598ddd1e839e","first_seen":"2023-06-16T04:51:50Z","last_seen":"2026-09-08T23:44:55.092773Z","times_seen":2989,"resource_available":false,"data":null}},"time_used":401,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":401,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/6e83802707b643a8a8474d00069d267c?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.383Z","timestamp":1788741144383,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/6e83802707b643a8a8474d00069d267c?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:26 GMT\r\nContent-Type: image/png\r\nContent-Length: 32056\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 88340\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"6e83802707b643a8a8474d00069d267c\"; filename*=utf-8''6e83802707b643a8a8474d00069d267c\r\nContent-Md5: jmEsdE0KuUac84jbrEfewg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FqTDj3tmlmphgPfQ24cM9ZpOZaKv\"\r\nLast-Modified: Mon, 31 Aug 2026 18:51:43 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: 43Lmzbt7h\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: 0scAAAA-uyxAktIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":32056,"size_decoded":32812,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"8e612c744d0ab9469cf388dbac47dec2","sha1":"a4c38f7b66966a6180f7d0db870cf59a4e65a2af","sha256":"f72882c49c2cc829f0e2872ee5541d8589c8607b0aa618dc46dbd1fe2cefe5c1","sha512":"a3e998f1f8930921488fcb1859df50d02d99cb7c300072f2f2a7044fcebc461e0b0a2907d53a767821201ca939fe03fdbbdbfa08c889fc9cf2d7cc01f686b4fe","ssdeep":"768:je6pyuy1v2XQvVqzVbjvbz86fCXqTuhwnDvq4CXM:R5yIXA8Fvbz86fGq/Tq5c","tlshash":"bfe2f29d5cd9cc4dc398114b2c59ca811fb779e6707f24cdb39ba69210e623f86c2978","first_seen":"2023-08-17T12:39:31Z","last_seen":"2026-09-07T00:33:21.777266Z","times_seen":187,"resource_available":false,"data":null}},"time_used":2135,"timings":{"blocked":1859,"dns":0,"connect":0,"send":0,"wait":255,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/c5db2d046cd44cf2a2f8c97dadcc97e2?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.475Z","timestamp":1788741144475,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/c5db2d046cd44cf2a2f8c97dadcc97e2?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:31 GMT\r\nContent-Type: image/png\r\nContent-Length: 134980\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 23548\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"c5db2d046cd44cf2a2f8c97dadcc97e2\"; filename*=utf-8''c5db2d046cd44cf2a2f8c97dadcc97e2\r\nContent-Md5: 7h5/FQ2dXv1VvNJPnM0JmQ==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fi4fd3GYRHKLse6D3QbWbwv8Wvut\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:11 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: MnrooE4X5\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: s0MAAACnM_MuzdIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":134980,"size_decoded":135737,"mime_type":"image/png","magic":"PNG image data, 372 x 366, 8-bit/color RGBA, non-interlaced","md5":"ee1e7f150d9d5efd55bcd24f9ccd0999","sha1":"2e1f77719844728bb1ee83dd06d66f0bfc5afbad","sha256":"53003d8b26e3c6494cd03b343696f866ce76eb09b88921af7ede393ad4a34625","sha512":"d948c5257aca09dcba2e088c2551a579c95d89772882d0297e68b62696f7fd5accbb621651e437ee163f9692e67741236e992fd3ad33219d42f079b0e9c5f088","ssdeep":"3072:Cx1u86btA4rGPYB1nzIr9gFVquF+sMMGB5QBuPZ8T7:WVct7rvnzDnB0sY5WuPc7","tlshash":"e2d312b93ecfac310914535c3189ef4ab711a06cf9457db4fd881f95c8e9b3a8622275","first_seen":"2024-08-19T14:24:38.520806Z","last_seen":"2026-09-07T08:08:08.327681Z","times_seen":81,"resource_available":false,"data":null}},"time_used":7248,"timings":{"blocked":6878,"dns":0,"connect":0,"send":0,"wait":252,"receive":118,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/f4822ecc046f45c2b114bcabda5d577d?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.491Z","timestamp":1788741144491,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/f4822ecc046f45c2b114bcabda5d577d?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:32 GMT\r\nContent-Type: image/png\r\nContent-Length: 10346\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 16348\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"f4822ecc046f45c2b114bcabda5d577d\"; filename*=utf-8''f4822ecc046f45c2b114bcabda5d577d\r\nContent-Md5: rnBKGpjN8HUTjj1Np/xuNA==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FrhvU5DYWMkb6JhpmxhewLaFeTO3\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:44 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: 859RrTvDA\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: AzoAAAD_I6a709IY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":10346,"size_decoded":11102,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"ae704a1a98cdf075138e3d4da7fc6e34","sha1":"b86f5390d858c91be898699b185ec0b6857933b7","sha256":"b61caf2d5d412c0eae882129328c6fdd21dd5b308cbd6893de16f57ebaf937f4","sha512":"8dbcae32a720304118172648e5c56e302619b5179f5afa08b736600a92428a0c21405070eacc1c3919e04848b2f8b4c800f988a5c6b5350a54780486ac16db42","ssdeep":"192:29Xbk5ux48AKg/AvLPFEKuYu6P1AnHne0J0XJYgWd+oLEUM8M/5JlybfKPLDUhkp:29XbrxngEP+KXuguC5YgWd+2E/5JfPfh","tlshash":"6522af5119158ed3fbda29f42cc69e6e153c90a58ec24eff937f54909238eb84887b14","first_seen":"2025-03-31T13:06:08.154965Z","last_seen":"2026-09-07T08:08:08.34753Z","times_seen":123,"resource_available":false,"data":null}},"time_used":7885,"timings":{"blocked":7617,"dns":0,"connect":0,"send":0,"wait":268,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_ca5ef219-cb88-4c5a-b68c-c85984b21465.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.609Z","timestamp":1788741144609,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_ca5ef219-cb88-4c5a-b68c-c85984b21465.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/webp\r\nContent-Length: 83944\r\nConnection: keep-alive\r\netag: \"cd3cf96ac48355aa8a68b4dd114b3511\"\r\nLast-Modified: Sat, 06 Dec 2025 06:32:14 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 48514\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HIuDLeypCFyfptR%2FWTuSi1%2Bs97G0rLzzubuJwJQ4ZPoyO1HATxKovGb4gFXcHq2nrwWQMRFYpIa64R4Gh0EoZkgPTMVoSI%2BkYDEZX84MfqZcF9%2Fvhkh8coswJ%2BcBamqzjPc9%2B7zTT5WJ%2Fh8c6ppbX%2F0%3D\"}]}\r\nCF-RAY: a36cfd68287d5240-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8f1a07947dd97788c\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":83944,"size_decoded":84863,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"cd3cf96ac48355aa8a68b4dd114b3511","sha1":"344310d10f86fbdbc05ee7080d3ca849573ac9ef","sha256":"e9d91b84873b60fda60b6113151bcb7abb1225aa67f1d823343f611eac3c92af","sha512":"987cad3ea6ba2be77a3fd0904132cb11c1945e1e5556cdec550708d2e22c279398f951312a4029b369980af4ab0b30f4fd72ad5d38740800d6dd48938d323016","ssdeep":"1536:Ka0Pq9/ipy6cNgUraO4ysYwAcTa6bfr9BHltyI4VGeglGZVClKy:Ka0Pq9/hzvhsTAp6bhBH7QLZolKy","tlshash":"2a83128e457a2ceec4bf7de9267cf94f60ca5e31557b1add437826c5208b80cd227292","first_seen":"2026-04-24T23:10:16.791296Z","last_seen":"2026-09-08T23:44:55.147046Z","times_seen":1068,"resource_available":false,"data":null}},"time_used":3733,"timings":{"blocked":3272,"dns":0,"connect":0,"send":0,"wait":323,"receive":138,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_91f2d885-8341-4928-bace-352c8c691bef.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.624Z","timestamp":1788741144624,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_91f2d885-8341-4928-bace-352c8c691bef.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/webp\r\nContent-Length: 11602\r\nConnection: keep-alive\r\netag: \"5b6551f12b1b84f1734c1a1990de36e3\"\r\nLast-Modified: Tue, 02 Dec 2025 14:08:32 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 53763\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=E61GCcxNy9vDq4%2BA%2FAOuwzpPsYv4pbFE%2BNHLtVvCsVZZyCFcky7nrHHnF5Jh3HrBVekkM0YKX%2BlHz05aWfY7%2FaaPiOY4rYrz1Zaw9swxZ9VQNqyvFmqNnRRrr8OnRI2Qr3TwvqwhO78w1ToB%2ByL06Xw%3D\"}]}\r\nCF-RAY: a36c7d448df12107-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5cc51a07947e1bf8b5b\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11602,"size_decoded":12517,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"5b6551f12b1b84f1734c1a1990de36e3","sha1":"4a9abbac21133dee3830561cdd3803655c193744","sha256":"fdf8c30716a64d0ba082686010f70ff0347eb4bc57f861ff9ca67ef41700059c","sha512":"c02da03187076f9921fd89e31f1d92cc60c78da95d5b35e179d76d11842191eb9f52431e4a7322e0a9c5d6d54b8c484aa6dea6d6f653557818f3383300b97f61","ssdeep":"192:U9/EwHQZEoeKC69DzEtpjQM8dUNCtSyj2OG5hSutqwILUXr/mt/XqzLYKHiifMfi:4/EwwZpe4Y3MMqUN/Qlw84IL4/M/an/H","tlshash":"0f32c043a66ed2fab717ab660556d304de22e0d468553406d7ebd43a302effeb180d0b","first_seen":"2026-04-24T23:10:16.72574Z","last_seen":"2026-09-07T08:08:08.398374Z","times_seen":1026,"resource_available":false,"data":null}},"time_used":4645,"timings":{"blocked":4333,"dns":0,"connect":0,"send":0,"wait":312,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-07T00:32:18.184Z","timestamp":1788741138184,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:18 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nCache-Control: public, s-maxage=600, max-age=0\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c921a07947ba0f83e3\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24594,"size_decoded":11244,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5777)","md5":"e79ba8d5268f3090203c26b2ec87119f","sha1":"67ec737a939ce7eb32f6c9ab0f6cb36a5d0c5045","sha256":"f03b70608a46781f56d44226537411cfd4da69014f8c6540319977c45398149b","sha512":"378079455a3539b8fa003afc4351f6acd844d704e0f41250b71dda29b445cb99821596e562eed3afea6a7d0b6de1ff61e22754a4c3d9384952d09b90f4dc3e55","ssdeep":"384:21ERlxqNBPJu2VwiYwJvSoVXsp+pa/iZcVk97g6nMusplIiz:1RXqrJuiNYiKop/E6wkpcu2llz","tlshash":"05b2195a9df3497a2423303a1f7fb20869b0d0134309ed803e4de7594f95aaa56f3bd6","first_seen":"2026-06-12T19:29:57.247756Z","last_seen":"2026-09-07T08:08:08.110319Z","times_seen":1244,"resource_available":true,"data":null}},"time_used":1017,"timings":{"blocked":0,"dns":27,"connect":304,"send":0,"wait":371,"receive":0,"ssl":315},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/83749.1781011881923.02b71cf6.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.579Z","timestamp":1788741142579,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /js/83749.1781011881923.02b71cf6.js HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:22 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-16665\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c941a07947c9078265\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":91749,"size_decoded":28924,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64016), with no line terminators","md5":"c1d2645de169d30e7a814fdbd1c1a47d","sha1":"41959bb5171f196d813c4b3c27bb3135d993ff43","sha256":"a400126839acc7fff4ce08e50633afc5560f3eb3e8aae7ec697fff30423bd26a","sha512":"21e02eeba3e71baf0938766c7abf83b68a4f54b149ea679f43c221c429729dacd395ed0e54233ff22be739636dcaf0104cd58083c50df9b6c521fcb2c3e27419","ssdeep":"1536:lcK/KnqHB3vmxuHXvKe+Gruc7iSxTcgOX8JwTl0sI5pQiVFFsdt+H+Xk:rB3vywXSex7HYgOXawTl0sgQi2tkwk","tlshash":"3693e7c4b5f4f5f8279ec5a2973644b8b02527c5b1c8ace0d2e96e147f19b62b0718bc","first_seen":"2026-06-12T19:29:57.252198Z","last_seen":"2026-09-07T08:08:08.217425Z","times_seen":1162,"resource_available":true,"data":null}},"time_used":821,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":604,"receive":217,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/api/sport/match/player/match","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.369Z","timestamp":1788741144369,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /api/sport/match/player/match HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nx-request-source: https://g36b.top\r\nXign: IEndzFgLERgzm3nqfSrPK+UH2s7GBzY3fW1B5nPESQUTwASVb/ZL3AODpVu91cMM21/CitzH/EmV6eC51PkEW4A14km2dumzV/wiklPNtj78i3qWPCBkugLF12ntKHMBKzSomPDjyH9mtRDwIde5M4SsXklMNTV9U0TbvDo+u9Y=\r\ntimestamp: 1788741144187\r\nsign: 1v6o411a7g195m6v\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: aDntxNnwbrytXeEW4SJfGsaRdsx3tyZ3\r\nlang: zh-CN\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:24 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nCache-Control: no-cache, no-store, max-age=0\r\ncontent-encoding: gzip\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8c1a07947cfb1811f\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":60,"size_decoded":475,"mime_type":"application/json","magic":"JSON text data","md5":"ad1b5cbc37e087c212a41eca07a863ae","sha1":"f990fb40077ca4c90bbde8ffb87c73e1c06fd931","sha256":"0fca88eefe8bb5f59242b88e2b8b179148a088b4cde3499e1c56fef8c84c309a","sha512":"fe056eef22791a958cc37f63c1cc4b3f35bd990c34d1d321f34504b7b99769b571fe46cf18ede31f7ca0e564baf63aaca9d4f3601395bd7a3ce424e50a2aaf87","ssdeep":"","tlshash":"56a002473a282ea49bc31066b50e7a5500a421749a55f469cc8e623dc755453b546531","first_seen":"2024-05-26T00:49:06Z","last_seen":"2026-09-08T23:44:55.173662Z","times_seen":2832,"resource_available":false,"data":null}},"time_used":315,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":315,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/7014926b1aa9411d9d4a57c2554053e7?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.431Z","timestamp":1788741144431,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/7014926b1aa9411d9d4a57c2554053e7?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/png\r\nContent-Length: 105094\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 28944\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"7014926b1aa9411d9d4a57c2554053e7\"; filename*=utf-8''7014926b1aa9411d9d4a57c2554053e7\r\nContent-Md5: zTaD2xn88RZqeaLdyCYfqg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FoTwvg1_L7DKb0QATbRjzU_UZRWN\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:42 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: RSFdtkE0W\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: H70AAAA7VDhGyNIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":105094,"size_decoded":105851,"mime_type":"image/png","magic":"PNG image data, 300 x 368, 8-bit/color RGBA, non-interlaced","md5":"cd3683db19fcf1166a79a2ddc8261faa","sha1":"84f0be0d7f2fb0ca6f44004db463cd4fd465158d","sha256":"ee41572e252e24b53853355316322ec0c5d1114aa13653eda6827ffae5091516","sha512":"11a52d85cda3639acd42b60d2d9da631c03cc8a7bfd916dcfaf3723822d57daa9995709e36a9c21ce31f2814351c7e73cab648e5a6c18fef1fb8c02a9f58097b","ssdeep":"3072:HDPdjwAwCSdXbQl+lzAIONUOXUv5ESfqSDq/kAYoHng:jPeHXXdlzLON9ARO/pYmng","tlshash":"69a31223fe30760b6143e519952809cdb97c2a9781bae1f9df30e8143979d3ba3d9230","first_seen":"2024-12-26T20:26:09.884535Z","last_seen":"2026-09-07T08:08:08.326774Z","times_seen":182,"resource_available":false,"data":null}},"time_used":4879,"timings":{"blocked":4561,"dns":0,"connect":0,"send":0,"wait":259,"receive":59,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/f293fc9f60ff441288c02326abd0351d?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.434Z","timestamp":1788741144434,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/f293fc9f60ff441288c02326abd0351d?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/png\r\nContent-Length: 31893\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 27130\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"f293fc9f60ff441288c02326abd0351d\"; filename*=utf-8''f293fc9f60ff441288c02326abd0351d\r\nContent-Md5: M5xqyv6cJF3F2GJ8YFKMog==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FotaGNWcV0aJSFIMIZed61YmUUt-\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:46 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: nm6gaS525\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: wXQAAACK-4vsydIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":31893,"size_decoded":32649,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"339c6acafe9c245dc5d8627c60528ca2","sha1":"8b5a18d59c57468948520c21979deb5626514b7e","sha256":"4ac9d10080e9aac10cad482f058aba94f5e0bd358719a10925a36f2c3a3a176f","sha512":"0bacdf9c10504a5d95523822ecc86de25cad478ce4d6cd32aa8eddfa347c12581e2d80be056f2f54b62042c1e8bef47a900696a99bc812a22be0c08a596c8c1a","ssdeep":"384:bh3wlSiM4zaxGLuG36vO6M0a6YHnFUsXB9ArP71i1nkpt3TmRPluLnKBt9YkHkoS:mNz7Kvj86YlRR+X1i1qt3qHSnKBfBTi","tlshash":"f5e2f0ccfccf80356f0e593a92904137acc12036d8a9abb6f47b49130b4b1638a799dd","first_seen":"2025-07-24T03:51:44.20104Z","last_seen":"2026-09-07T08:08:08.296588Z","times_seen":191,"resource_available":false,"data":null}},"time_used":4941,"timings":{"blocked":4672,"dns":0,"connect":0,"send":0,"wait":253,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_fc0e1468-bc71-4d42-9849-b6735b50978a.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.641Z","timestamp":1788741144641,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_fc0e1468-bc71-4d42-9849-b6735b50978a.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/webp\r\nContent-Length: 11120\r\nConnection: keep-alive\r\netag: \"c2103cd78445d5d98b8a8a38dee95854\"\r\nLast-Modified: Tue, 02 Dec 2025 14:12:18 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 48497\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QoAmXwNxfssJr1viopRPRhyxtW1onw14r%2Bvc2RrnY1w0UWQAJMrXCJVZOaWApUkxfni%2FhuZMBvY3l%2Bk6TkoDtOV%2FHLI3M4ITPrwmDlVY1HflPFDVw2EnDI%2FoH7AYcKHAl1QCCz7ZqsW%2BvQOr0xCKthE%3D\"}]}\r\nCF-RAY: a36cfddee86e0799-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8c1a07947e61a812c\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11120,"size_decoded":12035,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c2103cd78445d5d98b8a8a38dee95854","sha1":"77e8b55343bf4092e6a298d564b828b7167d73a7","sha256":"23f7d437c49f455c0bbe3d040982bd6cf8d25411106c3eaa156cc3e4760c3c1b","sha512":"c1f7b1f8f0187dd22795297f21febc867932be6f47b9d033e4df6dbe5f456cf4f7b97d88fff1320945d581b13e4e23cd66330b4432f6f506e504b9dcc01776fa","ssdeep":"192:UFGWMz7rqmua13y84zY36YC0JwSCH2XOc1wK3/RZ/dHGKFdVr5suOWQgcSQBO4mZ:Qmus3ytKC236rKJr53IW4mZ","tlshash":"1f32afcec9dc3b159c35837d36252988ea4909130b3762d2752a64c646eee8a3196bb3","first_seen":"2026-04-24T23:10:16.81812Z","last_seen":"2026-09-07T08:08:08.426718Z","times_seen":1129,"resource_available":false,"data":null}},"time_used":5765,"timings":{"blocked":5447,"dns":0,"connect":0,"send":0,"wait":318,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_b219e889-d34b-4c28-b534-674fb2e77fdd.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.639Z","timestamp":1788741144639,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_b219e889-d34b-4c28-b534-674fb2e77fdd.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/webp\r\nContent-Length: 105348\r\nConnection: keep-alive\r\netag: \"e55c87e5077d7d737d02e9a373cf6a5b\"\r\nLast-Modified: Wed, 10 Dec 2025 11:55:39 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 53763\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8h89oOs6OZ0pmsmjmnL5RfzCm6gLykelouS%2F7IOnqDjXkFwfDIsETFNDol6APruULSRWQWDxIVeub80nCTBGhddXep11ylEbnyl1id3RCaSL2HRHLW5OqpJXy4%2Fig2ImE%2Bl4xeKICI65CUh0tD97Kk0%3D\"}]}\r\nCF-RAY: a36c7d4e1a8709c4-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c911a07947e5d67f4d\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":105348,"size_decoded":106258,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e55c87e5077d7d737d02e9a373cf6a5b","sha1":"21898eb8dc994254eb1a125a5f6310fcf94b08c2","sha256":"e2a9d5843140eddeabf22fd2e092ea761500c7b0cbf432c3de4f0e5fda23d2d5","sha512":"b17785a3c181a357def9c7bdf608f2ceb1df6b17339a0b2756e8fef4930f04fbc2fc70d2a4f22cefec30adafa5d9d1b0d259594b97dfa6a7c1fd650322e27f41","ssdeep":"3072:aJ/fAaUQyCHbeJiOjCkW/cRnU/xMT2Wfw//CVX2W:a1oaRyCPYCJe2WfwoX2W","tlshash":"42a3123992169346e97329aa30f80f4dde9874557e26204d78c8d64e45122f2fe78fca","first_seen":"2026-04-24T23:10:16.778762Z","last_seen":"2026-09-07T08:08:08.146015Z","times_seen":1105,"resource_available":false,"data":null}},"time_used":5831,"timings":{"blocked":5379,"dns":0,"connect":0,"send":0,"wait":314,"receive":138,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/kc523-1/sponsor/sponsor_web_2.png?1781011825626","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.715Z","timestamp":1788741142715,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_web_2.png?1781011825626 HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:27 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 30 Sep 2025 12:19:27 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68dbcacf-a049\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nAge: 48521\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8c1a07947d98f8123\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":41033,"size_decoded":41188,"mime_type":"image/png","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 428x169, components 3","md5":"66036fddf71ff69f45c146ca63883070","sha1":"4b3076a271d5042ef1b6cffc2ff49f421a819f08","sha256":"93c59a52fe04b0050dd4552a135177533afbe2dec54f10c516610b0dee857e0c","sha512":"29c2fc65e144e5d13c011e4897e0bdf771c7b4c249875eca4fa25589625696c71ec015e7e8ef3a5ee45f2a6ae9df3663da0bb736a6fb13c9628f0d0957827c71","ssdeep":"768:6eyNeN9huVfPKv0KhazApErcA6cFKSkS+pbTCx81TxUqIUgYWxDHc9wZGbYGniRl:6eXXh8KcQakywKK++tTCi6xD89HbxiD","tlshash":"b003f15c4c413e7777f19baae00ac84224d11fd4fdd5e3e61a8bc659a843a68bc2540e","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-09-07T08:08:08.219854Z","times_seen":2423,"resource_available":false,"data":null}},"time_used":4526,"timings":{"blocked":4178,"dns":0,"connect":0,"send":0,"wait":323,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/img/loading.da46bff6.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.717Z","timestamp":1788741142717,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /img/loading.da46bff6.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-09T05:47:36.08732Z","times_seen":18359622,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/969f5995e3934ab19f423b43a42d98e8?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.329Z","timestamp":1788741144329,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/969f5995e3934ab19f423b43a42d98e8?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:25 GMT\r\nContent-Type: image/png\r\nContent-Length: 42074\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 5551\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"969f5995e3934ab19f423b43a42d98e8\"; filename*=utf-8''969f5995e3934ab19f423b43a42d98e8\r\nContent-Md5: 4F8D4Ak+t2Tag1k4kZqaNw==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fs8zownNDF1Mplxs673c0JdV9R34\"\r\nLast-Modified: Thu, 03 Sep 2026 06:49:05 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: yV6VYU6e6\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: 0LEAAAD-fsCL3dIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":42074,"size_decoded":42829,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"e05f03e0093eb764da835938919a9a37","sha1":"cf33a309cd0c5d4ca65c6cebbddcd09755f51df8","sha256":"c8746b6e03c68ed90f42ddb1569c295955f6b0b8232f0b1778e0cb1f4a1e6119","sha512":"6feeb9c3400bb846fc2e3141c45cb35232d3f8ca1f6bc87e203aa7254738555ab45fcdb9addea253b3a8593b5478f773f2a755c68534791f7a226d2a237ae9bd","ssdeep":"768:AZyIg3xpf2nYqrDUttPst7l6/QomNE62Xejm4hkzILooJ0uhQ5dVj:AZopOntUsl6ooMD2XUB0ZbFj","tlshash":"c913f1f2510d4b6f09954069ce56e33afc3a153614e0391dbcca2d10a6de3d5d8f3a96","first_seen":"2025-07-08T00:41:53.008072Z","last_seen":"2026-09-07T00:33:21.785394Z","times_seen":16,"resource_available":false,"data":null}},"time_used":1504,"timings":{"blocked":-1,"dns":304,"connect":257,"send":0,"wait":514,"receive":166,"ssl":263},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/7f515eb916144033ae4b7356ea210234?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.332Z","timestamp":1788741144332,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/7f515eb916144033ae4b7356ea210234?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:25 GMT\r\nContent-Type: image/png\r\nContent-Length: 20930\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 91923\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"7f515eb916144033ae4b7356ea210234\"; filename*=utf-8''7f515eb916144033ae4b7356ea210234\r\nContent-Md5: GRW2vq/G4Yvjui4XH6HV+Q==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FrIvx8BTengQrZWGlmvBBdpQwW2j\"\r\nLast-Modified: Mon, 31 Aug 2026 18:52:35 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: PVbh31U0R\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: FcYAAAChI6r9jtIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":20930,"size_decoded":21686,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"1915b6beafc6e18be3ba2e171fa1d5f9","sha1":"b22fc7c0537a7810ad9586966bc105da50c16da3","sha256":"05bd6425b657ad0327b886c680918756e47981141220cdd082eaff31adb32881","sha512":"b86130366a1a1b800b410ec90994a2827cd5a98564137e6bf6040fc86545dd203998770295c3bde6c5ef66733b072f18470cbb472c5d312074cc236bb1e4b0a0","ssdeep":"384:g2Cysq6ZvgvI7IMsSXNR42b2LZUcuqSI7INnA6Pwv2oK:pMh7bZdR4q2ac/SIMNnA6PW2T","tlshash":"ae92e1694114f0d00abe87bbb90e2340763adc5c1bfe4e532ad06db5161ca5b54e1fec","first_seen":"2025-02-04T17:13:01.023819Z","last_seen":"2026-09-07T00:33:21.786072Z","times_seen":360,"resource_available":false,"data":null}},"time_used":1325,"timings":{"blocked":-1,"dns":302,"connect":247,"send":0,"wait":494,"receive":26,"ssl":255},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/d0d2461529f9470ab27bc58fa3f6cc8a?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.384Z","timestamp":1788741144384,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/d0d2461529f9470ab27bc58fa3f6cc8a?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:26 GMT\r\nContent-Type: image/png\r\nContent-Length: 8995\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 1970\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"d0d2461529f9470ab27bc58fa3f6cc8a\"; filename*=utf-8''d0d2461529f9470ab27bc58fa3f6cc8a\r\nContent-Md5: JKHpNNYXaC55Ixbt5/YKuQ==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fruo4rDKhCvjZ_rUe6VL3zrXBW_o\"\r\nLast-Modified: Mon, 31 Aug 2026 18:52:29 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: 4BhZxcAnF\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: 6NsAAAAkkODN4NIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8995,"size_decoded":9749,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"24a1e934d617682e792316ede7f60ab9","sha1":"bba8e2b0ca842be367fad47ba54bdf3ad7056fe8","sha256":"d5c2ecd3421167087368a1460e7ec48499671fe95026657ef5e20de8f5321a6b","sha512":"d1577b39a045a24abdcad3254498a95ef6ee67058bb2f9b5c119781e27013cd3119ef3a2e57876b3136b18f94e4d6f7ee8e7465da20ae295c92b6d063e859942","ssdeep":"192:5+3w+O2B/fhoh3WKrvam3JfCcHyXCItXIw+h:5Ew+VJfuhGK7P7ACIt4Bh","tlshash":"7402af4e799a0386e5447feb5b5b53137092debe252a04f1387b4a1ec82172f10424de","first_seen":"2023-08-17T12:39:31Z","last_seen":"2026-09-07T00:33:21.786729Z","times_seen":32,"resource_available":false,"data":null}},"time_used":2220,"timings":{"blocked":1958,"dns":0,"connect":0,"send":0,"wait":262,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/7137d5f86cb04be2aed2da5d83d16fcd?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.437Z","timestamp":1788741144437,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/7137d5f86cb04be2aed2da5d83d16fcd?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/png\r\nContent-Length: 8225\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 27130\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"7137d5f86cb04be2aed2da5d83d16fcd\"; filename*=utf-8''7137d5f86cb04be2aed2da5d83d16fcd\r\nContent-Md5: XWbJFD2P4krRn9oOZ2X3Bg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Ft14-E5Q-yXyIkwyOwsYVBRSZ5UE\"\r\nLast-Modified: Sun, 30 Aug 2026 19:14:50 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: y2gkhZLL8\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: tkcAAAB4zJbsydIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8225,"size_decoded":8980,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"5d66c9143d8fe24ad19fda0e6765f706","sha1":"dd78f84e50fb25f2224c323b0b18541452679504","sha256":"d7ede69f34851758ef3bd7109077cc719c0b6118d768db7b3fc312cc5b42b46d","sha512":"a7c8100e67bf64d42d58047463b152fd23f5d3bb9ac44c5f989f2d99107ca5868ededac143d8c25b71b69fb2de00612ea9339e85dcee7dee034a8e99af23ba50","ssdeep":"192:QgZp9eVl1wfaXPYzePcHcir5ayoDlgLCF5YRigj0NA8THMdx2TRG:xZXiJseP0cGUgLUYRiIJx32c","tlshash":"aa029ed40281ba5f7821de7cd58b17dbf28f136d5ae606ac7bc115611184d22c719cba","first_seen":"2025-08-15T12:24:17.035007Z","last_seen":"2026-09-07T08:08:08.171032Z","times_seen":30,"resource_available":false,"data":null}},"time_used":5191,"timings":{"blocked":4928,"dns":0,"connect":0,"send":0,"wait":263,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/80ba9cd54adc45458f22189331d0944c?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.449Z","timestamp":1788741144449,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/80ba9cd54adc45458f22189331d0944c?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/png\r\nContent-Length: 19771\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 27129\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"80ba9cd54adc45458f22189331d0944c\"; filename*=utf-8''80ba9cd54adc45458f22189331d0944c\r\nContent-Md5: /ZVNCD7oWm8aPyRx3HViQg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FlXwTYPQH0AsMIt25PqWp_sfeMeu\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:50 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: hvhkTj6Vt\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: XjIAAACvYursydIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19771,"size_decoded":20527,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"fd954d083ee85a6f1a3f2471dc756242","sha1":"55f04d83d01f402c308b76e4fa96a7fb1f78c7ae","sha256":"1576760ad926f7ac4d0daa1f4ddb9948ae4a94b76cadce6ba06aaa7de2fb87eb","sha512":"3a12da7da28de16f0d3c8ae950f38c7279e56ac8911f1723493f4ed50613a02e276396b9e036dd5b0615895340810eeb45fc071f9d348381b0ac54149509cb77","ssdeep":"384:FkY/8NldeH/VQNkZCl0E9drsnYqZVXW9URWkUIHG3nQ6VVwWiAqkNcR:eq8fsf6JAYqP/UImnhvQkuR","tlshash":"9792cf270a7fed708d1ed3466569453e801fb03c392bb794ed8692ea1bd081d8e186b3","first_seen":"2025-02-21T06:40:25.57561Z","last_seen":"2026-09-07T08:08:08.43938Z","times_seen":270,"resource_available":false,"data":null}},"time_used":5719,"timings":{"blocked":5438,"dns":0,"connect":0,"send":0,"wait":272,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/df53f2b9549742f7b7e94d88f7f74d7f?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.468Z","timestamp":1788741144468,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/df53f2b9549742f7b7e94d88f7f74d7f?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:31 GMT\r\nContent-Type: image/png\r\nContent-Length: 29942\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 25326\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"df53f2b9549742f7b7e94d88f7f74d7f\"; filename*=utf-8''df53f2b9549742f7b7e94d88f7f74d7f\r\nContent-Md5: 2EUqjGzv/sqI1qY8Vr+V+g==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fv-M-EU6cCxDFEQRbGWD4TBmQEQC\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:01 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: iUg9NkpKi\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: rp4AAAD8MvaQy9IY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":29942,"size_decoded":30698,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"d8452a8c6ceffeca88d6a63c56bf95fa","sha1":"ff8cf8453a702c431444116c6583e13066404402","sha256":"63cd113115fbd200e48f3deffb6860e157bdec210fc9f5a8916725eea457397c","sha512":"c5904cad1621eeb02d9500deb414d6ffb8844593aa532aa3b7bb2ab6c426260d8d11c387a80bd1f572167c1cac05f5d47e5625290d306f0f7f7a4ccfb3d07db5","ssdeep":"768:em1JqNIG/nG8UsdCem4YtLV5XOclcVaZY++81:em1o+85dCem4YtJ5B6Vu+81","tlshash":"aed2f14b39486b3972fd0cc6d2596510a4844d1d0af4a91398b2b7c3bff019bbf9582e","first_seen":"2023-05-30T11:51:18Z","last_seen":"2026-09-07T08:08:08.455445Z","times_seen":128,"resource_available":false,"data":null}},"time_used":6799,"timings":{"blocked":6501,"dns":0,"connect":0,"send":0,"wait":272,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/9f712d268a714877a8fd5836bcd4089b?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.468Z","timestamp":1788741144468,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/9f712d268a714877a8fd5836bcd4089b?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:31 GMT\r\nContent-Type: image/png\r\nContent-Length: 18560\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 25326\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"9f712d268a714877a8fd5836bcd4089b\"; filename*=utf-8''9f712d268a714877a8fd5836bcd4089b\r\nContent-Md5: fAqd+K7ckBZrNti1FUd8Hg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FqVR6J1TpeLry5PumZ6YmP79ON7p\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:02 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: 4fShvD6Qm\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: -bgAAADjjgeRy9IY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18560,"size_decoded":19316,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"7c0a9df8aedc90166b36d8b515477c1e","sha1":"a551e89d53a5e2ebcb93ee999e9898fefd38dee9","sha256":"e40f46aab865092426dea263427bf3f9aa79e37fa1831c6b33c8c4cbf4890488","sha512":"ca9f60b6795288806d0fa6d7c3964ae28d19c069c014a44dbaf0f401061f82c9989711de228969aeadc806cbb46f9168d0455fa9f1d56a68a0666f9be2750a1e","ssdeep":"384:paFm3F9pn9zq5O2gZqz9tzapJ5B7Vm9dhi7qvYIR9vbdmhGR+bvGYH:D3zfz2TgZq5tzaJBMtiOvVF4bOYH","tlshash":"e182d0a512741ba4261b4ff1c1a210b774b5cc5afe2f0985bcfe95b41cd923057cbba4","first_seen":"2023-08-17T12:39:31Z","last_seen":"2026-09-07T08:08:08.401443Z","times_seen":120,"resource_available":false,"data":null}},"time_used":6832,"timings":{"blocked":6570,"dns":0,"connect":0,"send":0,"wait":259,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/0b9baa71d6f247cebcc3feb136cd0c4b?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.484Z","timestamp":1788741144484,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/0b9baa71d6f247cebcc3feb136cd0c4b?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:31 GMT\r\nContent-Type: image/png\r\nContent-Length: 24749\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 20838\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"0b9baa71d6f247cebcc3feb136cd0c4b\"; filename*=utf-8''0b9baa71d6f247cebcc3feb136cd0c4b\r\nContent-Md5: EN0vxH9tN2aoFjXoMPjTCg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FlBYMIP-Zi9ejDclECd5fsROPmgk\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:21 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: yNTFFtEoN\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: -6cAAAA9cvalz9IY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24749,"size_decoded":25505,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"10dd2fc47f6d3766a81635e830f8d30a","sha1":"50583083fe662f5e8c37251027797ec44e3e6824","sha256":"dec059657529191c80ba447de3c4d44628e7413cf0e45fdf7214381a8db1464c","sha512":"c36572db0c47e3e590481b34dbbc46e83cd6776ad5f1ed1ff4b3832cd8c594cf8795357cbe341e9b0d02e258500dbaef4f5b03adca87c45b29e821c9359f09b9","ssdeep":"384:9TX26VgNNHpJiRR2NnkVbWwiWw209T8NQb2cualiXjHkupBDqXHiP:ZX2Yg7DNFOQcQb2cualWnpx4H6","tlshash":"aab2e0cb47139568b34c0ebcce8c5ad52f417516946c482d413da93abd1c08bedab5bf","first_seen":"2024-12-26T20:26:09.833086Z","last_seen":"2026-09-07T08:08:08.442915Z","times_seen":217,"resource_available":false,"data":null}},"time_used":7617,"timings":{"blocked":7328,"dns":0,"connect":0,"send":0,"wait":272,"receive":17,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/b0ac1f6514c64476b581d43dd81cf950?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.401Z","timestamp":1788741144401,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /img/fb/team/b0ac1f6514c64476b581d43dd81cf950?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-09T05:47:36.08732Z","times_seen":18359622,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/969be8e8c58740729534cbbf6d00f489?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.456Z","timestamp":1788741144456,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/969be8e8c58740729534cbbf6d00f489?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/png\r\nContent-Length: 3872\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 27128\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"969be8e8c58740729534cbbf6d00f489\"; filename*=utf-8''969be8e8c58740729534cbbf6d00f489\r\nContent-Md5: qmm1bnEj9XM90nuHylBymg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fu_RQdp6ysqSBCMMIlWtB7S6PKsY\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:57 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: lCzUCpBMY\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: 6rYAAACMIhntydIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3872,"size_decoded":4627,"mime_type":"image/png","magic":"PNG image data, 225 x 225, 8-bit colormap, non-interlaced","md5":"aa69b56e7123f5733dd27b87ca50729a","sha1":"efd141da7acaca9204230c2255ad07b4ba3cab18","sha256":"dbd9d408bd99f85e4d13f6b0f5d28bef501be92ccc5a0ac2275a42bfa743004c","sha512":"3690dd4c7434950d16f1309cb6a2c4920aa8747a39f56a33b217396c103d811065e6964139ba9662229adf934a8271b623a2711edd8139725f8fc19c2f8c3dbd","ssdeep":"","tlshash":"73817d425b191b2ba0fbb540cd4fa9b578ec19f07311c9640cf8d39a8911da4b6f59cd","first_seen":"2025-12-06T19:06:37.262132Z","last_seen":"2026-09-07T08:08:08.379777Z","times_seen":27,"resource_available":false,"data":null}},"time_used":5973,"timings":{"blocked":5717,"dns":0,"connect":0,"send":0,"wait":256,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202506/_webp_size1260x1156_03543abb-5967-4969-b0c5-87347b24c4d6.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.608Z","timestamp":1788741144608,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202506/_webp_size1260x1156_03543abb-5967-4969-b0c5-87347b24c4d6.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/webp\r\nContent-Length: 148768\r\nConnection: keep-alive\r\netag: \"2c43663cd3eeae27a4e751556307f507\"\r\nLast-Modified: Sat, 06 Dec 2025 06:32:06 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 48513\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JZ0oabyZR564EJx0oaaI%2BEBcqekw6Qyhw7KGielhXwSLiE6NVaofGhEGFqiSf6UBkG1vsgvCCPWlf2XyGZPKhPnW%2FdfY7R4PdyoHGEZtMK8RF3cs2FkmZNRKazJXA7V%2FCcFCVixqZMyWQwTrvHEuIrQ%3D\"}]}\r\nCF-RAY: a36cfd693e170719-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8e1a07947dd6477e7\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":148768,"size_decoded":149678,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"2c43663cd3eeae27a4e751556307f507","sha1":"231f268ff0432bf21cea23c1a2cc12003c10f7be","sha256":"cdd625ad600403b36dcbcf589300926ee189bf9d47b2cc2c0715f91c5f6968a5","sha512":"d9ba3dcde4fcd162ea361339bce1c4b8313875af3fe94297a7a55cb8d245e815421dbfb9e5017c19e6a6d50b5ca654e02a326190c2e300b0fd369aa245726567","ssdeep":"3072:IgpSjBxCU8A3MroXYq21tKxGDaxxoyg4KtBHs7T8YMA4q8B4:IgpSjBGYuOYqGKx7ygoBqT8Yln8","tlshash":"3ee313b7f29017bdda91ca376b9f02f832041f64f4077e34a5509801839daada2bb572","first_seen":"2026-04-24T23:10:16.7755Z","last_seen":"2026-09-07T08:08:08.396383Z","times_seen":1111,"resource_available":false,"data":null}},"time_used":3559,"timings":{"blocked":3215,"dns":0,"connect":0,"send":0,"wait":302,"receive":42,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_6ba5f6e7-0a03-42b1-aae6-3de33d838c71.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.630Z","timestamp":1788741144630,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_6ba5f6e7-0a03-42b1-aae6-3de33d838c71.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/webp\r\nContent-Length: 72698\r\nConnection: keep-alive\r\netag: \"8173a97e42cbe83253f569868015813a\"\r\nLast-Modified: Sat, 06 Dec 2025 06:22:44 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 42531\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3GBYAYp%2F3qgThtVe7jTWUdf9ta1eB%2Fq6a2Fw3FZh67yDK%2BUPO2fBZpQg%2BKGTZG8Ic1F6u%2FCW2X1JgIv80a5BP9O5oZ2Ky238iD9N5t%2Fqp3OfD5qXNM%2BzvUnOSJ3STDl%2B%2FjBFPdCv242TXsTV6CwxsaE%3D\"}]}\r\nCF-RAY: a36d8f7f6aed0965-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c901a07947e35a879f\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":72698,"size_decoded":73619,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"8173a97e42cbe83253f569868015813a","sha1":"42ea560648d24b5b2f7a2707de2db0bdebc8f41e","sha256":"b6bf9777cb024d6afd79cdfab403bf54676a54ea6065abf0e8d02344a42bf8fd","sha512":"619c7b0a75af0e07e0929b087fda0183eae617910500da47727ff8b6d29e6dc98846c2e19a1fbe6d042c648c32aa24db9e0cd047a55f7256ca565e66376edaa8","ssdeep":"1536:ZYxIgPfY+3lbLKrfSQK0ds+ePjygtx4Ifql:Z0vfY+3lKrq4ds+QJtx2l","tlshash":"3663020b5a1dc95a0ae20441673a5bdeecc72324e27535c5a075fcbffad3f75414281a","first_seen":"2026-04-24T23:10:16.700652Z","last_seen":"2026-09-07T08:08:08.445523Z","times_seen":1026,"resource_available":false,"data":null}},"time_used":5166,"timings":{"blocked":4738,"dns":0,"connect":0,"send":0,"wait":337,"receive":91,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_d4d2b521-861c-48d3-89a5-438931453851.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.647Z","timestamp":1788741144647,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_d4d2b521-861c-48d3-89a5-438931453851.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/webp\r\nContent-Length: 52456\r\nConnection: keep-alive\r\netag: \"c545c93beaefd4bd61fc5c1b18fc1cae\"\r\nLast-Modified: Sat, 06 Dec 2025 06:30:18 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 48493\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KC732wFELCLvkolgxC5r9QCMrtCGUZywrDvsOq0yNsdfYMS6qbiBHZbbI4IGaY%2BB8Xd%2FOycZH%2BhIzS6iYTlYdpQI%2FPllDN4LnnESKOtPnmwTYLbZ4VJPGVwTNFrkFoDrB0crmbCncUT0D%2FsB8d0JoCM%3D\"}]}\r\nCF-RAY: a36cfdf25e0885c1-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c911a07947e79b7f4e\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":52456,"size_decoded":53369,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c545c93beaefd4bd61fc5c1b18fc1cae","sha1":"19a7126947210454bd434f5642d579bf87bb0e99","sha256":"c3a29377aa06329a7068664cec9166fbcf02f0724f8938eac5106b1c3a6b4644","sha512":"bff91a20b5bcb7b7eab35453005dffaa98033341f7eeaaec88a0c4b414d0d06511b4c05ebb0c3723aaaf654bc9f0c372ad3b5b288030b1d899736b27b84f0208","ssdeep":"768:n4M8fxEbpGtvfqj0Bs8GkjOhpAh9bzillpUed5V/7hz9WJVI7X1BPFLN7CLrJneU:nifKNsXI0ex7lgVMPZN7ErJnnZ","tlshash":"333302a0d69cc510dbf8d6bf0a5130fc5e88fa501ea53bab4b804cdd889e5e4e51f60b","first_seen":"2026-04-24T23:10:16.825501Z","last_seen":"2026-09-07T08:08:08.298889Z","times_seen":1222,"resource_available":false,"data":null}},"time_used":6202,"timings":{"blocked":5831,"dns":0,"connect":0,"send":0,"wait":314,"receive":57,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/718cd9f187e245d0baf0b63d56b0e2cc?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.472Z","timestamp":1788741144472,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/718cd9f187e245d0baf0b63d56b0e2cc?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:31 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 3833\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 23549\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"718cd9f187e245d0baf0b63d56b0e2cc\"; filename*=utf-8''718cd9f187e245d0baf0b63d56b0e2cc\r\nContent-Md5: tYTxVsS2/5GLUTU5ujbLcg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FkBVH5pAZcgCkz9vuascvMclxfjn\"\r\nLast-Modified: Sun, 30 Aug 2026 18:47:51 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: Lnjp6FczD\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: KV8AAABqD9EuzdIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3833,"size_decoded":4589,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 125x125, components 3","md5":"b584f156c4b6ff918b513539ba36cb72","sha1":"40551f9a4065c802933f6fb9ab1cbcc725c5f8e7","sha256":"ce3766bc987b13c3aa231cbe7ffe3992da9920ec293a63053ca335e4bdadf0cf","sha512":"e83ed4ea4a077814b890403970ee6ed7b4339d37c6339580f9646c90953350f38dc03b3ad73d2d60063a4d68151c4bdaa5e0bce67a6e5d6bb6ba5e5039ce5920","ssdeep":"","tlshash":"90815d37351dbcf8e8b93d3c4aa9a76885617d4cb180877dbc1ad94004b57c05b50b2a","first_seen":"2024-08-19T18:55:15.309347Z","last_seen":"2026-09-07T08:08:08.383048Z","times_seen":76,"resource_available":false,"data":null}},"time_used":7019,"timings":{"blocked":6770,"dns":0,"connect":0,"send":0,"wait":249,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/b4ba67640b23479a9dc39f03bec67c3c?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.394Z","timestamp":1788741144394,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/b4ba67640b23479a9dc39f03bec67c3c?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:27 GMT\r\nContent-Type: image/png\r\nContent-Length: 77727\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 37921\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"b4ba67640b23479a9dc39f03bec67c3c\"; filename*=utf-8''b4ba67640b23479a9dc39f03bec67c3c\r\nContent-Md5: tv0HMqkD6lOm7uQ7RXW/+g==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FnvYuaS11cP3SUvq_NGm4OAIHiYo\"\r\nLast-Modified: Mon, 31 Aug 2026 19:02:54 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: Liz7siO5h\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: mQcAAAAI4H4bwNIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-09T05:47:36.08732Z","times_seen":18359622,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/0b0646bd237c4e66be77f5e89591d590?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.397Z","timestamp":1788741144397,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /img/fb/team/0b0646bd237c4e66be77f5e89591d590?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-09T05:47:36.08732Z","times_seen":18359622,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/65246.1781011881923.03480a32.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.656Z","timestamp":1788741142656,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /js/65246.1781011881923.03480a32.js HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:23 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-11ec7\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c911a07947ca8b7f3d\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":73415,"size_decoded":19545,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (48666)","md5":"b98dafd31fe547add2f96acf9bea9922","sha1":"e63706f4b83ed72ce8a0ffee74c7d606968bd280","sha256":"92014e9ab9f7e62a6651d0a69b63f69a84ed58e15ee5dd8e287d46b28fe610cc","sha512":"a676475f44bd6ec6ab9e7421deb8c29430404be3852f96d012418d03e9135d3ec450ee58b4871a4f8ed2a053656c9a9a6523853d6238d701144d9b72c6df8ab8","ssdeep":"1536:f2+iDvYvNjx4Uyao0L8oDNzAuMMsTAQ0mqt2pXYzA4dANVO:e+iDYvPo0L8oZzAuMMsTA7mqt9zA4dAO","tlshash":"a673a501f78272385fa7e290220f2026e16e191505ac5ed8f179ffb93ef0954aa7d7b4","first_seen":"2026-06-12T19:29:57.345997Z","last_seen":"2026-09-07T08:08:08.100114Z","times_seen":1162,"resource_available":true,"data":null}},"time_used":735,"timings":{"blocked":397,"dns":0,"connect":0,"send":0,"wait":327,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/img/bj.ada43481.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.676Z","timestamp":1788741142676,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /img/bj.ada43481.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://g36b.top/css/home.1781011881923.38488e2a.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:25 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-6b4d0\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nAge: 43156\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8e1a07947d33077e0\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":439504,"size_decoded":440148,"mime_type":"image/png","magic":"PNG image data, 1920 x 927, 8-bit colormap, non-interlaced","md5":"2c55f8fcc8edb773be5014d8deb72c4e","sha1":"e7e55505bf22de833ec6b82a229e70bdba93b58f","sha256":"21c44535cffd825752bf9a535001b4b605147e3434cf2906fc2c8fcdcd992c1a","sha512":"bab93e8eb191df623bd7e238ae8d5cf7feae73e2a768d7b591d4dd8b7aafc199fce7c34066a272fc9137959a78a6bcd9fb388f39d4a0938f5674aaee815a3cf7","ssdeep":"12288:K+TyFzCVXhEu0hvb3kkjOO9FNkh4k6yvwUKA4AuJiT9h+:tTyFGjENkkyOWh87UK/JiT9h+","tlshash":"739423b1df0b89c858a39043dc74f99263e8d0a6bdc40ab80bf14b9176709dbbbf5116","first_seen":"2023-08-17T12:39:32Z","last_seen":"2026-09-07T08:08:08.414469Z","times_seen":2636,"resource_available":false,"data":null}},"time_used":3011,"timings":{"blocked":2575,"dns":0,"connect":0,"send":0,"wait":303,"receive":133,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_ce6f5a12-ce60-4931-b7a7-3cfa94c956bf.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.624Z","timestamp":1788741144624,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_ce6f5a12-ce60-4931-b7a7-3cfa94c956bf.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/webp\r\nContent-Length: 11070\r\nConnection: keep-alive\r\netag: \"9d6366dada143310062f824e5f7dd46e\"\r\nLast-Modified: Tue, 02 Dec 2025 14:08:23 GMT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=soYRmwPO5w1co8ebdjMnrf2crbkoGNw1nJZyYSEM%2BZakFfAaEKIM5dHop7C94%2BWryKJB%2F4JPeufkHiX02Q8hcYSUOKDM23elMGT776BQKxgS8yDXLVEssGXQtrPmc9l8MpvytPldfBJ%2FZHOt4xlluw8%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 42537\r\ncf-cache-status: HIT\r\nCF-RAY: a36d8f5a3e073424-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8c1a07947e1fb8129\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11070,"size_decoded":11981,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"9d6366dada143310062f824e5f7dd46e","sha1":"def0e81d351b0b1c8cec0603c0dfe6955438d059","sha256":"10b2cb9f1220e8ece8b47ee11eae49d1c947eec915c13165c241a59f1c8105e6","sha512":"afc9daaa38494954719bc7ef5f87c1bf6020e2d098b690a55d7f6ebcb26d463f6cd890941446e0c4cfc64771e8e7f74035e362c347f17818b1ec2801a2639f14","ssdeep":"192:6HWhsuhcANwPA6DmRamGZOxPCHE775EhPDR4oETR57jX:kWZhsDG8Olz75u7RsTXj","tlshash":"fa32b07de235930096a34cbecb5be3304bba629233b0b58cdc459df12597cb42e70926","first_seen":"2026-04-24T23:10:16.712242Z","last_seen":"2026-09-07T08:08:08.133257Z","times_seen":1025,"resource_available":false,"data":null}},"time_used":4711,"timings":{"blocked":4393,"dns":0,"connect":0,"send":0,"wait":318,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/f333cbffea324e5f923aabebc37abe69?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.395Z","timestamp":1788741144395,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /img/fb/team/f333cbffea324e5f923aabebc37abe69?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-09T05:47:36.08732Z","times_seen":18359622,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/7182c4c36e474424b53c4da94d4c6826?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.406Z","timestamp":1788741144406,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/7182c4c36e474424b53c4da94d4c6826?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:27 GMT\r\nContent-Type: image/png\r\nContent-Length: 137893\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 32543\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"7182c4c36e474424b53c4da94d4c6826\"; filename*=utf-8''7182c4c36e474424b53c4da94d4c6826\r\nContent-Md5: 4UE1DcqPvD2tqSrEfbIOQQ==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FuZ-a47Nvon6rs5-Bh3NGRLmx78q\"\r\nLast-Modified: Mon, 31 Aug 2026 19:03:15 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: UipPAB3zh\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: B_UAAABYuLr_xNIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":137893,"size_decoded":138650,"mime_type":"image/png","magic":"PNG image data, 407 x 407, 8-bit/color RGBA, non-interlaced","md5":"e141350dca8fbc3dada92ac47db20e41","sha1":"e67e6b8ecdbe89faaece7e061dcd1912e6c7bf2a","sha256":"8749bf171baa317e99633a4a65f4219a4ba427ad42ea5b382076313c7d51b11f","sha512":"0bef9046e15733e8f1d20fca166be35f3f39759997fb950c5529bc851b423600b2f36ec111414bb691577e75ed78b986dbbfce27336ca16f92abdcff458d5a2f","ssdeep":"3072:BKbVCH5JJzxC8I9w0UpYkDbotdi2SKrN55pXO:yC77CDPgYqbotdDBpXO","tlshash":"88d312be5b87c1d2a0ab1c799121bf5cb3f05549e7325ba53a94d8cb20bb3029dc3523","first_seen":"2024-12-10T14:50:17.981803Z","last_seen":"2026-09-07T08:08:08.209433Z","times_seen":43,"resource_available":false,"data":null}},"time_used":3594,"timings":{"blocked":3202,"dns":0,"connect":0,"send":0,"wait":254,"receive":138,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/d543dadd8f444add8604d861918a3cfd?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.430Z","timestamp":1788741144430,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/d543dadd8f444add8604d861918a3cfd?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/png\r\nContent-Length: 33429\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 28944\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"d543dadd8f444add8604d861918a3cfd\"; filename*=utf-8''d543dadd8f444add8604d861918a3cfd\r\nContent-Md5: WYnZxteR+8LpvOI96LXssw==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FtjXChN97WFdO30WVHA_q8ze9GTM\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:43 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: pyD8BZDDa\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: VfYAAAC7UQlGyNIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":33429,"size_decoded":34185,"mime_type":"image/png","magic":"PNG image data, 218 x 264, 8-bit/color RGBA, non-interlaced","md5":"5989d9c6d791fbc2e9bce23de8b5ecb3","sha1":"d8d70a137ded615d3b7d1654703fabccdef464cc","sha256":"b44f6f243b7dd5cd6a7fecf55167907ac40bb8608bfa0fb442fd12f1f2e6fb9d","sha512":"d45668b1c84533d8ede8316d4cfd47059267c870bc064b0cecc9c96d5d3d2d1f1c7a669f8ffbd005c1535956be8ab038f9e7927dcdb2f294da83529cc1eb173f","ssdeep":"768:pqlrXdZd/yWq3DahCF/PWWgP7Fy5C7WbxIpBXwuHE:U1rd/y3/+W67Fy5CIxIf3k","tlshash":"4ae2e1c5d8d356b3868aa05c777b283643a2deb183d3019d92c123d05dbf7da78b255c","first_seen":"2023-11-11T13:40:00Z","last_seen":"2026-09-07T08:08:08.390221Z","times_seen":43,"resource_available":false,"data":null}},"time_used":4707,"timings":{"blocked":4418,"dns":0,"connect":0,"send":0,"wait":264,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/ee475cefd878444197e6a3e45320240c?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.498Z","timestamp":1788741144498,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/ee475cefd878444197e6a3e45320240c?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:32 GMT\r\nContent-Type: image/png\r\nContent-Length: 14674\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 5528\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"ee475cefd878444197e6a3e45320240c\"; filename*=utf-8''ee475cefd878444197e6a3e45320240c\r\nContent-Md5: w4OnaSgoi8EsdKqCb3goyw==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fll54oRBEvoRgJ9oOVtZ_VAs5ezs\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:44 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: JINcaYUhU\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: kc0AAAAIDeKS3dIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14674,"size_decoded":15429,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"c383a76928288bc12c74aa826f7828cb","sha1":"5979e2844112fa11809f68395b59fd502ce5ecec","sha256":"0559cd498aa30949cdc3a8a1e0b42a9e1b1c8d8d4f7660acb4040ea3b61aaef7","sha512":"618127c0f46785268f264d49491ff60cb31d6b8fdf73c9e90ee71b8f24e4bd10ee8e46ef40c5695f9b6620d90175f8d65265ce6e6d5688028a1206bf4fb44ce7","ssdeep":"384:CUCsyr1CuVqYvJug9ziSQSxfrxwGqfAKTY8LYe7nlh4n:Ase1NdziSQSxfrxw5AKTY87nY","tlshash":"fc62e09303a52c842ce533fe5187826487b578b06336ecbb0b4367b07d1c970b25ea57","first_seen":"2025-08-03T21:40:07.445967Z","last_seen":"2026-09-07T08:08:08.333543Z","times_seen":280,"resource_available":false,"data":null}},"time_used":8368,"timings":{"blocked":8108,"dns":0,"connect":0,"send":0,"wait":260,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_c0a34e2a-97fa-40dc-8123-594806696886.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.619Z","timestamp":1788741144619,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_c0a34e2a-97fa-40dc-8123-594806696886.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/webp\r\nContent-Length: 13338\r\nConnection: keep-alive\r\netag: \"c9888ec9eb68e23af8c466de36aa1374\"\r\nLast-Modified: Tue, 02 Dec 2025 14:08:14 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 48499\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=p5hXQsOQi%2BPi%2FEjXjR%2Fnu%2FMbpSZR3av%2BdZnrDmoQlzIrxKIo%2FkDA38PwkUlMElQMlxlS%2F8qn0SNcJiO7nWQKmIk361NnvjEt46NDa8t5KjPVMlVvpIXf2%2BXjMBHymempatc49Yg2MY2GBDmzRHCF2FE%3D\"}]}\r\nCF-RAY: a36cfdc57b82e2f1-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8c1a07947e0ba8128\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":13338,"size_decoded":14257,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c9888ec9eb68e23af8c466de36aa1374","sha1":"9f390e12dc110576b1f87b5705379cce7c8d821c","sha256":"8ff81de4e5b37505789b23808f901d64ab7d3dd91a813438ff0c762971c445c2","sha512":"6234782d00cacdac98ef61238100e1e4b6d3a44b462264cddf34237f74cc589576644b8b1a8e1e309c0acf400d17b899dad9717654f487f86a28224d4e2744e6","ssdeep":"384:sfQdwsWMYKGas1GU33KVwYl/0VPxDNUrIJeYcsFAl33l8Ta0V+t:vdTqGU3aJB0VPx0IJ4sFApWT5q","tlshash":"f052ae4ef297816890419138d0d51cb6583550ee8ffb29ad2e78e7c9630173ee4abb3d","first_seen":"2026-04-24T23:10:16.827229Z","last_seen":"2026-09-07T08:08:08.434219Z","times_seen":1020,"resource_available":false,"data":null}},"time_used":4393,"timings":{"blocked":4073,"dns":0,"connect":0,"send":0,"wait":320,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/b471f36d64c740599fde347e03e205b6?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.454Z","timestamp":1788741144454,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/b471f36d64c740599fde347e03e205b6?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/png\r\nContent-Length: 24875\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 27129\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"b471f36d64c740599fde347e03e205b6\"; filename*=utf-8''b471f36d64c740599fde347e03e205b6\r\nContent-Md5: NnGbdIFOjL1pfRtJvh+M1w==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FqwjkZfKpg0AXeSd7n-eT59R8G1d\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:47 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: xUB5V92ii\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: w-kAAABJJAntydIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":24875,"size_decoded":25631,"mime_type":"image/png","magic":"PNG image data, 283 x 232, 8-bit colormap, non-interlaced","md5":"36719b74814e8cbd697d1b49be1f8cd7","sha1":"ac239197caa60d005de49dee7f9e4f9f51f06d5d","sha256":"f8cd592511eb71efe5afd70314ed1a10edb0e21539f02ee234c04a315e12d147","sha512":"2db9dcf9d576d47d611970f2911499b7ea53007485e1c81fda40b4fd3faaf8f09f80ff7a0065a48d3f4070569029a51723f169075fcd2bf3b9737a0364720d93","ssdeep":"768:7hM7wtSjN/ps5jo2VgUE6MvjsOGaghnYmFg+QIbEs:dFSpCpVglbspfFEIws","tlshash":"feb2e1313dfe99a1ff681f8011142619eb7b6b00d890cd863e3af187963a256b5e1d4b","first_seen":"2025-05-22T13:07:04.872582Z","last_seen":"2026-09-07T08:08:08.06691Z","times_seen":134,"resource_available":false,"data":null}},"time_used":5972,"timings":{"blocked":5706,"dns":0,"connect":0,"send":0,"wait":259,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/f385543a2bef4b89a51edfba88561b24?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.467Z","timestamp":1788741144467,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/f385543a2bef4b89a51edfba88561b24?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:31 GMT\r\nContent-Type: image/png\r\nContent-Length: 22333\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 25326\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"f385543a2bef4b89a51edfba88561b24\"; filename*=utf-8''f385543a2bef4b89a51edfba88561b24\r\nContent-Md5: WqWvwxS2vGmP6NlogbHyhg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FknMH0SCMxhSwgSCjFN6dzrhXj1V\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:01 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: zkSyFA3Fv\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: YJsAAADGBfKQy9IY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":22333,"size_decoded":23089,"mime_type":"image/png","magic":"PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced","md5":"5aa5afc314b6bc698fe8d96881b1f286","sha1":"49cc1f4482331852c204828c537a773ae15e3d55","sha256":"ad3de4270d9c06665339b85acb94859da511090b1aa5c4fd4a57595c9929417d","sha512":"0b9551b1869f902a1f3d59d1ce23d32127c82f0caf85fe9ac7c0db2a0429f32af9ce13ed128804041814eb8a0276d1e5f1573b12ce442af2a864a1f36693753e","ssdeep":"384:ZN9UcWOcNEzT+blZWshWK2JBsvYLFblS//Z3fHBXaJLuuBNySmFdjD8cpnctQk1S:ZN9UPGT+hZdWK2bswLwF48WMSK5Ycmt4","tlshash":"50a2d11f907141042e957d1c463134d63eeaecd946e99f8e2f08b649de3b5385b395c2","first_seen":"2023-12-11T12:53:02Z","last_seen":"2026-09-07T08:08:08.173303Z","times_seen":70,"resource_available":false,"data":null}},"time_used":6689,"timings":{"blocked":6425,"dns":0,"connect":0,"send":0,"wait":259,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/b192a307127647f2b92442509fc7bf9d?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.479Z","timestamp":1788741144479,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/b192a307127647f2b92442509fc7bf9d?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:31 GMT\r\nContent-Type: image/png\r\nContent-Length: 8155\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 21742\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"b192a307127647f2b92442509fc7bf9d\"; filename*=utf-8''b192a307127647f2b92442509fc7bf9d\r\nContent-Md5: 8Y6Uk8sCrUFbVuOZhOJiJw==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FowaqeCPZVccOyHwDso6OziI3JIJ\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:16 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: YGtlYb8ab\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: i_IAAADkjXPTztIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":8155,"size_decoded":8910,"mime_type":"image/png","magic":"PNG image data, 176 x 287, 8-bit colormap, non-interlaced","md5":"f18e9493cb02ad415b56e39984e26227","sha1":"8c1aa9e08f65571c3b21f00eca3a3b3888dc9209","sha256":"d1b7e3ab301edbad8a78b9d9aee7ff9cc16df4a27aedf2b5a94c32751f7cc953","sha512":"bff5f06830e780ab75cb1c623c3d7791d3f39756f62e3878e9fb88871e97f9e5ff65f1751e8838b04f42ef2f089f265e685e31e3b14dce3bafc3da2d89a11c9a","ssdeep":"192:1qhv7no4oYuG1ZIseZPkRZ2wXzJ5dRO9XcYPtkUjH6vA4:Mhv7no4Vu4FAo2wXzJ5HO9Mmtlr4","tlshash":"cdf1bfa9f41303b9d8ad57d5907ed91cb0aae9b254cd21e7222b1cc0317333ae02bd24","first_seen":"2023-08-17T12:39:30Z","last_seen":"2026-09-07T08:08:08.424951Z","times_seen":58,"resource_available":false,"data":null}},"time_used":7428,"timings":{"blocked":7173,"dns":0,"connect":0,"send":0,"wait":255,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/dfcefceedda2433d8e3ccfbd8835d265?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.480Z","timestamp":1788741144480,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/dfcefceedda2433d8e3ccfbd8835d265?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:31 GMT\r\nContent-Type: image/png\r\nContent-Length: 166375\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 21742\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"dfcefceedda2433d8e3ccfbd8835d265\"; filename*=utf-8''dfcefceedda2433d8e3ccfbd8835d265\r\nContent-Md5: rzlNLfWBls58SWmTk28R9w==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FvCTO7n3nQzPrHGX4HE5ne2x0G3E\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:17 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: Pp9pH2RJZ\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: v3EAAADMNXTTztIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":166375,"size_decoded":167132,"mime_type":"image/png","magic":"PNG image data, 1200 x 1540, 8-bit/color RGBA, non-interlaced","md5":"af394d2df58196ce7c496993936f11f7","sha1":"f0933bb9f79d0ccfac7197e071399dedb1d06dc4","sha256":"54af027c8e8e1516e8f0c794d61a1748bcdcf1e3c371f312f50318684ae14b9c","sha512":"fa18bc30c16099acfc0b12d741db7984682ba1fd6af3f6ea513b18c80510386f83e727383204621e155d356870f135062829e89a84cfe1bb6a9985306ea7cd6f","ssdeep":"3072:LbMzwNyw/S4hS30PDIJyV8vBTAGVlTCKhkvOc6lU9vtawtVNqr/:Lg0NTat30888JAgRxlO9vtaw7Qr/","tlshash":"ccf31291d6b7f2e26c3f5623680c0428587c2aab932f6932d72df2244d371f595d31ba","first_seen":"2025-08-25T01:40:32.424628Z","last_seen":"2026-09-07T08:08:08.203776Z","times_seen":35,"resource_available":false,"data":null}},"time_used":7564,"timings":{"blocked":7204,"dns":0,"connect":0,"send":0,"wait":259,"receive":101,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/2a1a90d5921c4e8c9b444cb654f96695?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.497Z","timestamp":1788741144497,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/2a1a90d5921c4e8c9b444cb654f96695?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:32 GMT\r\nContent-Type: image/png\r\nContent-Length: 6835\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 5528\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"2a1a90d5921c4e8c9b444cb654f96695\"; filename*=utf-8''2a1a90d5921c4e8c9b444cb654f96695\r\nContent-Md5: 10C1LqL+5XH2tZwhhq5Gzg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FgxusF6fsB1WYJi_-ATBS3c4ab_s\"\r\nLast-Modified: Sat, 08 Aug 2026 19:30:35 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: DQ9DqCEFa\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: vsEAAAAK5eGS3dIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6835,"size_decoded":7589,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"d740b52ea2fee571f6b59c2186ae46ce","sha1":"0c6eb05e9fb01d566098bff804c14b773869bfec","sha256":"f56d0b1bd0524ea3bca378750f7806a889e5920fe09003df8e830f121e59c065","sha512":"b4132b911894fa2d22fb535195721c5a9a7b78ad04af2012755075eba84b797f30750c45983e83baba2ed38aca4b8a805471d9ff3c9f3c90f8d8d64d7825451d","ssdeep":"192:qIwSHhkpWVNKl0ejh+2J7W5m1tWejffWBTFxi2WTDveZnWIenctzY7xFz:qrSBIWVgNjbxqm1EezqbsvveZnjZtzcB","tlshash":"4ae18ce8369c469d135bdca1b3cdebe1421daf2842251d7b72821af70c38e808597288","first_seen":"2025-02-24T02:30:01.312921Z","last_seen":"2026-09-07T08:08:08.099061Z","times_seen":67,"resource_available":false,"data":null}},"time_used":8355,"timings":{"blocked":8103,"dns":0,"connect":0,"send":0,"wait":252,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_f26e0b0b-19a9-470f-90cf-ab38984671ab.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.633Z","timestamp":1788741144633,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_f26e0b0b-19a9-470f-90cf-ab38984671ab.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:24 GMT\r\nContent-Type: image/webp\r\nContent-Length: 96286\r\nConnection: keep-alive\r\netag: \"a7ec31389e5a634d92383c733b498506\"\r\nLast-Modified: Wed, 10 Dec 2025 11:50:21 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 48492\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FvVypRFJcBBXvD2Hpy6wJZOgML8tJu2lHjPy4GwzWP%2BQmwyr0G%2BegvoAEKvP57BKYUf3OCjIVLym%2FnXUYCSvx2B7zUGZJXwutiiaJ2mb0i%2BqpAF%2Ft96rXvc6RAFUeJRir5%2FaIjn8Xc%2BaNueZDA1QKV0%3D\"}]}\r\nCF-RAY: a36cfdd57e2f6e40-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8f1a07947d0b97887\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":96286,"size_decoded":97205,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a7ec31389e5a634d92383c733b498506","sha1":"4386adc654865c1594ba0ac604ac3a4177a84b7e","sha256":"978643b0ac1ecb3edf679a74610a1a0fdaebb02505e0dc607a15e56b1bd5212c","sha512":"222ad2805e8bd8957e696920a81cdb86bbf7a0bd6720b2cb67ae89758558331b6842fcdf208560ba355a522bcf0b177a7b124ff3d2c4db25c1fd8b4eebe5c74f","ssdeep":"1536:s9n08pg3G3xErU4qzJYMDLc0OzGR5AGsSrbY4V9SrXLDoJgG4oaUHG0S/F:knptxviMDCzGRyXSrs4VQDocoxHNS/F","tlshash":"079312e74a42ba67f808b1319ea01b6ef3d7b43f09ac1a6d47599a7c4831bc4458137f","first_seen":"2026-04-24T23:10:16.718761Z","last_seen":"2026-09-07T08:08:08.174017Z","times_seen":1059,"resource_available":false,"data":null}},"time_used":555,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":333,"receive":222,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/css/home.1781011881923.38488e2a.css","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:21.986Z","timestamp":1788741141986,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /css/home.1781011881923.38488e2a.css HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:22 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-163b3\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c901a07947c669878d\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":91059,"size_decoded":33073,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65528), with no line terminators","md5":"e74f15d7fec8fd844f3f07595fad8d36","sha1":"6b072e1cd8db98eabc09e33e5aaecec0fa1f385a","sha256":"e0a518c123b57bf6db4c12b779cb9414056760733b9d1d59ccd160d4ce0f08d2","sha512":"74d96ef5f45097c02d494946f446bb8a1d5fb7b89389543f9c278b5b93678e4b50e75ae534fa8ded5c2b377381acd47403d8baadcf01676bed44d997eae44d1b","ssdeep":"1536:fwRzO3RM7jufawS2d3a8WiLKbzGhbG9jpXdNdp9khN+sJ/:fBiuSJwLUK09j7p9khN+C/","tlshash":"20933b76a610253db427ca72baf05bd8b524c846d7634a3df2537e25cbc72f21236394","first_seen":"2026-06-12T19:29:57.241174Z","last_seen":"2026-09-07T08:08:08.134183Z","times_seen":1183,"resource_available":false,"data":null}},"time_used":404,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":366,"receive":38,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/fonts/DINPro.9ee75b04.ttf","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.708Z","timestamp":1788741142708,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /fonts/DINPro.9ee75b04.ttf HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://g36b.top/css/46431.1781011881923.bc5df1d1.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:23 GMT\r\nContent-Type: application/octet-stream\r\nContent-Length: 119892\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:10 GMT\r\nETag: \"6a281706-1d454\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8c1a07947cadd8119\r\nX-Cache-Status: BYPASS\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":119892,"size_decoded":120358,"mime_type":"application/octet-stream","magic":"TrueType Font data, 10 tables, 1st \"OS/2\", 30 names, Macintosh, 2005 Albert-Jan Pool published by FSI FontShop International GmbHDIN Pro RegularRegularAlbert-Ja","md5":"028cefac160ed3b006f47106fbc68d1c","sha1":"efcecac09684435facd7397e4f6163a5069802c2","sha256":"fb841a09a82787982ad1774bdeb45e8e06ff4909161a9ce33fd42f8822c5ddc3","sha512":"3a5a284d0c4da6593b857ba785a4ba7d5f2e2b73d22a2ef25435b9558063d2486228d76a3cd5d3a59b5abe4c0da696a75373111b3569a94a9dea1516cf16091f","ssdeep":"3072:YhtN/CZnt1tbtKtHtFNgz1QZt0tbt2ktwtNstAtqNaEctWpy8TLtsIb66AUeo:YhtNGnt1tbtKtHt7t0tbtxtwtNstAtqV","tlshash":"5ac308c153e8fa4ad83996388511c7434226ff2de65d4f36ffd94d8c688e8e9064e6e0","first_seen":"2023-05-08T18:58:40Z","last_seen":"2026-09-08T23:57:33.397904Z","times_seen":5816,"resource_available":false,"data":null}},"time_used":1069,"timings":{"blocked":422,"dns":0,"connect":0,"send":0,"wait":339,"receive":308,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/30140d5398b045e492868aa46ee55266?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.382Z","timestamp":1788741144382,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/30140d5398b045e492868aa46ee55266?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:26 GMT\r\nContent-Type: image/png\r\nContent-Length: 128246\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 88340\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"30140d5398b045e492868aa46ee55266\"; filename*=utf-8''30140d5398b045e492868aa46ee55266\r\nContent-Md5: tMLHkqCfaOaUEONwqZVtVQ==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FmdiRUQ3KpMD1s08S3rJGxvbf_em\"\r\nLast-Modified: Mon, 31 Aug 2026 18:51:43 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: IukrWKzbh\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: ZEEAAACdESlAktIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":128246,"size_decoded":129003,"mime_type":"image/png","magic":"PNG image data, 1200 x 1200, 8-bit/color RGBA, non-interlaced","md5":"b4c2c792a09f68e69410e370a9956d55","sha1":"67624544372a9303d6cd3c4b7ac91b1bdb7ff7a6","sha256":"e9a9a33f8f633eb460b736404bbc022d016b9d484ee1bc4aefde8a46e83970ef","sha512":"a0a5afa056f8681fa9a702abd31897c7550df83ca89383b8b163a6a74c6f92413800bd4f18ce29ea1b6dc87c5526126ecf84d45560475dc84cc0b7a61b60e07f","ssdeep":"3072:yDHEHutz7WJuRohedb/SbxAafIiamIEdULXJy9w+Z7:yjEw2JuaoObxRBamd9w+Z7","tlshash":"9dc31237c8a7c977de9b45fed0ec84d5133c7e9a029467ab712847f99e24a312888d81","first_seen":"2026-05-27T00:31:47.147542Z","last_seen":"2026-09-07T00:33:21.813816Z","times_seen":152,"resource_available":false,"data":null}},"time_used":2537,"timings":{"blocked":1758,"dns":0,"connect":0,"send":0,"wait":308,"receive":471,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/90f62df9b61a49deb3c825fd93205775?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.461Z","timestamp":1788741144461,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/90f62df9b61a49deb3c825fd93205775?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/png\r\nContent-Length: 11831\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 26226\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"90f62df9b61a49deb3c825fd93205775\"; filename*=utf-8''90f62df9b61a49deb3c825fd93205775\r\nContent-Md5: vcehdHGgKHezo2VKCxrcUg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FlVRNnNkPMpzsVG5pvXX-zIKVaAF\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:59 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: XzrT8gkmZ\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: ozIAAABYaCe_ytIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11831,"size_decoded":12587,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"bdc7a17471a02877b3a3654a0b1adc52","sha1":"55513673643cca73b151b9a6f5d7fb320a55a005","sha256":"4e0df83babe00023a20d60d6aed91f5bec377cdf94d40b916c01efdd398ceb68","sha512":"17ceb2cafd6e264ad17d712f2cfe6d3a8a2247090c0cd1ee157f7be7c74ffa622fe3c5d5e4a436a9cdc35d054a590e52bb034b83cc9343c1bca101666324b2e4","ssdeep":"192:6C17PvhLHsSVq7xVQrJHCP/DddkwGAp+E9sPOuSdXwcemtzMZuNLTy:6o73hLMSV2xwm/hdHGApD9sPiwc3MZuY","tlshash":"ac32d0bf968f00f0aa5edf15187260e56b417573002c4008e79ea6fee9b0b5f18778e6","first_seen":"2023-12-27T14:56:21Z","last_seen":"2026-09-07T08:08:08.069977Z","times_seen":32,"resource_available":false,"data":null}},"time_used":6426,"timings":{"blocked":6169,"dns":0,"connect":0,"send":0,"wait":257,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/551055e1e879495cb2546a5a4339a337?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.496Z","timestamp":1788741144496,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/551055e1e879495cb2546a5a4339a337?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:32 GMT\r\nContent-Type: image/png\r\nContent-Length: 127341\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 9144\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"551055e1e879495cb2546a5a4339a337\"; filename*=utf-8''551055e1e879495cb2546a5a4339a337\r\nContent-Md5: xtftDuo0z1del4v6+/0m/A==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fga4afaek1Vpz5dYte0sRrD4zwMA\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:41 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: Gn9je5iLZ\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: 9XMAAAAObMpI2tIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":127341,"size_decoded":128097,"mime_type":"image/png","magic":"PNG image data, 1200 x 1202, 8-bit/color RGBA, non-interlaced","md5":"c6d7ed0eea34cf575e978bfafbfd26fc","sha1":"06b869f69e935569cf9758b5ed2c46b0f8cf0300","sha256":"4343795b1369240ec5aee75e955c643ffd514f60848d4d0602e18e38685dc658","sha512":"c3535d38695144cca8e34c047da34ba31a6459e4c25697e0b2b05b4f11e5ba335236e72c0228e345a9c50727067dd21fbb02a9fecbdcc01f174972017f3f680d","ssdeep":"3072:C3XgDX8pnk8NUjq85X4sAPtvrrsjLSh0Mos7R/rVE7X:C3Y8Nk8NUO8d3Adr57FrVEb","tlshash":"3bc3025fc8b08ca7c8c4587e6d918f2976af1dd31a11676242f763debb83e903b14648","first_seen":"2025-02-24T02:30:01.529373Z","last_seen":"2026-09-07T08:08:08.454618Z","times_seen":231,"resource_available":false,"data":null}},"time_used":8340,"timings":{"blocked":7885,"dns":0,"connect":0,"send":0,"wait":272,"receive":183,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/f23d4165559247bf98dcb636aae0371f?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.502Z","timestamp":1788741144502,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/f23d4165559247bf98dcb636aae0371f?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:32 GMT\r\nContent-Type: image/png\r\nContent-Length: 77632\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 1946\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"f23d4165559247bf98dcb636aae0371f\"; filename*=utf-8''f23d4165559247bf98dcb636aae0371f\r\nContent-Md5: y/632Cr8aVA7bKdKERx4nQ==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FuR11Gc6yRkNpFe5B4hSyeNpEKYr\"\r\nLast-Modified: Mon, 31 Aug 2026 18:51:38 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: 3K5GjqYZw\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: KcEAAAAdbdrU4NIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":77632,"size_decoded":78387,"mime_type":"image/png","magic":"PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced","md5":"cbfeb7d82afc69503b6ca74a111c789d","sha1":"e475d4673ac9190da457b9078852c9e36910a62b","sha256":"78c4a8f1251c4745c40944213476d25c4e281dfe33e62c07ead09597c74136dd","sha512":"557ebfc1bf2c859f41ec478fbbe6e811c323499c644f2d40c436874efd93373c85380b4a23b92088728ea3b6372aa80869d0ead41a9f8ff842fb86179af9702b","ssdeep":"1536:h3B9MhHTnWsY3RdcP5qKMKa8e2hAq/0nRrzNbgW3rwPVx45:h3PMhHzPY3PcPQKMKa85hAFlzNUW3rwe","tlshash":"4c7302ccb2a2d58ea5bbab509e7ffc3d586a3cb4af9054877b4f0501b4354c739a8601","first_seen":"2023-11-10T19:11:58Z","last_seen":"2026-09-07T08:08:08.231993Z","times_seen":125,"resource_available":false,"data":null}},"time_used":8686,"timings":{"blocked":8339,"dns":0,"connect":0,"send":0,"wait":268,"receive":79,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/a40a163bbd4c4301b0a677d3a7773e8b?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.504Z","timestamp":1788741144504,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/a40a163bbd4c4301b0a677d3a7773e8b?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:33 GMT\r\nContent-Type: image/png\r\nContent-Length: 39113\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 1947\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"a40a163bbd4c4301b0a677d3a7773e8b\"; filename*=utf-8''a40a163bbd4c4301b0a677d3a7773e8b\r\nContent-Md5: 8ucsG+afwZkUX6IBdQdeyw==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fl3qEnEIDSCeiPful0lEPf5Brvc0\"\r\nLast-Modified: Mon, 31 Aug 2026 18:51:40 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: 3tPabKhsm\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: KvsAAAB4at7U4NIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":39113,"size_decoded":39868,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"f2e72c1be69fc199145fa20175075ecb","sha1":"5dea1271080d209e88f7ee9749443dfe41aef734","sha256":"c3e9d6b10d07b2ccf69e1980d13570ff0292b30b54950b27cef4a3c8bc8d0e94","sha512":"c9c98b3e93e34590a6da57c536d36537896e98736eebc02deb7221f5e6f293a1b5dc17e071e6326038fa56ab9c458807cb21f8e42a4ad76f3afef03124110744","ssdeep":"768:GbXAYRhsJlnlNoO+PenstFdv9DzgaKCoYKYHHfidGuhRKD:kVeRlNoOHsfdCaegHHfgg","tlshash":"e803f2211ba56b893a21f5db130334e5c3494c6dbd05a642e98bd1ad0f3efe2b6790cd","first_seen":"2025-10-05T20:13:27.563383Z","last_seen":"2026-09-07T08:08:08.166742Z","times_seen":244,"resource_available":false,"data":null}},"time_used":8644,"timings":{"blocked":8368,"dns":0,"connect":0,"send":0,"wait":260,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size704x442_73525908-fb7b-43df-ab6b-ee9a1274a74c.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.649Z","timestamp":1788741144649,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size704x442_73525908-fb7b-43df-ab6b-ee9a1274a74c.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/webp\r\nContent-Length: 26068\r\nConnection: keep-alive\r\netag: \"da33ad9a009a89e0bc0c508e6f690949\"\r\nLast-Modified: Sun, 09 Nov 2025 14:20:32 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 48492\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fq1U%2BEOyvZVS%2BKC8uf1mKfzbSXzrJpLgTzVD4yJQkK7CyC%2F6cxcHhNoHVPEYGokf7004m%2FREtMLef2tODMu6ZlhAy6JY3kmb1tjCmugCWh8yp83EptKFPIRjiMo3V55cfuG3hsEO%2FLgACkFIaIW2r%2B4%3D\"}]}\r\nCF-RAY: a36cfdfaeab402d2-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c901a07947e7f887a2\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":26068,"size_decoded":26983,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"da33ad9a009a89e0bc0c508e6f690949","sha1":"52521f6667f933538fd61fac097ba79db283c0cf","sha256":"12889485842cb12ca8c77f0a9c71ac3098cf3c9898b3cdc299145280170962d6","sha512":"a254ca97846b0d3216994f8db6adfee226b9b2c6120a33c1ec1f0a635f658f99e6b2c2407dffcbe79d5dc65aca0869aff746d751347eaf9780083b0e25103fe0","ssdeep":"384:+w9CBmVKxqlIavZBdogyHrWz/1ope325wQBJKn5QahMi7HjOMdOdjawQJoYh:+yYmV5Vv7WZLWhop42525Q0M+HujawQ","tlshash":"e9c2e1c2bd2de50a9b37c27e24a6c30f01c497808faa2c677736129d4d365abb56900e","first_seen":"2026-04-24T23:10:16.863494Z","last_seen":"2026-09-07T08:08:08.446433Z","times_seen":1225,"resource_available":false,"data":null}},"time_used":6271,"timings":{"blocked":5918,"dns":0,"connect":0,"send":0,"wait":337,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/ecb/8f8306425cb6740e78b2802ff5047afa96a8ae096bee393c421cac4924db741c4a080b3f3ed2f2822673f3118bd3bae081df46a59bfce8","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:23.465Z","timestamp":1788741143465,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /ecb/8f8306425cb6740e78b2802ff5047afa96a8ae096bee393c421cac4924db741c4a080b3f3ed2f2822673f3118bd3bae081df46a59bfce8 HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://g36b.top\r\nXign: NmzT5r4icvG5T9/mpERkivbsppSpnMWu75pi/kCFXWXqJqhy0JfZ2iJpOkznRdU9I5svJXcR1J7BWoTfxe07/qeXtOclr1Yb3pNVZYySa7wDbHv+GFZyveYBOo9TuzR0Z2nHhfTANyYCI21Z1jOUn3Z5rR5xwLRhimWnMruaGYw=\r\ntimestamp: 1788741143463\r\nsign: 693h4t1o2t7m1240\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: aDntxNnwbrytXeEW4SJfGsaRdsx3tyZ3\r\nlang: zh-CN\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:23 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Mon, 07 Sep 2026 00:42:23 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nX-Request-ID: 703616b88db245b1957d01166820bd00\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8c1a07947cd64811c\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":519,"size_decoded":1339,"mime_type":"application/json","magic":"data","md5":"bab2fef0b89b1ed0635a9c6088b529a1","sha1":"1b70a58f840b19d48d202950d778457a13b4049f","sha256":"a5b8e90292051dd8bc91ddc83a304502b32f79ce44fc4e661f8bf16a6552b6dd","sha512":"68d68a3db5f47104708512ef925dbabdd4c9c155aee00767b8908a9ef4ffb409f9fec670e394f9e264ca74d7cf2d69fde6ab4d4b14074b2ba7b97dc021fac1bc","ssdeep":"","tlshash":"5e017087282116069cb42157303427f1272a33c81aaaedc8c63180c36af6a37e48f89b","first_seen":"2026-09-07T00:32:02.767183Z","last_seen":"2026-09-07T08:08:08.250515Z","times_seen":3,"resource_available":false,"data":null}},"time_used":629,"timings":{"blocked":315,"dns":0,"connect":0,"send":0,"wait":313,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/527dbdcd00344d0fb0f690a746678711?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.421Z","timestamp":1788741144421,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/527dbdcd00344d0fb0f690a746678711?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 4438\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 30442\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"527dbdcd00344d0fb0f690a746678711\"; filename*=utf-8''527dbdcd00344d0fb0f690a746678711\r\nContent-Md5: ZQBbLXwdfZQkC0QCdVYxpg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FuzWThmOt9nHqvKln4IdqZ9KM6Jv\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:33 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: Yr2QECVR7\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: 2HYAAAAEATDpxtIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4438,"size_decoded":5194,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 125x125, components 3","md5":"65005b2d7c1d7d94240b4402755631a6","sha1":"ecd64e198eb7d9c7aaf2a59f821da99f4a33a26f","sha256":"c57003283c2c79ac630b5aa962f12d80d4dab31cd4325e8e96522e7e983febb2","sha512":"e45ff068c93abcf696e9b0fb9e8e08249e21a020756e455404893f12413275b04f08e970296ac7b0c45fec2199e60bcef1dc4119126351159a0d09c7e3283f8e","ssdeep":"96:fb0oQnzWMX1zyaXFuBbFqw0CqMM8ADbQ+bc9QG:0zWEXFuBbn01MMLXQ+I9QG","tlshash":"c7919f7f797b8fd6a06774f4e7c227865ecd4f856a33db8a87010686180a284434c64c","first_seen":"2023-08-17T12:39:30Z","last_seen":"2026-09-07T08:08:08.160217Z","times_seen":58,"resource_available":false,"data":null}},"time_used":4271,"timings":{"blocked":4019,"dns":0,"connect":0,"send":0,"wait":252,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/23a87f971a1541dabfcfc4e29ead7240?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.493Z","timestamp":1788741144493,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/23a87f971a1541dabfcfc4e29ead7240?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:32 GMT\r\nContent-Type: image/png\r\nContent-Length: 50619\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 12731\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"23a87f971a1541dabfcfc4e29ead7240\"; filename*=utf-8''23a87f971a1541dabfcfc4e29ead7240\r\nContent-Md5: COraz0heSAh503fvTX0N8w==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fk1bWBnuv4icrt-F_AKYO9tF5fTj\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:36 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: oQGORRt8I\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: vX0AAAB0zsoF19IY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":50619,"size_decoded":51375,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"08eadacf485e480879d377ef4d7d0df3","sha1":"4d5b5819eebf889caedf85fc02983bdb45e5f4e3","sha256":"c42426eb84f2155816c1c5b79e3fcd4587ba940dcc69c8035d1d31a9a1e68ad2","sha512":"6efcb50abef37584ba9d74817cb49aa31ccce883c503b49b18fe7eaf2da259690c9dbbf9c09da65d27a88a43ed9261d58b62215c7f00bccd2bda9ef7b5be1064","ssdeep":"1536:GSSd1KVdQk32M5/POjFugAOegNiqHDv1sQeJrY6s:pVdjG8nOjFughHv1T6s","tlshash":"7a33016b7e15a972e2ea5f3eec9c30a3c07d68088476d1e3eac63035a81045ef5657c9","first_seen":"2025-08-31T16:55:16.601279Z","last_seen":"2026-09-07T08:08:08.223175Z","times_seen":6,"resource_available":false,"data":null}},"time_used":8119,"timings":{"blocked":7830,"dns":0,"connect":0,"send":0,"wait":266,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/kc523-1/noData/cms_noimg.png?1781011825626","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.513Z","timestamp":1788741144513,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /kc523-1/noData/cms_noimg.png?1781011825626 HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:26 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 30 Sep 2025 12:19:27 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68dbcacf-269a\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nAge: 52531\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c911a07947d6df7f44\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9882,"size_decoded":4400,"mime_type":"image/png","magic":"PNG image data, 1920 x 700, 8-bit/color RGBA, non-interlaced","md5":"85e60fd8767b18839ffb552a5d543f8a","sha1":"341cfd68a5b39cb246af6ade1e3171c857d2df5a","sha256":"4b7ad68306ffac25830d1016ba86154890deef8bd77a03257b767b37de1c8338","sha512":"785f028aab80d3f96794431f84025483f490d7d642022404a7b14ccb4785aa52fe4a21048d44acda3bd160eedeaccfb4959a677986dfe47ef038d80724f2acb2","ssdeep":"96:74iGykVWI7TGvGJUgTFSebsBzYofEC16+TqBK7R7LWKaR8a8D7uZNgAMXFL73:74iyHunEFSebsvP1nTP7IF2uAAMX5","tlshash":"141259118573d43cd82ce57926df6fb93b709f996890476e8328e7342f2a2f78d60848","first_seen":"2023-05-01T09:33:58Z","last_seen":"2026-09-07T08:08:08.444615Z","times_seen":3212,"resource_available":false,"data":null}},"time_used":1923,"timings":{"blocked":1626,"dns":0,"connect":0,"send":0,"wait":297,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_4d4d0270-e129-42d7-8f6f-0802c910d540.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.616Z","timestamp":1788741144616,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_4d4d0270-e129-42d7-8f6f-0802c910d540.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/webp\r\nContent-Length: 11920\r\nConnection: keep-alive\r\netag: \"013c35e9baa4c707701c1a2cf8534d3d\"\r\nLast-Modified: Tue, 02 Dec 2025 14:08:51 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 48500\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MWXflFifZBxdyqc1evKLd01Dseo1n2NjnXQeyBgTTXj0uuU3CdjyKoH2dxRi9AaIh1b9OHA2EdRjwYBFkJnsZZOIkjvdGvo4nEotTOHQh%2B%2FZfU8NiSE5YSkjOLEB4eMsyybSsgCCjs%2Fdpn6pRsDC%2B%2BM%3D\"}]}\r\nCF-RAY: a36cfdbbeb358cae-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c921a07947e00083f6\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11920,"size_decoded":12833,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"013c35e9baa4c707701c1a2cf8534d3d","sha1":"2139b155d847e1eb2d17fc298760cb039598f89b","sha256":"f1d2851323d84d5dde72bf02ab6ed8f8f55eddc2a9607799e1ff211e0ede29fd","sha512":"e80a60ee340f8de57181fe71da391673d3bb834b91b622b5032c3674e8b85ee3c1610574b1b1d883b42e94d94a45823a63657a90cfa2062674776ebe9637c8cf","ssdeep":"192:H0RkcJGKX9YQtzAe5IIq83lxzCfVJGpYWrJUcm1aTfRbuArP+UcJaYrR5Vc:UXGjQtzAxILj2tJGrJRmETflDzcoGR5V","tlshash":"ec32b065c3da9c54c4027bfdab0239f95c5e7b45783bc7de68893d150288f90be218b1","first_seen":"2026-04-24T23:10:16.764405Z","last_seen":"2026-09-08T23:44:55.172967Z","times_seen":1032,"resource_available":false,"data":null}},"time_used":4195,"timings":{"blocked":3888,"dns":0,"connect":0,"send":0,"wait":307,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_b1b5acd8-3851-4b06-8e10-d549f7f09d1b.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.645Z","timestamp":1788741144645,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_b1b5acd8-3851-4b06-8e10-d549f7f09d1b.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/webp\r\nContent-Length: 15438\r\nConnection: keep-alive\r\netag: \"a1349a63a048224ad8e87814e87bb73e\"\r\nLast-Modified: Tue, 02 Dec 2025 14:12:01 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 42514\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=umYpBszkc0qhTBhs4Cl8dmBKDJ3TEhDO74AnOG4Uc7AH2weVCvwABmv7hQaB3VY2LDERTmMunYSozDSLNGUQHJhhLCziw4QXxVyfTENw%2FVwpOZDUzK2K1QJLmw6Py7OLn%2F1sKQsU9mUQvKBxcoOteV4%3D\"}]}\r\nCF-RAY: a36d8feb383ee2f5-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8c1a07947e759812d\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15438,"size_decoded":16345,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a1349a63a048224ad8e87814e87bb73e","sha1":"0e04bbeddf14327f501a7d2c6df6e05795879d8e","sha256":"07dea36c21de6e1a3b038a16fee3fe652275f33b1757c12ef30396e4dcabd2e8","sha512":"6e92d8f202db95f03407b4594b217cc15dd52e187fd69f779d45407cd9644095929c9a657b49fc030e7a2f4b1dc1f92cecddbdf72ceddba23cf33b759b782c11","ssdeep":"384:8033ZoVI43DY5WxPnFK9OMJuFUzYc4Ig30k8E2:PobD3xtwn+jc4IgV8E","tlshash":"2d62d0402ecaf0713ba1781ebb7df58804b89937b45a724758b70471b66d4ae13964f3","first_seen":"2026-04-24T23:10:16.871482Z","last_seen":"2026-09-07T08:08:08.181278Z","times_seen":1195,"resource_available":false,"data":null}},"time_used":6088,"timings":{"blocked":5765,"dns":0,"connect":0,"send":0,"wait":323,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/6120806d0ca941c9af798bc4abaa4c7b?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.460Z","timestamp":1788741144460,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/6120806d0ca941c9af798bc4abaa4c7b?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/png\r\nContent-Length: 28005\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 26831\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"6120806d0ca941c9af798bc4abaa4c7b\"; filename*=utf-8''6120806d0ca941c9af798bc4abaa4c7b\r\nContent-Md5: evdiLfByuuSBUoR34tvWyQ==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FiPghUClIf5cel-eBXWtectAzTMQ\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:59 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: hW4QbzONX\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: 6B4AAAAQFVQyytIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":28005,"size_decoded":28761,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"7af7622df072bae481528477e2dbd6c9","sha1":"23e08540a521fe5c7a5f9e0575ad79cb40cd3310","sha256":"b06ea68ef5b53941a1b178c08e5a57e0d138f0579bbdff42987473cafa838be1","sha512":"8e08d262f0fc4efcfc5500d98b674aa8b48c8f6ccac546db09063b7dfa65e187dbef3de765d2f3746c5ea5ddc4923e943083b5347b1c931bc71f61709c0e6700","ssdeep":"384:RdIsI+syFujLPVGB5s4Qh0ZZxBzgzUZkdnz9/DUS46xqCBN/rJUEcYIfh9ySHy/c:RdPI+2jLP4st0/xpbZerhLTsYIJzoy","tlshash":"6cc2e105b3a55ae4318f73b123a3265c72270d8c49edcd8695469b21b93daefbfd0087","first_seen":"2023-11-11T13:40:00Z","last_seen":"2026-09-07T08:08:08.097931Z","times_seen":41,"resource_available":false,"data":null}},"time_used":6291,"timings":{"blocked":6025,"dns":0,"connect":0,"send":0,"wait":253,"receive":13,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/2238839f28c145bcaad3f155713b0297?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.476Z","timestamp":1788741144476,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/2238839f28c145bcaad3f155713b0297?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:31 GMT\r\nContent-Type: image/png\r\nContent-Length: 35128\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 21743\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"2238839f28c145bcaad3f155713b0297\"; filename*=utf-8''2238839f28c145bcaad3f155713b0297\r\nContent-Md5: MTkLZ7YuDVRX/Ar53KCZcg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FnD1jdwvFZ7t9I3QIdC8yOvR68sx\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:18 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: 0ifDkMPqK\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: CigAAAASFVDTztIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":35128,"size_decoded":35884,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"31390b67b62e0d5457fc0af9dca09972","sha1":"70f58ddc2f159eedf48dd021d0bcc8ebd1ebcb31","sha256":"465b606b0294e2ee186e4688ea6a969c39c2ba4588c147d0e80e5820a9672903","sha512":"ecce3d2a655bc1136e8c1436a99cbfe1321b2d77db8f2cba3333611e499b5e022558df01978498f24ffd46c5c1f5fa1f1b60876c20529c0761277482ae5c96d7","ssdeep":"768:2OfGDxvrHpVpaqwQTfWcIqUYjkCz8SYFOa2u9W8HLGHVM:/fIrpVpaZVcTCH2VGR","tlshash":"c3f2f1dd18f3eb92e2522dca55d1f98e183ae4bb5602e4d16929005ccfa761ff3ea005","first_seen":"2026-01-24T17:33:49.393438Z","last_seen":"2026-09-07T08:08:08.183881Z","times_seen":34,"resource_available":false,"data":null}},"time_used":7204,"timings":{"blocked":6931,"dns":0,"connect":0,"send":0,"wait":259,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/492a30b2472b4ed1960f05d0d3e4cd2d?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.476Z","timestamp":1788741144476,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/492a30b2472b4ed1960f05d0d3e4cd2d?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:31 GMT\r\nContent-Type: image/png\r\nContent-Length: 38010\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 21742\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"492a30b2472b4ed1960f05d0d3e4cd2d\"; filename*=utf-8''492a30b2472b4ed1960f05d0d3e4cd2d\r\nContent-Md5: UPcjasuIIVijTfDjmQCswg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fo9C5J1AlksegzF5ZGMXN8cZ-13c\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:18 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: 3gGL2gmF0\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: 040AAABqlVDTztIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":38010,"size_decoded":38766,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"50f7236acb882158a34df0e39900acc2","sha1":"8f42e49d40964b1e83317964631737c719fb5ddc","sha256":"79e67661bd561b224af2c3a659ac08eaccffc5fa62871cfd71a0cb3c17a0126a","sha512":"a1e962dab0cd1d539a8b5e657fdc5fef9e225269f18484f8a563bc745c880b8d36d1cf7ad3948512095288908fdb02fe8345d0dc26088c0f182f5c34829af1a5","ssdeep":"768:kkoNXWE2bMLLT9IcVk8/62V56RI8dyxtjddvd9/GGe6SgGYOYnx:k7mE7LL/6iO8v//GGQgGE","tlshash":"2d03f1ccbc878131404478bfbf65418a5616a78d3fb2c7265ac3d088bcba59c65ef585","first_seen":"2024-12-22T16:23:43.946536Z","last_seen":"2026-09-07T08:08:08.088279Z","times_seen":54,"resource_available":false,"data":null}},"time_used":7225,"timings":{"blocked":6943,"dns":0,"connect":0,"send":0,"wait":266,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/kc523-1/sponsor/sponsor_nav_web_3.png?1781011825626","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.663Z","timestamp":1788741142663,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /kc523-1/sponsor/sponsor_nav_web_3.png?1781011825626 HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-09T05:47:36.08732Z","times_seen":18359622,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/img/help.4e3cf897.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.677Z","timestamp":1788741142677,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /img/help.4e3cf897.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://g36b.top/css/index-399e2569.1781011881923.a7b0b4f4.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:25 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-2852\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nAge: 43144\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8c1a07947d3758121\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10322,"size_decoded":10840,"mime_type":"image/png","magic":"PNG image data, 112 x 112, 8-bit/color RGBA, non-interlaced","md5":"6dd52a6a4d07f2786b1926fac1b4b06a","sha1":"9c9908204401fbe65d33cf7df8881639d6aea37d","sha256":"e02471f47b506ab510d0e0dc4224cffc03c34f950b649ce347ccd71af0bcf0ab","sha512":"fdd52f532e5c2e2c182db20e2053eee0ca8c26cec51ff75e1bc341b01911461ac72fa75887fa3114188ba32aa6341c0974d81d071fc42b605e72f73dfb87ab9c","ssdeep":"192:x0C+pMwjX2XZ456BAJu+1KzdjCfDrRq6wUPlJyh2h4PAmWP5yQSkHxfYX32H5TRm:EjGXZau+1MjCrrRLlqGOnWcQSkRQX3IG","tlshash":"3822c054370836084f737a4362ac4e837a06040ffdf9b7919a6372659a5b94e44cfb66","first_seen":"2023-07-01T07:21:14Z","last_seen":"2026-09-07T08:08:08.301544Z","times_seen":2732,"resource_available":false,"data":null}},"time_used":2968,"timings":{"blocked":2650,"dns":0,"connect":0,"send":0,"wait":318,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/08ebb36688a34e77b5b7223b641e379b?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.429Z","timestamp":1788741144429,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/08ebb36688a34e77b5b7223b641e379b?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/png\r\nContent-Length: 31487\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 28945\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"08ebb36688a34e77b5b7223b641e379b\"; filename*=utf-8''08ebb36688a34e77b5b7223b641e379b\r\nContent-Md5: gScoOSd2DKuTIbco7NG8dg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Frkj8i2nuqMmedRaefyMgt1_ZFD6\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:43 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: q2xUpPyXY\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: z8oAAABULPVFyNIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":31487,"size_decoded":32243,"mime_type":"image/png","magic":"PNG image data, 220 x 295, 8-bit/color RGBA, non-interlaced","md5":"8127283927760cab9321b728ecd1bc76","sha1":"b923f22da7baa32679d45a79fc8c82dd7f6450fa","sha256":"0195854f089c957610fcf25e730c0f212eac9cc4e5eeddca9e46f3baa26e4bf5","sha512":"22537b04cc72846097219c1f7a351286b1cf02d30ee5613cc38083a438f0355a7234d6656a57d53496225b279ee2f57e0fa5413045ddb869009e2103587d1ac8","ssdeep":"384:Ks0GC3tg7FlKtuWxYk3ez+CrYvvfN4KtUa2GyiYZFlCWoq0DVHwm6cmrjpvKBeTS:tbZ7fKtok3ezrqF8dZFlCW19m65lZTS","tlshash":"c1e2f11ac1d4ba947bb3550f650ceed1982ac2747214092aeca307ef95d0ebdb07c297","first_seen":"2023-12-04T17:08:39Z","last_seen":"2026-09-07T08:08:08.423058Z","times_seen":57,"resource_available":false,"data":null}},"time_used":4673,"timings":{"blocked":4404,"dns":0,"connect":0,"send":0,"wait":253,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/826fcab9a5d84823a533f66b4780dd19?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.462Z","timestamp":1788741144462,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/826fcab9a5d84823a533f66b4780dd19?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/png\r\nContent-Length: 217490\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 26226\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"826fcab9a5d84823a533f66b4780dd19\"; filename*=utf-8''826fcab9a5d84823a533f66b4780dd19\r\nContent-Md5: uv0xOMa4R93/i141IC1K5w==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fqz-2SKhoYPavKQhHtAfIIHLkdWY\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:00 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: syUB2iY8B\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: 4_IAAAAoQhm_ytIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":217490,"size_decoded":218247,"mime_type":"image/png","magic":"PNG image data, 1200 x 1373, 8-bit/color RGBA, non-interlaced","md5":"bafd3138c6b847ddff8b5e35202d4ae7","sha1":"acfed922a1a183dabca4211ed01f2081cb91d598","sha256":"ec5ebe152f3802e28a2b44592b21e425dc3cccc6911a19fa912dafce5a327f34","sha512":"780f07908867283a65ae38a4dc8d9ff5f242ba3ab82974c85aac161fdd1d45e56e27ed375a550ebbd8f53120a74ec145278c743b127422c9959f359e9dbe04ca","ssdeep":"6144:i6Hb7zHikIAUq9D3fu4TBo0OcIdRA+FU7tv3mWmeOI13f1LouS4DLU:i6HbviKDDVtoRJhixTVP1LQ4Do","tlshash":"1c2402f2c7e654e7ae99173b7ad30a06c41f2a35e73e2d8643c6bf510a6f5d95382008","first_seen":"2025-03-16T19:56:39.428277Z","last_seen":"2026-09-07T08:08:08.105498Z","times_seen":59,"resource_available":false,"data":null}},"time_used":6781,"timings":{"blocked":6183,"dns":0,"connect":0,"send":0,"wait":263,"receive":335,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/0ba3e544bfd94bd980193674d04eda22?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.495Z","timestamp":1788741144495,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/0ba3e544bfd94bd980193674d04eda22?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:32 GMT\r\nContent-Type: image/png\r\nContent-Length: 9282\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 9144\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"0ba3e544bfd94bd980193674d04eda22\"; filename*=utf-8''0ba3e544bfd94bd980193674d04eda22\r\nContent-Md5: KESNHYTSEZaKvSYJGCosCg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FpMpfmJ38TUq6WkfijA6v1SUdh9S\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:41 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: ZTRvgZ2cm\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: frEAAADQsMtI2tIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9282,"size_decoded":10036,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"28448d1d84d211968abd2609182a2c0a","sha1":"93297e6277f1352ae9691f8a303abf5494761f52","sha256":"d88d17f45ed0200a8c08c133339f912085bd6f40bf5f31270700fe02018dd356","sha512":"f92f66eca6b1f77ffad3739dc1aa958e67ba956878d5cc0269aef802979c158300dc549aaeea346e8e3fe38e0ad4b473c031dd62a77ed943a88cdc1bce476080","ssdeep":"192:vRhFQbKoSYkisAItCQWHm2dW7y3qW6jqnMFDbXIaFk:v3aEdihIYm8GRqMFP4aW","tlshash":"a412c0280a53b73fb56ad6416a60c3c27c14f3416b64a9cf3f683423dec13272ee1219","first_seen":"2025-02-24T02:30:01.444616Z","last_seen":"2026-09-07T08:08:08.145229Z","times_seen":161,"resource_available":false,"data":null}},"time_used":8109,"timings":{"blocked":7853,"dns":0,"connect":0,"send":0,"wait":256,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202603/_webp_size1080x1196_b15d1708-bfce-458e-bd99-5bc1134b7122.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.583Z","timestamp":1788741144583,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202603/_webp_size1080x1196_b15d1708-bfce-458e-bd99-5bc1134b7122.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:26 GMT\r\nContent-Type: image/webp\r\nContent-Length: 48628\r\nConnection: keep-alive\r\netag: \"170614bf75e281d0f05503cdeab75a59\"\r\nLast-Modified: Thu, 19 Mar 2026 14:50:59 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 52541\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EOT8dx3%2BdQAo%2BHdygLAMAxSDw4BGs0a24J7BaYrdEa1E%2B0pZndf%2BU%2B8uacn6SYrDxNb9yxRUh9f5Nbq0R%2FauY3%2B9XovrphCqJ9%2BtgyIfOyxv7c%2Fa40bWpQxvL8syobI9lOeCUaQsJc16uw04QJdzCCo%3D\"}]}\r\nCF-RAY: a36c9b084977e6a2-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8e1a07947d93e77e3\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":48628,"size_decoded":49549,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1080x1196, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"170614bf75e281d0f05503cdeab75a59","sha1":"32025008b56adf94f2a64724f1b00f55939db943","sha256":"010f104d5782b172955179537b5945b89f7a5ac32185a63d67ea5405d5c13733","sha512":"e11fa01405248d40ad8f95f335734207193356f418418955cafc6ebdfa04f5a08d8e304d23c34b211fd9dc7cdab36710694ccd0585c79778a156bf214750346a","ssdeep":"768:tk9BmrgO1s4wjUc8pqYtHwHGvhSgV1iCdmcmxWSqZA16T2rrKhv0cQ6ZQOc4vS9P:tkbmrgO1srjUtkEn5LTdmcmxnqC0aKhm","tlshash":"4223f124d4de0cda1978e776f637574cdb8b325fabc4601f82c9499f800ab04c6628ee","first_seen":"2026-03-20T12:57:26.684793Z","last_seen":"2026-09-07T08:08:08.13526Z","times_seen":1131,"resource_available":false,"data":null}},"time_used":2521,"timings":{"blocked":2208,"dns":0,"connect":0,"send":0,"wait":303,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/img/weihu.49a14962.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.602Z","timestamp":1788741144602,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /img/weihu.49a14962.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://g36b.top/css/index-399e2569.1781011881923.a7b0b4f4.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-09T05:47:36.08732Z","times_seen":18359622,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/ecb/8f8306425fb46e096ba9db3ab31b67b681fbb31575ff397b0117","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:23.432Z","timestamp":1788741143432,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /ecb/8f8306425fb46e096ba9db3ab31b67b681fbb31575ff397b0117 HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://g36b.top\r\nXign: uzY8AMkULCwzFeezBuyddVBD5a69u92IGxaU5PhczEbr0W0P6CizuzP9yKYPJdc2ngEXsGg6wElqaGfRKRIiKHhU7KTRHusjsXSlo6UGFerKMZbLMwGBiva946dVxRerG9fe02ZRq0I5nWTnlTYlFblnyzKkYFxnAN9uguux0MY=\r\ntimestamp: 1788741143420\r\nsign: e6m3s4c6v75v2f27\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: aDntxNnwbrytXeEW4SJfGsaRdsx3tyZ3\r\nlang: zh-CN\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:23 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Mon, 07 Sep 2026 00:42:23 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nX-Request-ID: 8413385a67fb406fb5de69d5cfa705b5\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c881a07947cc088134\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2132,"size_decoded":2952,"mime_type":"application/json","magic":"data","md5":"5a5fa14c7c2f894cbe023921d600d98a","sha1":"cdc24ffeb3a9bc6868f54f5611c12dabee2b627e","sha256":"0cff788fa64bec98a5d5e46fd9cedd91812c437a2f0d6954bc3fe9099382d411","sha512":"6ed6dd72c3ccdf696ab9c81d4d599c4212c1a1700e2283f7258387380ce41585d2b2dd4c9ff0631fcc029f8303b5e8589033f9da81a86e0776e5f91e2ae43916","ssdeep":"","tlshash":"02616c176a9da30ada2a4e75c4378de9692cc32d7b5df8e3c5904f2082eb303306d640","first_seen":"2026-09-07T00:32:02.858593Z","last_seen":"2026-09-07T08:08:08.328632Z","times_seen":3,"resource_available":false,"data":null}},"time_used":318,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":318,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/0dd0cf6ed4304dca94ada9bfaebf7e66?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.474Z","timestamp":1788741144474,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/0dd0cf6ed4304dca94ada9bfaebf7e66?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:31 GMT\r\nContent-Type: image/png\r\nContent-Length: 137572\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 23548\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"0dd0cf6ed4304dca94ada9bfaebf7e66\"; filename*=utf-8''0dd0cf6ed4304dca94ada9bfaebf7e66\r\nContent-Md5: 7DEy0rJdlso6Z48rxbuyWA==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FgGGmmspj0_g-hJL5oDcEVCvih_q\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:10 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: dcDdqxm9K\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: WJMAAABGvewuzdIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":137572,"size_decoded":138329,"mime_type":"image/png","magic":"PNG image data, 300 x 356, 8-bit/color RGBA, non-interlaced","md5":"ec3132d2b25d96ca3a678f2bc5bbb258","sha1":"01869a6b298f4fe0fa124be680dc1150af8a1fea","sha256":"d1e6d43a87b913f620b7f4f5736dc7f7c226249c8ef8a2ef11ca52d425850b49","sha512":"bfd1ac05a2256d14d1e5ca00c12e223bb1c0792e5a0ae8e478e9616ee09dfe539bfb6aa23fd8e3360bd086bfe236e9d43685ceb2799113385c581645f7962e4f","ssdeep":"3072:WEHXoPeWmlOgX12r8DYgTuGRXziCbWuCgbceSbDlhKqi/:WMYGzAO12r2uIUgIHDlhC/","tlshash":"e2d3128c7e6407431cc8fb05b3fa94384989c292d6fc7d29668d9ee81a54ec714da377","first_seen":"2025-02-04T17:13:01.177963Z","last_seen":"2026-09-07T08:08:08.302753Z","times_seen":64,"resource_available":false,"data":null}},"time_used":7174,"timings":{"blocked":6833,"dns":0,"connect":0,"send":0,"wait":262,"receive":79,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/5f03236fc0b84f42ab1f4b58e29ba926?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.509Z","timestamp":1788741144509,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/5f03236fc0b84f42ab1f4b58e29ba926?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:33 GMT\r\nContent-Type: image/png\r\nContent-Length: 10740\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 1042\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"5f03236fc0b84f42ab1f4b58e29ba926\"; filename*=utf-8''5f03236fc0b84f42ab1f4b58e29ba926\r\nContent-Md5: uHDhZkWg70lKd3BJ2TFJow==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FiIRZQPKhQBvbXZHKpryQf3-Ekuf\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:47 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: ykqmzRKh3\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: ZnAAAABQNHSn4dIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":10740,"size_decoded":11495,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced","md5":"b870e16645a0ef494a777049d93149a3","sha1":"22116503ca85006f6d76472a9af241fdfe124b9f","sha256":"706faf0c9c857766bb2c5857a8027970be90d731a0a0f092491139ff6f1284d3","sha512":"dd4b220ab27a485f591e3bcc84e160fb61051c54606aebfa92174ec738a6295eb5193ec25df7d01e56454347243598486aad3e40bfcfdf67671366f48ebc40a4","ssdeep":"192:DUilqtz4nZCfePklj2hOdaSicW+HgJjGr5Y02ukKYBsoihzjvgHEFFznAyfvAa4:DUiVslj/ESicWLJssukpsngyNf4a4","tlshash":"d522cf81b0456716fae099360b19a7c28efbd1528a03bc9176332d1c4cef16af781b29","first_seen":"2025-01-29T13:39:14.630847Z","last_seen":"2026-09-07T08:08:08.167389Z","times_seen":248,"resource_available":false,"data":null}},"time_used":8876,"timings":{"blocked":8619,"dns":0,"connect":0,"send":0,"wait":257,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size704x442_7f760e34-ebbd-4cfc-bc28-666cc8a6234f.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.651Z","timestamp":1788741144651,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size704x442_7f760e34-ebbd-4cfc-bc28-666cc8a6234f.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/webp\r\nContent-Length: 44494\r\nConnection: keep-alive\r\netag: \"693c20ba4107f736124e16931ead8d60\"\r\nLast-Modified: Sat, 06 Dec 2025 06:30:27 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 42519\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QeZdDecrn3BVFLn82gYKvC8cj%2BgDndJR%2FkcE1raQcGWTZ4Mypr%2BPmVtPgzHZeOcC2e4HT8O89fU%2FxEiG5zqinTDdmuLgVo%2FUcH9VIcVky2REj1pSHx9r7bdtMQuMB2mBygBayzjcKE3S1Mueleqd824%3D\"}]}\r\nCF-RAY: a36d8fd1a9610974-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8c1a07947e89c812e\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":44494,"size_decoded":45407,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"693c20ba4107f736124e16931ead8d60","sha1":"6a247e864c0c0a9c40bb5be357de99524abf3e2e","sha256":"342bf65608ae9d71296ffcfbbfb4580c00ba782557c802be6496ec374d5fad11","sha512":"ae136a2a5baba143d5afd3fe4270a5ce2bd0a96655f2f56a65f2d9ea26ada4a90c63b36c96b6b79adb32dc0ac9f118040f236cfcdae958f82c05f3f600dc79da","ssdeep":"768:ssqja8OCwQkPOoS4nNgT3p8tZgn5DVWGgNS4RipleSQ6c5xlGY89B:JVQGS8A+wn5D4GgrkKKc5jGY89B","tlshash":"5a13019a26762833b187c36d0030062c1b78b89f3654c54ea4ed7924975f09ec7eca6f","first_seen":"2026-04-24T23:10:16.7563Z","last_seen":"2026-09-07T08:08:08.149784Z","times_seen":1217,"resource_available":false,"data":null}},"time_used":6441,"timings":{"blocked":6087,"dns":0,"connect":0,"send":0,"wait":323,"receive":31,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/a39467b499bf43da9cb74cd10f6e344a?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.382Z","timestamp":1788741144382,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/a39467b499bf43da9cb74cd10f6e344a?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:26 GMT\r\nContent-Type: image/png\r\nContent-Length: 19185\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 88341\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"a39467b499bf43da9cb74cd10f6e344a\"; filename*=utf-8''a39467b499bf43da9cb74cd10f6e344a\r\nContent-Md5: iqmZiMGYpY0Wk+akFN1Zhw==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Ft6Jh4U2BhA-TTALCz3Z_iXlywzy\"\r\nLast-Modified: Mon, 31 Aug 2026 18:51:40 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: 2JTGOLCii\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: MqcAAACrrfo_ktIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19185,"size_decoded":19941,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"8aa99988c198a58d1693e6a414dd5987","sha1":"de8987853606103e4d300b0b3dd9fe25e5cb0cf2","sha256":"dd7fc40a9f0f57e62d902c1f7497b200e26e65b7f964fa71f25d8f3ddb5c98ae","sha512":"69794ae2906f691e4709a758a2210740274907d04d13756b5c40100c17e8361e7181cf99a9e736cca8e82a2f0bb9a31cda1907152999adbb5f79cac87335dd43","ssdeep":"384:GezkAY7PSrZdEOpBSGcjj8uJQucK3qi8f5n+VQzuojtURe:lkAi6N5STP8uJQtrijQCJY","tlshash":"1c82d12fa61f48d5c60269871bb324c338ee8d3e456924edd6cb723e53d24217a8ddb0","first_seen":"2025-04-01T11:41:18.00304Z","last_seen":"2026-09-07T00:33:21.836668Z","times_seen":150,"resource_available":false,"data":null}},"time_used":2001,"timings":{"blocked":1667,"dns":0,"connect":0,"send":0,"wait":309,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/833ba658046c44f28ae1d5b2eca4adfe?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.453Z","timestamp":1788741144453,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/833ba658046c44f28ae1d5b2eca4adfe?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/png\r\nContent-Length: 9163\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 27129\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"833ba658046c44f28ae1d5b2eca4adfe\"; filename*=utf-8''833ba658046c44f28ae1d5b2eca4adfe\r\nContent-Md5: BQpPdqWtm27e71p/BOrMtA==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FnOooirOpw7_U6xAACj83fvHacIS\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:46 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: Z2JI2UQm5\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: fQgAAADfy_7sydIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9163,"size_decoded":9918,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"050a4f76a5ad9b6edeef5a7f04eaccb4","sha1":"73a8a22acea70eff53ac400028fcddfbc769c212","sha256":"45799aa8be9962228dbd4531802e0e424c950b381c23f8feb70364822f1d6d5f","sha512":"4bad8f4ea09cb8ac13247c841d7d6acd3be22ae36355bdcb1e064a0ed813ac9a68b1eccbd78154e5d2f65bff1ef04518a4899e70f550342f2da1a39fd18d55c1","ssdeep":"192:to7ffFKPUssDJwa8T5AzL+6MLqNJFKFWnCHxohOFHUaOz:2fcEtWKNML3DxohAHUac","tlshash":"0c12af94d3a749e4c4d48b1e6010894fb7c6f9e2f7e2358f0559d437441912a3fed29e","first_seen":"2023-07-17T19:56:39Z","last_seen":"2026-09-07T08:08:08.20291Z","times_seen":155,"resource_available":false,"data":null}},"time_used":5907,"timings":{"blocked":5651,"dns":0,"connect":0,"send":0,"wait":256,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/8c17ebc094f74dcabb83291d7325f739?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.471Z","timestamp":1788741144471,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/8c17ebc094f74dcabb83291d7325f739?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:31 GMT\r\nContent-Type: image/png\r\nContent-Length: 1995\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 23549\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"8c17ebc094f74dcabb83291d7325f739\"; filename*=utf-8''8c17ebc094f74dcabb83291d7325f739\r\nContent-Md5: nzy8w3fQFDgGWPoSKEsdtg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fk2sh3sWplDQ3IVVcTJ6aq33NdyO\"\r\nLast-Modified: Mon, 31 Aug 2026 12:48:07 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: W3eXGpeoL\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: 9UoAAADnrsQuzdIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":1995,"size_decoded":2750,"mime_type":"image/png","magic":"PNG image data, 219 x 271, 4-bit colormap, non-interlaced","md5":"9f3cbcc377d014380658fa12284b1db6","sha1":"4dac877b16a650d0dc855571327a6aadf735dc8e","sha256":"96010d00429ba0796ccefdb76ffcf552801aa4dbb6a21b3365c707df37929a94","sha512":"17b9ac6899091e9923c78ff6f7fc9cf2b842f0ceb840c945d2fa16324c8e9a116fddf1a283fbb7382f644407006f0b5d99fdbf70d6373b318a7ef57335b8963b","ssdeep":"","tlshash":"a1412ad0f39949ec47c7f62e2b0b2a6c8028f0852c54724f1260c1cc6f281be893ca4d","first_seen":"2025-09-29T19:03:34.650687Z","last_seen":"2026-09-07T08:08:08.118182Z","times_seen":60,"resource_available":false,"data":null}},"time_used":6931,"timings":{"blocked":6679,"dns":0,"connect":0,"send":0,"wait":252,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/16558ed924b145aabf8ad5d706776b7c?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.482Z","timestamp":1788741144482,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/16558ed924b145aabf8ad5d706776b7c?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:31 GMT\r\nContent-Type: image/png\r\nContent-Length: 25847\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 20838\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"16558ed924b145aabf8ad5d706776b7c\"; filename*=utf-8''16558ed924b145aabf8ad5d706776b7c\r\nContent-Md5: yHg4lRAbW88JwSZoNtieiA==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fss8D-4n4NZsM_XEactwQZ7pcCqw\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:22 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: lzfqOnL95\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: HJcAAADO0Oylz9IY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":25847,"size_decoded":26603,"mime_type":"image/png","magic":"PNG image data, 221 x 221, 8-bit/color RGBA, non-interlaced","md5":"c8783895101b5bcf09c1266836d89e88","sha1":"cb3c0fee27e0d66c33f5c469cb70419ee9702ab0","sha256":"24bd970704b2d855ccaeffa72149ec59aea6027452b2b1d091865d6e024d5ee7","sha512":"db49a0cefb3cfd0cea003308e3da1100fac9f42b07f063d7ea557f0bbebebf95b9094ab365989c5518ed4d10a7113567291d9012fbc25eb811472ca5a4fe3da4","ssdeep":"384:/4LJ7qkj66J/DmmdWFGgJhsVjMKYfyPgP02EBc+yvlu7SgkP8CaXrrTT1vlZunn:/4L76vmYFn3xfh9+OYdkP8VrInn","tlshash":"a3c2e0708929d024b372eabfc24f9fba949371670a35306609ead04c6b263c3c5d669c","first_seen":"2025-12-20T18:16:54.86578Z","last_seen":"2026-09-07T08:08:08.1202Z","times_seen":15,"resource_available":false,"data":null}},"time_used":7510,"timings":{"blocked":7248,"dns":0,"connect":0,"send":0,"wait":252,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_de72e240-4300-48d6-8f6e-b9cb363e7924.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.638Z","timestamp":1788741144638,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_de72e240-4300-48d6-8f6e-b9cb363e7924.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/webp\r\nContent-Length: 81300\r\nConnection: keep-alive\r\netag: \"4a30c16256a637de0e38e326aa6cdf0c\"\r\nLast-Modified: Wed, 10 Dec 2025 11:51:47 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 42517\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DXug6FBzy4aU7Ulf8jfyHH6ruUH0f6mxyqsHbSOiXUYqX68zNlDR0RUpp8r%2FVF%2BVQwmXtmVy7pXuVb20BA0AKqqWgphXhGrF9oL4Ap1D80L1UVc7s31NmjlPi7Z%2BSCUbVEjSsGRUtegtVeViG%2FPtiSs%3D\"}]}\r\nCF-RAY: a36d8fd93c1a49dd-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8e1a07947e53e77ed\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":81300,"size_decoded":82211,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"4a30c16256a637de0e38e326aa6cdf0c","sha1":"083a8e24d12a329c41bc5271ff2ee57570a6ff1d","sha256":"2e9e6d8b511c612cae6e20caa233846b723fe3f3c899d19eb8389073f0ca8047","sha512":"2cc3551a276966a3615edbf590ce22d06779e40c371e54737fdd0033faf900483fe32a33fcc86327fc2e3098e5ee02a88d6e7c60552a4ebdeac5ed66a47f007f","ssdeep":"1536:rHYJZl7vtdLMbrX1zS7hmZHerpnyjI79AYRU6kzu0MRsIelVbd:rkf1dLMvl6MZ+9nyjIinjuxcbd","tlshash":"7b83f1603172ed83bd9eb46081883156f984d84473298ff72a779fbd93128e9973970e","first_seen":"2026-04-24T23:10:16.828064Z","last_seen":"2026-09-07T08:08:08.253523Z","times_seen":1088,"resource_available":false,"data":null}},"time_used":5542,"timings":{"blocked":5220,"dns":0,"connect":0,"send":0,"wait":302,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/css/index-399e2569.1781011881923.a7b0b4f4.css","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:19.386Z","timestamp":1788741139386,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /css/index-399e2569.1781011881923.a7b0b4f4.css HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:20 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-faee\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8c1a07947beaf810b\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":64238,"size_decoded":34078,"mime_type":"text/css","magic":"ASCII text, with very long lines (64238), with no line terminators","md5":"1f30d2cd291b70a1848607e3460d9278","sha1":"e91e48518ec94fcaacf418789927f34d7527dc99","sha256":"8ce1851c7bd6e7db80ee5ee8da7a0c808f29756dda3c941bb3811dc3bd3e5afd","sha512":"3cf09b1afc740c4a219a45a233489d76587ec8bd80a57c52ab133f33fdffa8a3fe35a0a27e386270ebeaa9e86d156897e44733b8eb83ee6935fe67749c30cd0f","ssdeep":"768:E0ouVbMisnf7X8vtr9UL5srs7hAqpLe20TCKiNkZICSA2ohGyHukQ9aaV+TJtU+G:HoGws9isrQAqVe6KekWRlkQ9hf+Pe","tlshash":"c6538d3123e0286ee27b6b16ec51e659352b8602f127625af703362fc1d72f5c67b742","first_seen":"2026-03-20T12:57:26.768432Z","last_seen":"2026-09-08T23:44:55.189401Z","times_seen":1780,"resource_available":false,"data":null}},"time_used":1470,"timings":{"blocked":-1,"dns":0,"connect":308,"send":0,"wait":571,"receive":271,"ssl":319},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1884x434_f0f83841-a720-4f18-8acd-c726f4c1e685.jpg","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.029Z","timestamp":1788741144029,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1884x434_f0f83841-a720-4f18-8acd-c726f4c1e685.jpg HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:24 GMT\r\nContent-Type: image/webp\r\nContent-Length: 36728\r\nConnection: keep-alive\r\netag: \"52398a59ef91dae075d096fc4ff3afd5\"\r\nLast-Modified: Wed, 10 Dec 2025 10:48:28 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 31017\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FZ1C8TQWwpRtkfJai%2F9Z342NO1tpKHV8mbkJD10ZouRoG8mTE7vvFnyW7K3cRbqo%2B3zlKGpMCQT2Bm3phixmKC3MRPGfU3ZGIVJAuKRVZW%2BK2dJv7SYsY2PoLyckzP%2FhqVpLlhpZvefoGQkMkTOApPY%3D\"}]}\r\nCF-RAY: a36ea877ecab26d1-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c881a07947ce5d8135\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":36728,"size_decoded":37641,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1884x434, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"52398a59ef91dae075d096fc4ff3afd5","sha1":"715ca96c95f7b75bd6343de6602afcc7e7ccf18f","sha256":"2e8e6e9cbe50fbf5f51840e5623faf0f36db820671ff2be4b6b081cb1291e12e","sha512":"c07a7de6ef0d1d3354bcadee066770459b970a5055407f504cfdabf079769658313aa63c703e8368197fd058aa17ef6dcb3370f91b189afa43ca1d9fdb4d348e","ssdeep":"768:sBvs73CSqIdqVjockR0g1C89hQMFd0gAgojNSB5uZE259v14vG:sBvs7vDacRR0g1C89hV0gA9SBgn59NSG","tlshash":"7cf2f173d312052e65293ba2aa1c6b7b2cff7e34c77d82d150a278570d01adb07ac764","first_seen":"2026-04-24T23:10:16.817294Z","last_seen":"2026-09-08T23:44:55.129054Z","times_seen":1386,"resource_available":false,"data":null}},"time_used":668,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":425,"receive":243,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/1c5371666c74489aa66c146b42300252?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.408Z","timestamp":1788741144408,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/1c5371666c74489aa66c146b42300252?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:27 GMT\r\nContent-Type: image/png\r\nContent-Length: 62183\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 32542\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"1c5371666c74489aa66c146b42300252\"; filename*=utf-8''1c5371666c74489aa66c146b42300252\r\nContent-Md5: zRgp2tn5jBZuDipa93h48Q==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fh8SNiqFaGEnbZhEETlTAhn-F0GK\"\r\nLast-Modified: Mon, 31 Aug 2026 19:03:17 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: HQwXj48wu\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: nooAAACp-uv_xNIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":62183,"size_decoded":62939,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"cd1829dad9f98c166e0e2a5af77878f1","sha1":"1f12362a856861276d98441139530219fe17418a","sha256":"0ae0eb452dce2d886b882fef4dfb4597279768ffb90684e6fbf2683c2cdabfa0","sha512":"7615fddd93b44a88ec526feafef6b1c8734291a959a0bb3a9c8516662399a2c7178d0994398f7534c62143fffcbbb747c4b538880c4a1f7592aab30eaa8bc842","ssdeep":"1536:awjCD3wzvd67h1+T3ALPCS3SFbM2gHT00wlA:Zpzo7Duw84bHbwlA","tlshash":"995302b1d221c2dfc6934cae41a2cbc0e7d3d611e6260da65f1237a861c55908cff9bb","first_seen":"2026-08-18T23:27:44.286349Z","last_seen":"2026-09-07T08:08:08.340917Z","times_seen":18,"resource_available":false,"data":null}},"time_used":3663,"timings":{"blocked":3328,"dns":0,"connect":0,"send":0,"wait":268,"receive":67,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/1f3464c8157b4df881f23f734cb592a5?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.465Z","timestamp":1788741144465,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/1f3464c8157b4df881f23f734cb592a5?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/png\r\nContent-Length: 93578\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 25325\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"1f3464c8157b4df881f23f734cb592a5\"; filename*=utf-8''1f3464c8157b4df881f23f734cb592a5\r\nContent-Md5: K8CpH3GodcdJpKjR3EAX5Q==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FtSnwu8aFIsqKt77ZFwYJFRbnanZ\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:03 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: 166i4mKov\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: bbwAAAC4QNuQy9IY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":93578,"size_decoded":94334,"mime_type":"image/png","magic":"PNG image data, 300 x 424, 8-bit/color RGBA, non-interlaced","md5":"2bc0a91f71a875c749a4a8d1dc4017e5","sha1":"d4a7c2ef1a148b2a2adefb645c1824545b9da9d9","sha256":"c6342726d0d7db5ffdee0d572a2fb0f4706555d96d734ab363bc78902def58b4","sha512":"87e6171074b7dd9c71299b96f948d7a61e090e5bb5d226ad1bb2815f05e8a06a2c254a4a156caa8d917b516edf76e8e180f7438da067c1d91a0875f0096874ba","ssdeep":"1536:J7fRtlsJuwEYQ9vmpGDzj7W057Q4pS5VMvhyjwsr3LcGjytcR7wwsh36akgUUg:J7LMuAS7pb5yjwYLcGjBTA3xBa","tlshash":"9d930274366cd6cb978e86174c70cf4d0c49bf722c1bb24d18eb65c1269afbb5b29220","first_seen":"2024-08-19T15:01:26.103796Z","last_seen":"2026-09-07T08:08:08.19818Z","times_seen":201,"resource_available":false,"data":null}},"time_used":6621,"timings":{"blocked":6290,"dns":0,"connect":0,"send":0,"wait":252,"receive":79,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/0dba773b7c10415a8a5957c8ed717e04?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.489Z","timestamp":1788741144489,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/0dba773b7c10415a8a5957c8ed717e04?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:32 GMT\r\nContent-Type: image/png\r\nContent-Length: 61719\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 18126\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"0dba773b7c10415a8a5957c8ed717e04\"; filename*=utf-8''0dba773b7c10415a8a5957c8ed717e04\r\nContent-Md5: XDw5D8HLezXwbruxYBUcJw==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FlmTgAViya1Ujj4s95TBjh1sCFpV\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:34 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: KyO8CEv80\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: _g8AAABNDIwd0tIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":61719,"size_decoded":62475,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"5c3c390fc1cb7b35f06ebbb160151c27","sha1":"5993800562c9ad548e3e2cf794c18e1d6c085a55","sha256":"2b89af1fe7ddac88098a4df27fe390c83387fc7f0b8601b4490c5c86a872aa63","sha512":"22f31034b1619ba448f8440fa53acf5229fd56b6e634298ebcabcf3a467071ca5045e95c2ca46f4ec0f85669166f67664c15908a646f9b969584a44b6f960624","ssdeep":"1536:KXB1CJOPsFqq6dgNZ28fosBZZwpBAoxjvfSYOaYy:3OPsod0Jfoh9yYOhy","tlshash":"6b5302c9ef21effe8350491cde049a7ad320d5ac8d8267d9961afc3d9b40e738c55922","first_seen":"2023-05-27T18:34:14Z","last_seen":"2026-09-07T08:08:08.157728Z","times_seen":177,"resource_available":false,"data":null}},"time_used":7852,"timings":{"blocked":7563,"dns":0,"connect":0,"send":0,"wait":259,"receive":30,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_95e34ac6-aa0b-4d3f-9ae0-451b7e2983d6.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.614Z","timestamp":1788741144614,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_95e34ac6-aa0b-4d3f-9ae0-451b7e2983d6.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/webp\r\nContent-Length: 72760\r\nConnection: keep-alive\r\netag: \"f3567ecc873ade2418801f0f5a4a755f\"\r\nLast-Modified: Sat, 06 Dec 2025 06:17:08 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 42543\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3rb3V2kFL3s%2BJ8WwHfU6aix73qSGTQndBjGjNQgDiPzZrfShBcRft8aHDGVu7KMNtjAO8A2WAm86aIMxT9uXo%2FzMBpxOHOO8ZLJH1mr6hpLJGQ1%2FJjiVRw2s6tFqU%2FWz7IKvUaaT%2FdFoRSMabmNjozQ%3D\"}]}\r\nCF-RAY: a36d8f2b296208bc-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8e1a07947df1e77e8\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":72760,"size_decoded":73673,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f3567ecc873ade2418801f0f5a4a755f","sha1":"e8fc02b34bd284bdffb53faea4cf595658b0313c","sha256":"4b1a175ed7a2578bee0892a9483844a11bd86070caf612d6714d961747b38420","sha512":"857339772b7cd720df654fc85ac26d103e6cb1ef75e2e1b3dd377b6403b34112dd44a07521fdcd476bdb0b657c3525cb25796ad3ae24a8820ef947c6718d9c44","ssdeep":"1536:GqiacLi4hDdd3WrRvp1BtjWbzMEws521D5kBTVhe3w/PKgXJcuSOe:G71L7hgrhXBtjgzMEF5A+VkEPhNe","tlshash":"0b6302ccd2cc9aa0c4a46cd7f4057b38a962b589664f997303e2e387cac4bd917171bd","first_seen":"2026-04-24T23:10:16.730515Z","last_seen":"2026-09-07T08:08:08.443737Z","times_seen":1050,"resource_available":false,"data":null}},"time_used":3976,"timings":{"blocked":3656,"dns":0,"connect":0,"send":0,"wait":302,"receive":18,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_ad0ed5ff-8fa0-4231-a619-ce0616ad2a8d.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.627Z","timestamp":1788741144627,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_ad0ed5ff-8fa0-4231-a619-ce0616ad2a8d.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/webp\r\nContent-Length: 43980\r\nConnection: keep-alive\r\netag: \"fe9109b6cf4f5478cc8e8fa2df5009fe\"\r\nLast-Modified: Sat, 06 Dec 2025 06:22:15 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 31023\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hy%2BdOf32cyACGzofF%2BOMcBJ1APIwGH7Nl2bmErQ3wckbquDUB2OUNjeLHaExqokF6RkzkHgHWoIhiMDkIyfm2fWYHBLs%2F5NlspYhd%2FEs8u5xkrquR17rHlyL0swCUEqlNXxXjnTFIEcVzdNO5ytSeP4%3D\"}]}\r\nCF-RAY: a36ea870de3b7be4-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c911a07947e2bf7f4b\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":43980,"size_decoded":44891,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"fe9109b6cf4f5478cc8e8fa2df5009fe","sha1":"c379459affae382d1bb8ebcc637a880c0ccc284f","sha256":"8a0f41c270d457f16992ae4d9cfdacaf31bc2e03526f377b557111ceb90bc056","sha512":"4d95fa57a6e2175f2e11a07e15ef45187a3d5e44ad567ec4634bdf5e35c37e1c88026663fdd6a583cf0e1d665f0fe8d12cbaa535af6189cb88977228ffd3c5ab","ssdeep":"768:mD/LEFkjJ0uG775vp9Y25iMxn46PWKhqrJ0bAbhtI0iSRXbs6nuxV8fnxO:mDD9jJ0p9J5iKnQKEriAbhtgcbspx","tlshash":"4c13f180b6ebb93680296123673378eef9c47a6fff44872aff82464699133743119d15","first_seen":"2026-04-24T23:10:16.768892Z","last_seen":"2026-09-07T08:08:08.263279Z","times_seen":1034,"resource_available":false,"data":null}},"time_used":4949,"timings":{"blocked":4590,"dns":0,"connect":0,"send":0,"wait":314,"receive":45,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/chunk-svg.1781011881923.7ca9cdc1.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:19.389Z","timestamp":1788741139389,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /js/chunk-svg.1781011881923.7ca9cdc1.js HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:20 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-72eeb\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c901a07947bebf878a\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":470763,"size_decoded":89835,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65532), with no line terminators","md5":"2e885a50d7dc711be337a96fe33f0c2e","sha1":"8c767dd1bdcbf35f2577bd215ff6fe495cbd0f43","sha256":"603d14d58a247671742688b96c517d62e9c636443b960bc421af5352df4c01f7","sha512":"09289e06b0db84915693f0b78ab40149972b29693d0d6b1e66e4fbe9bddf00380f5f4e8e78961512d91a132226494572994ceade62d3d8a878126fdcdeb8fd95","ssdeep":"3072:/8nz2uaLZSZvx6Q/sIPrekK+mB6Ua94sRZI7gbpF/:/8nz2uasNxpXPrekK+mB6UHsE4pF/","tlshash":"c0a4fcb4c190f4edf704ce196e7c9e1c50321688e0a9e9e52da9fe0d9e85d6b241cdec","first_seen":"2026-06-12T19:29:57.244213Z","last_seen":"2026-09-07T08:08:08.174729Z","times_seen":1243,"resource_available":true,"data":null}},"time_used":1758,"timings":{"blocked":616,"dns":0,"connect":0,"send":0,"wait":516,"receive":626,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/83876.1781011881923.7ce40e6b.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:19.400Z","timestamp":1788741139400,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /js/83876.1781011881923.7ce40e6b.js HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:21 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-4007d\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c921a07947c26383e8\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":262269,"size_decoded":77694,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"abf84df30621edc23a82d05ff0b8a83a","sha1":"e727ad94ce5d5f5b8fabec0e0b5a966fb6e6594f","sha256":"c3b02d056ac034939c3ff75a10a2da23f5f05f96a36ca1e5cea2157ce0fe12be","sha512":"db2a2a00f51cc6f75cfcbb6d988df74403fae93255982a054710e5f87a2d8407f4f8f02fef8ef1a0e5edb289736296b2d11a3b77cad6c6d9089bb831cda45be5","ssdeep":"6144:0/rOTU2/xB0Jjytg7DiQPkcsz1aL3p2YO+WidjHrrL:0iUjytgPJPT3p2YpHrrL","tlshash":"2f442c44b291f0b8879b42f7922b4056a17f48a1308cacb4f265f990be7555c927fbfc","first_seen":"2026-06-12T19:29:57.272405Z","last_seen":"2026-09-07T08:08:08.234968Z","times_seen":1229,"resource_available":true,"data":null}},"time_used":2218,"timings":{"blocked":1554,"dns":0,"connect":0,"send":0,"wait":394,"receive":270,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/css/83749.1781011881923.2e202a68.css","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.577Z","timestamp":1788741142577,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /css/83749.1781011881923.2e202a68.css HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:22 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-6f2f\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8f1a07947c906787e\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28463,"size_decoded":6092,"mime_type":"text/css","magic":"ASCII text, with very long lines (28463), with no line terminators","md5":"1ead8072763d5fe20963f033dc63d94e","sha1":"36eeb0853a1b5681ab464dc1ef3682160e420e60","sha256":"8f014d5d9b2798ecfc473bac7c23f80295b94af3cbeff054fcaf973b286f8240","sha512":"92670a870b9db4259e71072ab72699e3431fa9eb53027f4b90c954b51eaf1869f5f50987808e5c625e9101ea4ea3aca655b81ba73f3ba2ced4cd480eb9a915cc","ssdeep":"384:DYCKpsUIc1F8l1TANI34yQyqPPQwmfzIfRbHx6+OhCcbakzeYaTONdqdK:DYCKpcPE64yDqbodqdK","tlshash":"07d2739ae5d4b13e6c1fbb35ebc5a1ecb1399450df620e7af202762547c3af1012216d","first_seen":"2026-04-29T03:41:13.425526Z","last_seen":"2026-09-07T08:08:08.35341Z","times_seen":1576,"resource_available":false,"data":null}},"time_used":475,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":475,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/85dd026da55b44e0afd6ee20e79b7085?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.373Z","timestamp":1788741144373,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/85dd026da55b44e0afd6ee20e79b7085?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:25 GMT\r\nContent-Type: image/png\r\nContent-Length: 143747\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 5521\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"85dd026da55b44e0afd6ee20e79b7085\"; filename*=utf-8''85dd026da55b44e0afd6ee20e79b7085\r\nContent-Md5: cfBGXRkAR25Kzv/ehMDqmQ==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FiKLqAvcAB9TEyn4wanekIoNzdwB\"\r\nLast-Modified: Sat, 05 Sep 2026 04:52:42 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: 6cV9XOUCI\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: 4SUAAABIRNGS3dIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":143747,"size_decoded":144503,"mime_type":"image/png","magic":"PNG image data, 450 x 450, 8-bit/color RGBA, non-interlaced","md5":"71f0465d1900476e4aceffde84c0ea99","sha1":"228ba80bdc001f531329f8c1a9de908a0dcddc01","sha256":"e489b8901e6e721bbafaf984fca1fe57cdcbf95426b1358434c705c6752b0320","sha512":"8823acd124f909e62cb2ccd9dbd8436342652caf211cbcd6de105255fddb55ba53b9619b11b2930df71ebbfe293ca239fa06547dbe90370407b8a0072aff69d9","ssdeep":"3072:Nlg5p7TUIAuXtCsjbj0LHVMEDyrUDzaLmr3pIydtGVy:NS5hTBAudCsjaihEaL+iyd+y","tlshash":"5ce31248bce1f58ac999f93a6c4814c15783a37bee647d107a1d9199cf1cfc82d34e12","first_seen":"2025-08-19T10:44:12.604438Z","last_seen":"2026-09-07T00:33:21.852807Z","times_seen":45,"resource_available":false,"data":null}},"time_used":2002,"timings":{"blocked":-1,"dns":261,"connect":240,"send":0,"wait":319,"receive":698,"ssl":484},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/950da1c9aed6462e84a89948f080cb87?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.407Z","timestamp":1788741144407,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/950da1c9aed6462e84a89948f080cb87?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:27 GMT\r\nContent-Type: image/png\r\nContent-Length: 59590\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 32542\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"950da1c9aed6462e84a89948f080cb87\"; filename*=utf-8''950da1c9aed6462e84a89948f080cb87\r\nContent-Md5: 9bmu0PxCi031BqieuuhMbQ==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FsGLuG-LLnxqWUyDDrU2_SdGiRrU\"\r\nLast-Modified: Mon, 31 Aug 2026 19:03:15 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: T8OTBcQjj\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: NCwAAAC-ltX_xNIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59590,"size_decoded":60346,"mime_type":"image/png","magic":"PNG image data, 180 x 204, 8-bit/color RGBA, non-interlaced","md5":"f5b9aed0fc428b4df506a89ebae84c6d","sha1":"c18bb86f8b2e7c6a594c830eb536fd2746891ad4","sha256":"d4037bbbfafe5baf8eff9e99c8b218ecd0693f0fb0fc6148e70d82e4699983f9","sha512":"53674f0a3aef146370e6f2148cfc5779f1056a2e12139d391444967a0f97098a0fb54478f0ffdaa35eb47bee0a2f89ac2680f68f398d2ece7623326534fef6c3","ssdeep":"1536:zfrXicQ6KJo4aJoltSFv2vf8YvbgIbDbny/HWu5j9:zDXicSIJCSd2vf8ubDbyHWGh","tlshash":"a843019108aa2c5eabf3b006437db2d92a2ef0acfbe04d5f05b1ba1c220d57cfd54195","first_seen":"2026-08-23T15:23:20.434895Z","last_seen":"2026-09-07T08:08:08.325454Z","times_seen":30,"resource_available":false,"data":null}},"time_used":3562,"timings":{"blocked":3236,"dns":0,"connect":0,"send":0,"wait":266,"receive":60,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/9f4ab708b0014b09894d56ab1e19e664?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.412Z","timestamp":1788741144412,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/9f4ab708b0014b09894d56ab1e19e664?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/png\r\nContent-Length: 30412\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 31642\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"9f4ab708b0014b09894d56ab1e19e664\"; filename*=utf-8''9f4ab708b0014b09894d56ab1e19e664\r\nContent-Md5: i1XSpuUIoazI2xlFQNE5zw==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fv6Fo3rSC1ZKoNSehRItBlLS2mv9\"\r\nLast-Modified: Mon, 31 Aug 2026 19:03:18 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: e8rrc8pyL\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: zVwAAABnps3RxdIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":30412,"size_decoded":31168,"mime_type":"image/png","magic":"PNG image data, 125 x 125, 8-bit/color RGBA, non-interlaced","md5":"8b55d2a6e508a1acc8db194540d139cf","sha1":"fe85a37ad20b564aa0d49e85122d0652d2da6bfd","sha256":"7f89f4cb5cbf75ba8f65ec754865f6fac5d61fb48d77fb7e1a3bec993e58d0b9","sha512":"6ab85624b1bacc0cec0512a3205677a97e619f3c117ee1d0f56a1a6883bd85e1a863e6dea540a1acb2fad3716f38cb146d558f3a553addc708365fa4a012fce4","ssdeep":"768:CTHbPfjVzTuBkuA4vbkSIWjAdoXP5iuCHom5Ub:CP7Vz7uBbF5AdoBTC9Sb","tlshash":"9fd2f1d1e0fcfd0a53f61185620f83df6980c6d526de11a1abb67a8d4898dcd60237b8","first_seen":"2025-06-24T17:27:40.329713Z","last_seen":"2026-09-07T08:08:08.18758Z","times_seen":90,"resource_available":false,"data":null}},"time_used":3862,"timings":{"blocked":3594,"dns":0,"connect":0,"send":0,"wait":252,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/c6031c0bcc5d463aa365914fcf0b489d?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.438Z","timestamp":1788741144438,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/c6031c0bcc5d463aa365914fcf0b489d?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/png\r\nContent-Length: 8771\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 27129\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"c6031c0bcc5d463aa365914fcf0b489d\"; filename*=utf-8''c6031c0bcc5d463aa365914fcf0b489d\r\nContent-Md5: c/1n8e5ni/e+S71xI0C5FQ==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FofVw-Kdvo9gqFKinwWGERmQRIjR\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:48 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: F36xAaqfq\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: DscAAADB9pjsydIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8771,"size_decoded":9526,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"73fd67f1ee678bf7be4bbd712340b915","sha1":"87d5c3e29dbe8f60a852a29f05861119904488d1","sha256":"5432b0d05a596054b3b577706a58884f705d5af88b8104b66c87d112866810ab","sha512":"e919d2216bbc5d0e0833bad11dc4173cf84720e4bfa5bc0cebccdb2123cea1072398c5d9eef384ee7241fafb9d4d8b50df5457d9d74daf67a1dd3e1ede628d55","ssdeep":"192:qXYaI7gAOJGqNSipwZxjqsLXrCmZOV6w59jdowVoKxJ9ac:qXnAOcOSrzeuOV6w9pojKFac","tlshash":"42029e22ca22f598a644356be746ca28e1d3016c6e40daa257b3d9f45ca44e2c4fc4f6","first_seen":"2023-08-17T12:39:31Z","last_seen":"2026-09-07T08:08:08.150489Z","times_seen":91,"resource_available":false,"data":null}},"time_used":5187,"timings":{"blocked":4940,"dns":0,"connect":0,"send":0,"wait":247,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/c4b0475c7ee9448aacc5ccf978bad174?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.505Z","timestamp":1788741144505,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/c4b0475c7ee9448aacc5ccf978bad174?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:33 GMT\r\nContent-Type: image/png\r\nContent-Length: 141834\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 1947\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"c4b0475c7ee9448aacc5ccf978bad174\"; filename*=utf-8''c4b0475c7ee9448aacc5ccf978bad174\r\nContent-Md5: kCFRZmr+O7RToWsdV+XE5w==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fm5yjyjz7FR2ip9Ne5tMygeohUGA\"\r\nLast-Modified: Mon, 31 Aug 2026 18:51:41 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: aXw79Qc1P\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: MEsAAABP6d_U4NIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":141834,"size_decoded":142590,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"902151666afe3bb453a16b1d57e5c4e7","sha1":"6e728f28f3ec54768a9f4d7b9b4cca07a8854180","sha256":"1fc3b28a190d4bde111183fc706f42131819d5121190b57a273cee75cf78cfdb","sha512":"3018716d81ae6e12bb7644b41b46c8ee2604745d46ace127fc6b36fefdf1e2dfd2c1163f857254f0f41d1fd9bbbaf4543dea3567eb87363aef1d08332f1c99d6","ssdeep":"3072:aC4vucs051MWhovvfmV69ifHL6Moa2WfTVEXLJUfQM9YRUtd2I4pKnY:aC21M2Ox4HLIEfBEXLJUYMiu2I4pKnY","tlshash":"dad31262607f8d008b58009749fdb972ce53e139d676f67a6b090d4efe83ed43920a5e","first_seen":"2025-05-09T00:23:54.104535Z","last_seen":"2026-09-07T08:08:08.179116Z","times_seen":136,"resource_available":false,"data":null}},"time_used":8738,"timings":{"blocked":8387,"dns":0,"connect":0,"send":0,"wait":267,"receive":84,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/assets/logo/favicon.ico","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.288Z","timestamp":1788741142288,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /assets/logo/favicon.ico HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:22 GMT\r\nContent-Type: image/x-icon\r\nContent-Length: 585615\r\nConnection: keep-alive\r\nLast-Modified: Wed, 01 Apr 2026 05:40:09 GMT\r\nETag: \"69ccafb9-8ef8f\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8e1a07947c83277dc\r\nX-Cache-Status: BYPASS\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":585615,"size_decoded":586069,"mime_type":"image/x-icon","magic":"PNG image data, 1024 x 1024, 8-bit/color RGBA, non-interlaced","md5":"abd1eb812e495d993fb310ca906ea605","sha1":"77a61cd2ad4a89c22f4a979571d3c259870732f5","sha256":"ccd41d39ff7fbed7a9200f685d9b0198736d1a2f737e9d32f83ddaeef39a4180","sha512":"e8221a9acda08a0a0bc5410cd14bc72d30e6fa66cc6e7a4bc07b53f5c94b5ec670f19571246ab2f55ec2924f679543780e9f55e0ecf8a169ce3b91e38da07d25","ssdeep":"12288:zObp4IC0/qFNYge/0z5g2c+UTxVi1+4g+/F5:ibpa2qFNNe8zy+si1+4V/F5","tlshash":"e8c4230df5a39834d5dc996741db54e0c790e4183db25e323ba3448ea3d05b8ea267f7","first_seen":"2026-03-20T12:57:26.707036Z","last_seen":"2026-09-08T23:44:55.152457Z","times_seen":1646,"resource_available":false,"data":null}},"time_used":1260,"timings":{"blocked":100,"dns":0,"connect":0,"send":0,"wait":448,"receive":712,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/img/appdown.6e7c9177.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.680Z","timestamp":1788741142680,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /img/appdown.6e7c9177.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://g36b.top/css/index-399e2569.1781011881923.a7b0b4f4.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:24 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-277f\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nAge: 43143\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c921a07947cfff83ec\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10111,"size_decoded":10629,"mime_type":"image/png","magic":"PNG image data, 112 x 112, 8-bit/color RGBA, non-interlaced","md5":"716d097b193628397635cfac41b561fa","sha1":"545d1876219bed15fe850a499a08322de6a26866","sha256":"50276d87fae9c1e30a32c32b4e90dcc2e227cabb4e3bb1d60ecb22fb50c5f2ff","sha512":"47ea5928e921bec4ce4d9c807ee921f6115a6dd27af6fa7325e6d988058d22cf36c03693ebc56665203809cfd6d008cd410380e688e90b36d7eeec18ce6aa92f","ssdeep":"192:cALsiDRih/bWKl4Hq2BHZE6+3paMeCsuTvB6hi6tswYmd:lBEv2Hq2BHS1ZaMJtB+tsud","tlshash":"4622d047a584327b826ec79c8fe98c112470ad1ce6f04d5ac44e711128e8df3503baf2","first_seen":"2023-07-01T07:21:14Z","last_seen":"2026-09-07T08:08:08.247567Z","times_seen":2686,"resource_available":false,"data":null}},"time_used":2070,"timings":{"blocked":1764,"dns":0,"connect":0,"send":0,"wait":306,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1884x434_f0600e57-43d6-4af4-8f1c-08ad10ecab8d.jpg","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.027Z","timestamp":1788741144027,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1884x434_f0600e57-43d6-4af4-8f1c-08ad10ecab8d.jpg HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:24 GMT\r\nContent-Type: image/webp\r\nContent-Length: 35520\r\nConnection: keep-alive\r\netag: \"cd3987864cb3f095323f43e0248e2180\"\r\nLast-Modified: Wed, 10 Dec 2025 10:48:07 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 48486\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rPrRPUwT5%2Bj70mc9CaQH4MAIa4259kEMsFDoEXLeXg6%2BVF7lZF0twDfs5x8X6NAYhqmonpoo9QhAhubohPALbmzi6sRZrm3m5BmlQsb1eTb03cCMJ27IiaEXyOVVSvaj8p3dxbsWnAv5AQimOXr4hN0%3D\"}]}\r\nCF-RAY: a36cfdfe2937ddbc-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c911a07947ce5a7f40\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":35520,"size_decoded":36427,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1884x434, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"cd3987864cb3f095323f43e0248e2180","sha1":"57b2593c8fb12efd02723c4297cc32c426e77017","sha256":"f86c999282c8cc66a7a94042d0d117be0e025906c4bd5647298e312a2c309ca9","sha512":"ba70094c63b1d4360f2ade43b4a26c9b412fe366e805223c019a6b1418e656067f54a94daf0eed2e9fac0fce3623ef9c0dac9cf092d6503388d9400146a25f25","ssdeep":"768:S4wSvosDYmjc1AHEBOLMSkdFqvZa6Hfj/9q3uTOdbXjzZBniHc9QjK:SytDYAkByMZPqvg6Hfj/9FTSXjfiH0Qe","tlshash":"bcf2f20a3c565b1f01ff3414b7028a68004b264c603face2cd99b8ce5dbf94d859e556","first_seen":"2026-04-24T23:10:16.816486Z","last_seen":"2026-09-08T23:44:55.079479Z","times_seen":1419,"resource_available":false,"data":null}},"time_used":350,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":315,"receive":35,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/77be09f47b3b4cb3841732f4a4ead579?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.414Z","timestamp":1788741144414,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/77be09f47b3b4cb3841732f4a4ead579?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/png\r\nContent-Length: 59283\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 30442\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"77be09f47b3b4cb3841732f4a4ead579\"; filename*=utf-8''77be09f47b3b4cb3841732f4a4ead579\r\nContent-Md5: E7d2XiAAyES+GGg2YmQ45w==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FtI4E-fQwcLccWdOJhvNn5sna6BK\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:35 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: nkMAwMZR8\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: D1wAAAAFcwXpxtIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59283,"size_decoded":60039,"mime_type":"image/png","magic":"PNG image data, 496 x 503, 8-bit/color RGBA, non-interlaced","md5":"13b7765e2000c844be186836626438e7","sha1":"d23813e7d0c1c2dc71674e261bcd9f9b276ba04a","sha256":"b2b41bb859ecf781b36c52ec292b4d334abc50e112dfe82157885633c748954a","sha512":"0ebbb1cc83245363352ee28e6efd3cac92a733f1230b8a13d5416f47d69e69195aa4aeab9b6b5142743e167042612cc1bff5700b40fc34ab0e872de6b06a9a54","ssdeep":"1536:b9o12vPZB+74JEHnbOjTAyjNFZrmKbbj1feXDTwdM9+uo2C2:ey4G6bsTTjNjrmQfeXDMy9p+2","tlshash":"1443f221de5aa95b1e6f43c2157d09ccfa11a612bba07ad091d69cce0ecc9021bf5cde","first_seen":"2025-08-19T10:44:12.515558Z","last_seen":"2026-09-07T08:08:08.394585Z","times_seen":26,"resource_available":false,"data":null}},"time_used":3990,"timings":{"blocked":3662,"dns":0,"connect":0,"send":0,"wait":268,"receive":60,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/d284e87d63d047ddb2a1c029d1ab74ba?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.493Z","timestamp":1788741144493,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/d284e87d63d047ddb2a1c029d1ab74ba?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:32 GMT\r\nContent-Type: image/png\r\nContent-Length: 219629\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 16348\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"d284e87d63d047ddb2a1c029d1ab74ba\"; filename*=utf-8''d284e87d63d047ddb2a1c029d1ab74ba\r\nContent-Md5: JBYJIdnvmw++rwfi8RHoWA==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FhZD5fokJC1nnBxec_s-Bcp-llQm\"\r\nLast-Modified: Mon, 31 Aug 2026 18:52:00 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: hcme32cQM\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: Yz8AAABY9qq709IY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":219629,"size_decoded":220386,"mime_type":"image/png","magic":"PNG image data, 1200 x 1500, 8-bit/color RGBA, non-interlaced","md5":"24160921d9ef9b0fbeaf07e2f111e858","sha1":"1643e5fa24242d679c1c5e73fb3e05ca7e965426","sha256":"bc121391f92ed6cbb4e1127184ee032aa80537b6fd4f2782c028690bb48d1671","sha512":"0ad3544a9f257b95e6631eec13ca26f3bf201c50ace6f02d579b038384c451c0612388b3f292bf9ac626f2a5cc0b5e9054b56b295cb1a020ce4e66d5114b3dbc","ssdeep":"6144:1jRqZZr6tmDXN52n4lGPHE6HiINFHhEBJwJJ8+8bkxsu:d4Zl6YDXDis6HiUBEBRjO","tlshash":"892412c1a8ffc0f3ff4b5918b5709a54a454840b65d4e8efeca6c67cd824f4da218b68","first_seen":"2026-07-24T04:32:26.332561Z","last_seen":"2026-09-07T08:08:08.271279Z","times_seen":29,"resource_available":false,"data":null}},"time_used":8273,"timings":{"blocked":7826,"dns":0,"connect":0,"send":0,"wait":252,"receive":195,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_13f1f273-ad7d-4854-b9a3-7f3eb8823296.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.631Z","timestamp":1788741144631,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_13f1f273-ad7d-4854-b9a3-7f3eb8823296.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/webp\r\nContent-Length: 78902\r\nConnection: keep-alive\r\netag: \"5cae9008e22ccc62c09f38e52e664de6\"\r\nLast-Modified: Wed, 10 Dec 2025 11:49:58 GMT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BRt06llp9PTNpRdUC5LT%2BL7dnTAWsuKHYENmjCdKMijiBgQQYb684wGDKiyE%2FtF7eC%2F1bFvFUrqrEFdlADF8LAJ7lrOfL2%2B6USVe04dVenAWnAvMsn3zDKmxgUf2imbBJD5w4%2Ff2AXHqyP%2BUQW8s3pk%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 42530\r\ncf-cache-status: HIT\r\nCF-RAY: a36d8f82f91c0474-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8e1a07947e3fb77ec\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":78902,"size_decoded":79819,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"5cae9008e22ccc62c09f38e52e664de6","sha1":"a1f17e80566874fe9706d17a46a2d46f82bb4334","sha256":"3148a6d8c30b8b20d81c8e0873dc24170d6be114b7e3570870da05e12202d770","sha512":"49b2777a4621bd265be1b02773561be3504f5d1dd0c104f8ddd0781e36791a1f12be3093743baa2a7d21c70766e76f7d5d475efe312d725a1959acf4a1625551","ssdeep":"1536:blYjfVyd06MgAmxW/kYHFfuwKFhzwOxl3juR+GfDIroclZ:bc606u75s1wMGlfTclZ","tlshash":"5673012aa243088ae0f71039184a6be7f90d11a1e7e85fef84e7570bbe0df413d65e50","first_seen":"2026-04-24T23:10:16.877965Z","last_seen":"2026-09-08T23:44:55.198595Z","times_seen":1041,"resource_available":false,"data":null}},"time_used":5221,"timings":{"blocked":4899,"dns":0,"connect":0,"send":0,"wait":304,"receive":18,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/img/license.ea57c78d.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.681Z","timestamp":1788741142681,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /img/license.ea57c78d.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:24 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-7b8\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nAge: 34400\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c911a07947d0207f41\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1976,"size_decoded":2488,"mime_type":"image/png","magic":"PNG image data, 161 x 52, 4-bit colormap, non-interlaced","md5":"60a2c7c150b01809fbb7b97932684b5b","sha1":"67fc9647c452a17b519c6a51dc8c38daa23755f9","sha256":"c5ce31558a1f979ae78c7779d2f312b196750375541e9c147b73d6e44d47c276","sha512":"2328442fa1c74e47c6eff4adab55920c7e7738e7ae51bd2b222fb696bbcf8201a14805089a33baa80c28a40db47061048d817c384bd72735b2e0c0116ff63c6f","ssdeep":"","tlshash":"b3412a6266729beced1a8c47592c7df1d8338ca1a200e1c150ed761f1bf8e1060e7a94","first_seen":"2025-08-29T11:05:53.23289Z","last_seen":"2026-09-07T08:08:08.18615Z","times_seen":2616,"resource_available":false,"data":null}},"time_used":2092,"timings":{"blocked":1797,"dns":0,"connect":0,"send":0,"wait":295,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/ab402a4ac9c24d1fa294cf5bb0d304b1?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.391Z","timestamp":1788741144391,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/ab402a4ac9c24d1fa294cf5bb0d304b1?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:26 GMT\r\nContent-Type: image/png\r\nContent-Length: 15398\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 37920\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"ab402a4ac9c24d1fa294cf5bb0d304b1\"; filename*=utf-8''ab402a4ac9c24d1fa294cf5bb0d304b1\r\nContent-Md5: k0o6Oklfqd5lxNrV/qtKOQ==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FvHNRNetcSrHQdr5emhDr4ZsQqru\"\r\nLast-Modified: Mon, 31 Aug 2026 19:02:52 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: g4NmsUvai\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: C90AAABdDYcbwNIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":15398,"size_decoded":16154,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"934a3a3a495fa9de65c4dad5feab4a39","sha1":"f1cd44d7ad712ac741daf97a6843af866c42aaee","sha256":"0f68dc8e3505f18d91a837c1faf37748e7f30a90246964df73ee82d03abffed3","sha512":"f0e9e90d90d3274e5a2e76eb375b346418880f219fcbae0947407947db3544bf94d6edf0089b65c0a83e7a716cdc0eb410baaba26e24aac2e61f790274a97d64","ssdeep":"384:SgmoCPd59MyfavbQ5f6Fpqgs7XKRGiSyqJigNK36npCKYU:Nrado+f5iXs+XSnip6npiU","tlshash":"fc62c063535b1b570b1dbe4e4d26242b9818bd8ca5450b1c83627eec9e6b181b2ff1ca","first_seen":"2025-03-28T18:20:50.087114Z","last_seen":"2026-09-07T08:08:08.202059Z","times_seen":69,"resource_available":false,"data":null}},"time_used":2640,"timings":{"blocked":2386,"dns":0,"connect":0,"send":0,"wait":254,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/5637ccae78784162a88d410d0f63be34?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.399Z","timestamp":1788741144399,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /img/fb/team/5637ccae78784162a88d410d0f63be34?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-09T05:47:36.08732Z","times_seen":18359622,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/abe8ba5a1b654166bf57e786d95036ad?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.445Z","timestamp":1788741144445,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/abe8ba5a1b654166bf57e786d95036ad?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/png\r\nContent-Length: 53921\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 27128\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"abe8ba5a1b654166bf57e786d95036ad\"; filename*=utf-8''abe8ba5a1b654166bf57e786d95036ad\r\nContent-Md5: +JasJTwZAIrqv7ScPvBE2w==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FgCoLTBCcWpyRkVPSQQHlNS5nqb7\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:53 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: oZJqf1Abt\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: tAEAAADPKdTsydIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":53921,"size_decoded":54677,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"f896ac253c19008aeabfb49c3ef044db","sha1":"00a82d3042716a7246454f49040794d4b99ea6fb","sha256":"f1b7cf5e94f7a4da1d272f64784966931286e999e3c1afd8933dfb6a35e1c0d6","sha512":"e6fb7249e9dcee9ab8ff109f21ba19d3b4a0e8857a46e90ce91caefd89c84c5ef5ff772d1ccd960dcb56151bf701e464dedb5707fe24b2fa28c85e7e7f5f008e","ssdeep":"1536:pwpfYRYsWN4uVjUv5NhiwWq0Z2o/xPO993:pwpfY+sUtUvNi/qs5P0","tlshash":"b533f173129e7fc147edf1216da1f6cbb4e26582831b2c9acbc583c95e19c8d4f29468","first_seen":"2026-08-09T01:57:58.526445Z","last_seen":"2026-09-07T08:08:08.293311Z","times_seen":43,"resource_available":false,"data":null}},"time_used":5653,"timings":{"blocked":5318,"dns":0,"connect":0,"send":0,"wait":277,"receive":58,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/img/home-bg.1e09954b.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.510Z","timestamp":1788741144510,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /img/home-bg.1e09954b.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://g36b.top/css/home.1781011881923.38488e2a.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:26 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:10 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281706-fae\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nAge: 48510\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8e1a07947d61477e1\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4014,"size_decoded":4526,"mime_type":"image/png","magic":"PNG image data, 278 x 80, 8-bit colormap, non-interlaced","md5":"ed0eb6c81f949885511fbbe4d666a2f0","sha1":"d74fb98c3b01727753bb182eb5ee5d6eedf3da4a","sha256":"7fecf4ed61ab1535aafe2800474ac643b49264b83f54fc1da596d7334868ae75","sha512":"dd2f749e24e6b35f80fa77856c9c8b1cb1e0cacb9250b947403283e152d8bb9e7bf539df00ca6743d4162aeac014e47ce82191b62847fabe6cbb5693b4cd7fec","ssdeep":"","tlshash":"1a816c7eb31a4997296ff194138b387d74b0709d0b546934388a9c31a4791fcf39e526","first_seen":"2025-08-29T11:05:53.155399Z","last_seen":"2026-09-08T23:44:55.123028Z","times_seen":2447,"resource_available":false,"data":null}},"time_used":1716,"timings":{"blocked":1418,"dns":0,"connect":0,"send":0,"wait":298,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_9986c108-3fd7-4f35-9443-f78ce32e1660.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.645Z","timestamp":1788741144645,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x442_9986c108-3fd7-4f35-9443-f78ce32e1660.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:24 GMT\r\nContent-Type: image/webp\r\nContent-Length: 15914\r\nConnection: keep-alive\r\netag: \"d455ee7db25284552aeaae58bb713429\"\r\nLast-Modified: Tue, 02 Dec 2025 14:11:43 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 42516\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6ERxAsjPR3QZ%2BegTNL1B1adKFNC%2BQLLMeFvmGMMQAeHAy7Xs2o8egWj6pneYnOJvtoXJamszwZ0jnWaffxHLR%2FD3M1liOKzD9En3yHrhNVSMkNfdRFLcorHtYBxxqXxMaP66%2FUaKaagzoXOuM5qtJ64%3D\"}]}\r\nCF-RAY: a36d8fbdfd7c08b3-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c941a07947d0c48268\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":15914,"size_decoded":16825,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d455ee7db25284552aeaae58bb713429","sha1":"22ea59f69e3ce33cb693d6ab7cde1f4f64bbe6b6","sha256":"20c558fe862164c2d2636a0b3aa259515f5175835dd461e5c16689338ba39413","sha512":"bc5147cbcf7ebb167eb2a75a56c140a33d81616f014f44c4976eff4525f665957e33e6d46f946d873016140af260808658915299a2004c2964be1543126a00b2","ssdeep":"384:POdbE1lYVo0UOKUjQgxN5voCgMMZUN3GcHHZUX3650gyyY44oDMWQ:P4+6+0URmQ+OMMZUNnnZUX6jyJPoD","tlshash":"8b62b051fa2b34398ea119feefcd1d195804ce608a3e6d6a6f3cd20d96b450ec46ed05","first_seen":"2026-04-24T23:10:16.815124Z","last_seen":"2026-09-07T08:08:08.180568Z","times_seen":1187,"resource_available":false,"data":null}},"time_used":353,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":353,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/45540.1781011881923.25dfba7d.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:19.397Z","timestamp":1788741139397,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /js/45540.1781011881923.25dfba7d.js HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:20 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-37ff6\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c911a07947c1367f38\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":229366,"size_decoded":65622,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"7983a109fba451279f84fe7b75724983","sha1":"9487dc955240c6083cf3497e806dff89bec2061f","sha256":"80bb5c781336a9095ee3e8ae99d724f58a409c7f3c159bf0f320a9c948afe030","sha512":"ddf49f5cfb4721100ef951228391607209e248a8733d48229ff5196fd8a32fc3e759d90c1040dd591b1c0bd97ab83a1c8baaffa70fa96bbe2d556af2379478b0","ssdeep":"6144:1YD4wFsYiSGfKnCKPP6Xm9sm3MCln1OSgpozfEe5a:1YD4wFsYiSAKNH3TY5","tlshash":"e724f894f294f1be075fc1f1d23b501af35b5e6120cc9ca0d296e6942e20b49da77eac","first_seen":"2026-06-12T19:29:57.328205Z","last_seen":"2026-09-07T08:08:08.223991Z","times_seen":1237,"resource_available":true,"data":null}},"time_used":1696,"timings":{"blocked":1254,"dns":0,"connect":0,"send":0,"wait":333,"receive":109,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/ad78ac9e100b4a97a2251a914edeff2f?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.473Z","timestamp":1788741144473,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/ad78ac9e100b4a97a2251a914edeff2f?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:31 GMT\r\nContent-Type: image/png\r\nContent-Length: 11434\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 23548\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"ad78ac9e100b4a97a2251a914edeff2f\"; filename*=utf-8''ad78ac9e100b4a97a2251a914edeff2f\r\nContent-Md5: 6wJaD7anFYYg//+L2oVwOQ==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FjPZOv-IoGBC-q64o9GR4PH2R1sK\"\r\nLast-Modified: Sun, 30 Aug 2026 18:47:51 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: 7nleZheXM\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: A0sAAADS_twuzdIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11434,"size_decoded":12190,"mime_type":"image/png","magic":"PNG image data, 104 x 104, 8-bit/color RGBA, non-interlaced","md5":"eb025a0fb6a7158620ffff8bda857039","sha1":"33d93aff88a06042faaeb8a3d191e0f1f6475b0a","sha256":"7d85d033f6e255df7060607e67c60029ea2d1d877e8385b166b84a8f46306dad","sha512":"e8f6f98be06e4c0f2c32768618bdefea4a608541d5c3f10ad5359bccf0599f73eccaca40c396613608833da3fda4465de42cc2ce53f391b7915aa2bbe7f66ec2","ssdeep":"192:AuRyqu8BYkIGfqvtYof8LTtxzLtfcbBZWkRfaIdCK2aKKZyRRi6UCPd+blW29UrI:Uqu8LI+Jof4TtdJElZWufaIZN0zbPd+H","tlshash":"5332c0475d40f0128ae76dfed484262ac893bb9b4d3b6667649c4382033e175ce7da0f","first_seen":"2025-02-26T15:38:27.671597Z","last_seen":"2026-09-07T08:08:08.297507Z","times_seen":86,"resource_available":false,"data":null}},"time_used":7056,"timings":{"blocked":6789,"dns":0,"connect":0,"send":0,"wait":267,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/14d681a85eb444429e6c743d37fde869?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.483Z","timestamp":1788741144483,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/14d681a85eb444429e6c743d37fde869?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:31 GMT\r\nContent-Type: image/png\r\nContent-Length: 105180\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 20838\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"14d681a85eb444429e6c743d37fde869\"; filename*=utf-8''14d681a85eb444429e6c743d37fde869\r\nContent-Md5: PWHopBUJhS8KFW1z0whbmA==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FqDuI9lm0-F3dfnp3A9euty__qG6\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:20 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: KBbLknrHL\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: 9AgAAACuK--lz9IY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":105180,"size_decoded":105937,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"3d61e8a41509852f0a156d73d3085b98","sha1":"a0ee23d966d3e17775f9e9dc0f5ebadcbffea1ba","sha256":"012ad437a2cadc25bec1460f560adaff28752601f07dee662d28154acb441d31","sha512":"5b6e1106c29ab6d63100c9ddd4a49278ae22501581b62b6d17f277690c09041de1ad070edd30f1641f8af9d7e55903f882cf4926d2166ecb4b2c125dca792b2b","ssdeep":"3072:6Q2qlI1eR3Wb4bdsP9qGHArHbt0GYjxEQjmC0By+R:jlM2WMbdEHW5jYj2lCJ+R","tlshash":"15a313d5349f208f11c74894f4571bf6a0bda4a83401bfb1df912db9ae1b70217ac29b","first_seen":"2025-09-27T19:21:32.671484Z","last_seen":"2026-09-07T08:08:08.453724Z","times_seen":258,"resource_available":false,"data":null}},"time_used":7593,"timings":{"blocked":7277,"dns":0,"connect":0,"send":0,"wait":256,"receive":60,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/6d5ab1dcdb124234adbce343aa6b869b?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.376Z","timestamp":1788741144376,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/6d5ab1dcdb124234adbce343aa6b869b?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:25 GMT\r\nContent-Type: image/png\r\nContent-Length: 212005\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 90117\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"6d5ab1dcdb124234adbce343aa6b869b\"; filename*=utf-8''6d5ab1dcdb124234adbce343aa6b869b\r\nContent-Md5: 82IM1rI1ZaAWzwma7IE/vQ==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FjENyVFVeclZYp4GK9rcxvZjZfFN\"\r\nLast-Modified: Mon, 31 Aug 2026 18:52:26 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: kaa7pXMv5\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: YRIAAACOGEKikNIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":212005,"size_decoded":212762,"mime_type":"image/png","magic":"PNG image data, 1000 x 1000, 8-bit/color RGBA, non-interlaced","md5":"f3620cd6b23565a016cf099aec813fbd","sha1":"310dc9515579c959629e062bdadcc6f66365f14d","sha256":"c5cd71a4699a2ffb58caa862e15a82dbf41c3585224598c2ab621ebc2cb57074","sha512":"9019983163b8f0b0b0fa11864f07b191e36a1eea94fe396587eae04f968a9953d3cc4948b062d777c43ad8fd748bb9b36f2a28eaa5eae03db205c675eb4a1534","ssdeep":"3072:dvTNDI3ylhnzGpaKPKm8zAvElbY3LyJGyCOD4fg/VEqXbVcGUvKpg/Ml6O/kJuWt:BxDOWzdq8zAn3OJGrI1mG4KkMl6qDOh","tlshash":"362412dd89ebac2301383c58479c98e771376942e73cb50a599c989784fd3e983b2c5e","first_seen":"2025-09-27T21:37:30.388407Z","last_seen":"2026-09-07T00:33:21.869596Z","times_seen":106,"resource_available":false,"data":null}},"time_used":2196,"timings":{"blocked":1244,"dns":0,"connect":0,"send":0,"wait":317,"receive":635,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/home.1781011881923.a94e73ca.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:21.989Z","timestamp":1788741141989,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /js/home.1781011881923.a94e73ca.js HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:22 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-319eb\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c911a07947c6667f3a\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":203243,"size_decoded":60505,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64174), with no line terminators","md5":"7ad9af47a2c0c93f65e42ff84b45dad7","sha1":"eed3b4bd1191c75416f457ee41317595880f8635","sha256":"c9d64aef33c7a35945a5963b08b2bc3157f403dc91a5c9c9463c82a0d4075af6","sha512":"757a63f9b96bc8a36491424f8e0ae9fd6813983817ab2da87bb3455e18b5cb5f71d5e682919941194e4a588bea925c790888e4d27f8531ee03c777c1e2c92678","ssdeep":"3072:T5daS9tSIMcewi8uJBuoMfqFf2GMkvVJuhxffj7TEOiGRlc:T5ES9tSIMcewiLQqFRmzffjAGHc","tlshash":"93141880b5f0e275575fc2a7d7371025b2271786d0ccac60e1f66b187e2879ab236db8","first_seen":"2026-06-12T19:29:57.277471Z","last_seen":"2026-09-07T08:08:08.456638Z","times_seen":1182,"resource_available":true,"data":null}},"time_used":432,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":334,"receive":98,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/assets/logo/favicon.ico","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.289Z","timestamp":1788741142289,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /assets/logo/favicon.ico HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:22 GMT\r\nContent-Type: image/x-icon\r\nContent-Length: 585615\r\nConnection: keep-alive\r\nLast-Modified: Wed, 01 Apr 2026 05:40:09 GMT\r\nETag: \"69ccafb9-8ef8f\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c921a07947c7f683e9\r\nX-Cache-Status: BYPASS\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":585615,"size_decoded":586069,"mime_type":"image/x-icon","magic":"PNG image data, 1024 x 1024, 8-bit/color RGBA, non-interlaced","md5":"abd1eb812e495d993fb310ca906ea605","sha1":"77a61cd2ad4a89c22f4a979571d3c259870732f5","sha256":"ccd41d39ff7fbed7a9200f685d9b0198736d1a2f737e9d32f83ddaeef39a4180","sha512":"e8221a9acda08a0a0bc5410cd14bc72d30e6fa66cc6e7a4bc07b53f5c94b5ec670f19571246ab2f55ec2924f679543780e9f55e0ecf8a169ce3b91e38da07d25","ssdeep":"12288:zObp4IC0/qFNYge/0z5g2c+UTxVi1+4g+/F5:ibpa2qFNNe8zy+si1+4V/F5","tlshash":"e8c4230df5a39834d5dc996741db54e0c790e4183db25e323ba3448ea3d05b8ea267f7","first_seen":"2026-03-20T12:57:26.707036Z","last_seen":"2026-09-08T23:44:55.152457Z","times_seen":1646,"resource_available":false,"data":null}},"time_used":1258,"timings":{"blocked":99,"dns":0,"connect":0,"send":0,"wait":326,"receive":833,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/42677dd356d647969689068f8bb0bb99?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.409Z","timestamp":1788741144409,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/42677dd356d647969689068f8bb0bb99?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/png\r\nContent-Length: 40837\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 32543\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"42677dd356d647969689068f8bb0bb99\"; filename*=utf-8''42677dd356d647969689068f8bb0bb99\r\nContent-Md5: x0HndjABWSS1ooAG/C1QUw==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FsbPcDfXffx8FpPsJezu-wa4kT-b\"\r\nLast-Modified: Mon, 31 Aug 2026 19:03:17 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: ALW3VhTHq\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: 0F8AAACg5vP_xNIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40837,"size_decoded":41593,"mime_type":"image/png","magic":"PNG image data, 220 x 260, 8-bit/color RGBA, non-interlaced","md5":"c741e77630015924b5a28006fc2d5053","sha1":"c6cf7037d77dfc7c1693ec25eceefb06b8913f9b","sha256":"6eed8e19283dbb6d025f8c3239dcb439490bf9dafa8be7cbd6570c71583d730c","sha512":"95d9b08266b6cbd23f76436e9bab76b7ea1ba9a1103fff65077b7951e13d76e6afb6dc5e2f9c9cffcb8059288052b7a6195ede2376f6cb28676349cf0f063608","ssdeep":"768:Xyg3VRr++ez2ywSY4eOrbxNrxD3bx55X5m5tca2mfMwNNqOrKLfG:iUgz29SumbvBbnt5mworcOrKK","tlshash":"a403f1f7585a1f51e67bd6a729c30facd4531000ce9ef8a46ba62a8f8340713566c7b4","first_seen":"2023-08-24T20:41:53Z","last_seen":"2026-09-07T08:08:08.229538Z","times_seen":30,"resource_available":false,"data":null}},"time_used":3695,"timings":{"blocked":3418,"dns":0,"connect":0,"send":0,"wait":259,"receive":18,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/4bfc8f15b9224402bf53edafddd9345f?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.422Z","timestamp":1788741144422,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/4bfc8f15b9224402bf53edafddd9345f?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/png\r\nContent-Length: 34920\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 30442\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"4bfc8f15b9224402bf53edafddd9345f\"; filename*=utf-8''4bfc8f15b9224402bf53edafddd9345f\r\nContent-Md5: tMTG6Sf7T120zfCAeHGSBg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FgLG0Tu3Mk3cXuobcqWN6bsrBJaL\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:30 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: yLBI2qylb\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: bvAAAAB7LTPpxtIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":34920,"size_decoded":35676,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"b4c4c6e927fb4f5db4cdf08078719206","sha1":"02c6d13bb7324ddc5eea1b72a58de9bb2b04968b","sha256":"7791502f0fdb1d2f89e24094b158589a19e9467d66e28c1fb95f6f0c698e21c6","sha512":"371dd8c2db10ef3fcd7ae8a7544c14923273b7cdd504bf32bf60e02d86ee6e6d1f46a3e0d4dfec7b9955e9a35a4ef60e71b27ecb9236e98059c6f6662587148e","ssdeep":"768:8LjRmEdYTZWvb9vaq3/ulKJpqodEwIy93QVmGCOh9LQSYf9h5:IdmEyZ2b9vX3UKJkpfs3M3hqnl","tlshash":"44f2f1bfed7ea104c64f0c2f4b0311516a87bea949905adb6305fca4419e0dcf4ec9a9","first_seen":"2025-06-30T02:18:01.391952Z","last_seen":"2026-09-07T08:08:08.103499Z","times_seen":262,"resource_available":false,"data":null}},"time_used":4419,"timings":{"blocked":4126,"dns":0,"connect":0,"send":0,"wait":265,"receive":28,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/655f226f2bbd4cb6a722cb967716ef35?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.450Z","timestamp":1788741144450,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/655f226f2bbd4cb6a722cb967716ef35?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/png\r\nContent-Length: 14304\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 27129\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"655f226f2bbd4cb6a722cb967716ef35\"; filename*=utf-8''655f226f2bbd4cb6a722cb967716ef35\r\nContent-Md5: 0kNVdgGHia13PADOnLGg4w==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FvhX7V5JIHybeW4q5M4zpxin-F3_\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:49 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: 1TR4O0ECJ\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: w0oAAAAU0e7sydIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14304,"size_decoded":15060,"mime_type":"image/png","magic":"PNG image data, 75 x 75, 8-bit/color RGBA, non-interlaced","md5":"d2435576018789ad773c00ce9cb1a0e3","sha1":"f857ed5e49207c9b796e2ae4ce33a718a7f85dff","sha256":"1b0f2ac656f115eab0fb0c4163e42f95ae0ee4e703e81aadc0db6f3425673e75","sha512":"20d1ab4cb26b25d610269a2f61d8681a24c65f187e0a62b5e2e8a7c316fb719cdbed154b9107fc6d1dd75c294c559202301c10415e5d8df271c445a5b3ca66f3","ssdeep":"192:feMXDH5yUbN24PxFzrQD/YGFuEyNUXKSOwHcV1xpTsPLdscFeq7/BZsVFtcsMhsj:2MXDoUbNlXNUXKc0xBu5kqpZUpM8N7","tlshash":"d252c0fe7e316a1b90816a7e48fb6150051bd2b9a85139f8627dc4ec11ce973c843f66","first_seen":"2025-02-04T17:13:00.903328Z","last_seen":"2026-09-07T08:08:08.424Z","times_seen":33,"resource_available":false,"data":null}},"time_used":5715,"timings":{"blocked":5463,"dns":0,"connect":0,"send":0,"wait":252,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/kc523-1/logo/logoWhite.png?1781011825626","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.711Z","timestamp":1788741142711,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /kc523-1/logo/logoWhite.png?1781011825626 HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:27 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 01 Apr 2026 05:40:09 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"69ccafb9-547d\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nAge: 43144\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8e1a07947dc3377e6\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21629,"size_decoded":21963,"mime_type":"image/png","magic":"PNG image data, 318 x 144, 8-bit/color RGBA, non-interlaced","md5":"0fe99b7761db545277ab76a5eac225b7","sha1":"c0ae9d5f9473be88b84d7d46d1efc51283a57a76","sha256":"e74b087729f820069fc590a73411d4b19d3da8a22ad1d127d4e4109be832cd97","sha512":"848f1da518a00ef98cf0e70429260b91720d3f139ed89714536d0a267aaacb8acb9779dfb1c0b42b134f81cb1ec0f5af97a160f1fc327750b111e88d7c6cc239","ssdeep":"384:Ok3FHRYfLVQEST+Yh9YDQiIkXnq3H+PxYi5JLL5PI4v2Kee/0Aytd:nFHRYfL+r9AQiIk0H+ZRGQHee/yr","tlshash":"aaa2d0d63930414ec49128de0fc1b9285cb6858847fd1e944f9f5eb2b4a3df62b4b368","first_seen":"2026-03-22T09:12:55.770605Z","last_seen":"2026-09-07T08:08:08.265101Z","times_seen":1115,"resource_available":false,"data":null}},"time_used":5153,"timings":{"blocked":4848,"dns":0,"connect":0,"send":0,"wait":303,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/f07c51312a994daa939a40ba14eb7432?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.410Z","timestamp":1788741144410,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/f07c51312a994daa939a40ba14eb7432?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/png\r\nContent-Length: 58467\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 32543\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"f07c51312a994daa939a40ba14eb7432\"; filename*=utf-8''f07c51312a994daa939a40ba14eb7432\r\nContent-Md5: Wu+vpmHi838rOQIvp8rYxg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FmPQ6N2tC3ab616u4nb-t_KKMBKZ\"\r\nLast-Modified: Mon, 31 Aug 2026 19:03:17 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: JMcOGADiQ\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: jpgAAAB-qfr_xNIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58467,"size_decoded":59223,"mime_type":"image/png","magic":"PNG image data, 300 x 267, 8-bit/color RGBA, non-interlaced","md5":"5aefafa661e2f37f2b39022fa7cad8c6","sha1":"63d0e8ddad0b769beb5eaee276feb7f28a301299","sha256":"4ed01237a787a6297846e115ecac83ca766f521aafce6b3dbed8ed627a982c7c","sha512":"422e4606cffe4af66fcdc5625d6ed84a78140ad3ecac4e8bff8c0d4e9cc8928dd2ae5cbbcb1b0d9553b26575c33a77f7ad637b538e9466b78a2f70408629c9d9","ssdeep":"1536:288LsUowEIpBZP2IzygpmFNXY1BJ6le1p525:MJEILZeIJmFN0BwSpA5","tlshash":"554302e891437a72ccad6bc6e5366577244376bf93c5b8b387ea24ba02506500ed9cc1","first_seen":"2023-08-24T20:41:53Z","last_seen":"2026-09-07T08:08:08.164731Z","times_seen":24,"resource_available":false,"data":null}},"time_used":3968,"timings":{"blocked":3458,"dns":0,"connect":0,"send":0,"wait":309,"receive":201,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/3d435e3523ed44379ab5b28225bb1b6b?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.477Z","timestamp":1788741144477,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/3d435e3523ed44379ab5b28225bb1b6b?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:31 GMT\r\nContent-Type: image/png\r\nContent-Length: 15642\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 21742\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"3d435e3523ed44379ab5b28225bb1b6b\"; filename*=utf-8''3d435e3523ed44379ab5b28225bb1b6b\r\nContent-Md5: ljJsZgC59Lz2uspU1gUkyw==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fqn4Z-xepTGttTUw7TmSXt7_iX5k\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:17 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: YPxOr9dsV\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: Q6sAAAChnFDTztIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15642,"size_decoded":16398,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced","md5":"96326c6600b9f4bcf6baca54d60524cb","sha1":"a9f867ec5ea531adb53530ed39925edeff897e64","sha256":"4e2786040005dbebf511a7084c8650bb45b736b7786681e38c2ed02fd93daa7d","sha512":"9689d83e64f44e1cdfca356635488d9fec7af06ccd8f8a204d3ee8823b3dfa7ce2ce781121f7aeee9692ec9e5e348b9fb19f7a7565f189ac2615ef44cdd78eac","ssdeep":"384:wm6ZqpZ2cO4wsKS99zUffoT7Fnev0kKe6mNKS8NGybj:wtzzI9zUfqnEqefAS8NTj","tlshash":"ae62bfd03bbbbd1a88cb5df564713142a4eb3f815b8b60a3935b415053ae24b0f91d92","first_seen":"2024-12-22T16:23:43.770758Z","last_seen":"2026-09-07T08:08:08.151137Z","times_seen":20,"resource_available":false,"data":null}},"time_used":7277,"timings":{"blocked":7019,"dns":0,"connect":0,"send":0,"wait":256,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/img/vs.21f89f73.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.511Z","timestamp":1788741144511,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /img/vs.21f89f73.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://g36b.top/css/home.1781011881923.38488e2a.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:26 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:10 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281706-51a\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nAge: 48500\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c921a07947d6ba83f0\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1306,"size_decoded":1823,"mime_type":"image/png","magic":"PNG image data, 70 x 28, 8-bit colormap, non-interlaced","md5":"41cff06a80e61ee3fcd32f7c29a6493e","sha1":"bb70bb0a3a0fde7a132788777aee629392c756e9","sha256":"3240fcea2e4168dc863b8aea602750e6a1fe11a557c18ac6a381781ef487746b","sha512":"fce7ff9f62b51c4f8994f0a8ec4a56f21570d0cd163471d99b357eb0a9a735c800b389c4a8a611ba441b208cea7eb483140042f5d11ef110b591c1c1898bbb8d","ssdeep":"","tlshash":"e921eaffe15b2c75ccb59bb3bc6c12656809582970866b137125e7588c539217f0c461","first_seen":"2025-08-29T11:05:53.184813Z","last_seen":"2026-09-08T23:44:55.110223Z","times_seen":2437,"resource_available":false,"data":null}},"time_used":1893,"timings":{"blocked":1589,"dns":0,"connect":0,"send":0,"wait":304,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202506/_webp_size1164x872_0e80d399-2c93-4f64-89db-61a96d3b05e4.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.612Z","timestamp":1788741144612,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202506/_webp_size1164x872_0e80d399-2c93-4f64-89db-61a96d3b05e4.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/webp\r\nContent-Length: 112700\r\nConnection: keep-alive\r\netag: \"62970d9f3c6d5069ad898724c19a4277\"\r\nLast-Modified: Sat, 06 Dec 2025 06:28:28 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 48501\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=M7npJLoh1vX4mX0BTRGKbDcKdwPdtRgd6vnUqlH0X3aYHTd2EURVwau9l7X8lShd34Gm03LsEArOgHffbUuyedEvel6WdMBFIB2MRLtwQk%2Bkp7ZSWlWbMmHIyDK3AKpPAUo7DDO%2F%2BY%2BJBh6ZNI3UfrQ%3D\"}]}\r\nCF-RAY: a36cfdb4ea71dd46-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c901a07947de10879a\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":112700,"size_decoded":113612,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"62970d9f3c6d5069ad898724c19a4277","sha1":"2b378bf8f829167d47bea58444d399fe47052617","sha256":"7b17d39fcff43e49c7a9cfa070a2e9ad41f466c464e347b7f2a91b705f6b5161","sha512":"00e247d65514ff4a5e8032c591faf83e4af220acd25b5b2fb5883c3f85ec349284e1609489cad86537bcbdc7718e2bc956f6b2c9bfef0cee09b54f036b9b495a","ssdeep":"3072:2Q4KKXKBHjDhDCq5qNrHMlyp8Rod8oucXQUEyr:DjBHRCqwNM4dw25r","tlshash":"e7b312dd1216b6b4a8b027fb23ccbd8944cd2ef64e787e96d8a9c8513545b2f40f4d42","first_seen":"2026-04-24T23:10:16.754484Z","last_seen":"2026-09-07T08:08:08.158348Z","times_seen":1047,"resource_available":false,"data":null}},"time_used":3910,"timings":{"blocked":3386,"dns":0,"connect":0,"send":0,"wait":341,"receive":183,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_aa2a4724-288d-4252-82c6-453d0458d8c1.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.636Z","timestamp":1788741144636,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_aa2a4724-288d-4252-82c6-453d0458d8c1.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/webp\r\nContent-Length: 49050\r\nConnection: keep-alive\r\netag: \"bb2aa8a4e812ea372888371e3493b542\"\r\nLast-Modified: Wed, 10 Dec 2025 11:52:08 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 42526\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DZMxTCZIvpEl7AjYVgzOyL9wkpRX4ANC%2BZGYeEkGzvCMsl9IFxECYkW%2BYtA0SGCEqNVcd1IomIukYoMq%2Flx2LX4xspRvSqwmdKhiwoEefOOzgYCF2iWENgrfJz9%2F00ryLJsaWKxr8%2FjS31mjPO4Bc%2Fo%3D\"}]}\r\nCF-RAY: a36d8f9a7ed4854e-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c921a07947e4e983fa\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":49050,"size_decoded":49965,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"bb2aa8a4e812ea372888371e3493b542","sha1":"4a36a3e778cd1cfaa8cbecc34e70d024963106a5","sha256":"fe97bdaee3660ca686cab03b1ef7af16d387780811e739ac2271082c7d4bb489","sha512":"f5ffb0368751705c8584d3a6bafa79c865cf33c0d4d8e58f06404807864ceefc41d20cd1162c01b17afcbc438a2fb2ed4f92b8f80938387b012bdd10e0ff2302","ssdeep":"768:6UQ6Jz2sCQ6dza0R/4YUaVSjgKLnkBM/jScHyXLEcDs5Op2jbOKz6im:tD5rCRNa0R2aOgKzkKucHybEcLKwl","tlshash":"2323f1d8f25dd108f9c51d3e9ebe898e6cbaeded3ec998c6224cd81c041494678d6623","first_seen":"2026-04-24T23:10:16.759919Z","last_seen":"2026-09-07T08:08:08.215843Z","times_seen":1084,"resource_available":false,"data":null}},"time_used":5462,"timings":{"blocked":5142,"dns":0,"connect":0,"send":0,"wait":308,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/config/telegram.js?t=1788741139362","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:19.404Z","timestamp":1788741139404,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /config/telegram.js?t=1788741139362 HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:21 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-1c896\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c901a07947c335878b\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":116886,"size_decoded":18682,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (483)","md5":"4ef2154bcfb8399f256c2da15a4cb409","sha1":"e0f8f5578b2e0773ec1d79bb1cec54e1f5d6373d","sha256":"73fa4926373755b52fecfdf3145a0c9953c08af374ea69dda46fe2b3b9ddb022","sha512":"8b64643161386bdefbb7eab04416e78e5e183c50acba7b25b146aa6e733744a326566a01eb7eabb1a0a3f5b87ac8461a7ab3b9ad1c44de37ecea25af09e3eb41","ssdeep":"1536:WK4KZK+Klt3LbbdS4V+vO14KtA9phXTQ+fcZl8LDh7j8d3K+V4WMrnf/NunqxF00:Wj+dgdLbbdSA+1XTQRZ1jSBl","tlshash":"14b31c4c5cf3216285a7b1be8b9f925072759893304def203c4d9ba45f98d3c53eaad8","first_seen":"2025-05-31T08:16:48.368096Z","last_seen":"2026-09-08T23:44:55.185793Z","times_seen":2648,"resource_available":true,"data":null}},"time_used":2119,"timings":{"blocked":1758,"dns":0,"connect":0,"send":0,"wait":356,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/35142.1781011881923.1d227afa.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.455Z","timestamp":1788741142455,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /js/35142.1781011881923.1d227afa.js HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:22 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-530c3\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c901a07947c8b6878e\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":340163,"size_decoded":93970,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64894), with no line terminators","md5":"8325235b613820a57b71043f360e5b36","sha1":"925ff977edf9892e868d43915f93d29e6feeb113","sha256":"0c505f39a463b09ece16c213b7ead75186dcdc26d25ee02dcba5a62cc0dff7c6","sha512":"efd16c9b7ff0f806890ae77542e8c0d4e954f8c797ff21b8dcde3f240e4940ca3c6d0fe75ee2fda35bf53ff5d0eb691fa7e38cfdfa82c0f231b0cd57458fbcf2","ssdeep":"6144:N0hEyLkbJDb7w/1FOAmBm7cene7Ancbt8sbyAkKJwoSlt5MMjmlHGwwzHUY9SroE:N0hEyLkFDb7w/1FOAmBm7cenaAncbt84","tlshash":"8a742b94b290b17883af86fb731a91a1d24d0e9460ccace4f27e6e407f15746b8775ec","first_seen":"2026-06-12T19:29:57.248751Z","last_seen":"2026-09-07T08:08:08.44733Z","times_seen":1181,"resource_available":true,"data":null}},"time_used":717,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":551,"receive":166,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_3340babe-d86d-4379-84e5-92efe2221568.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.610Z","timestamp":1788741144610,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_3340babe-d86d-4379-84e5-92efe2221568.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/webp\r\nContent-Length: 69604\r\nConnection: keep-alive\r\netag: \"bf4ab4dd29a7e850bb98cc23f8aa469b\"\r\nLast-Modified: Sat, 06 Dec 2025 06:31:49 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 48502\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tRQN4hUzWuraCaXcYK9fp7lqLctOSukFq4kj4h8OJ%2BWCRQb6kOHWQ%2F65eDw5yQYcdDudC7m%2B%2Fl1NUh3dKeMKhUNojgQyd5kIHFhE0OAjxFWu3DINVrvwrXl6wJzHtqNDwuqsl0IsPNGv0069MFyCEsU%3D\"}]}\r\nCF-RAY: a36cfdaf4d5dd11a-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8c1a07947dd9d8126\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":69604,"size_decoded":70515,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"bf4ab4dd29a7e850bb98cc23f8aa469b","sha1":"bf8a5db8a24980c822ff470dfd5c400c3a7c9318","sha256":"2755467e92e31efad621b2e575f92ee22de6de608fa8f2fddb67db94b677b946","sha512":"21ee32c3081cdce13a032da5e97d59e0a8abd54778a0be5efadea03e95f5a9876414faeb43046ddeeeb580bc384b67ef786ac80243a9b7d10b4695ed25a5fb03","ssdeep":"1536:kzZ24Ia5yjsOfOLgsOtyLr/i7deYSzcwqzpf1btvhp61:kzZDIa5yjDMkyLr/z/cwqzpdxpp61","tlshash":"f76302aa4a11d1c8af767507133a99aa77ec93ea60d612f04077944f162bddba1f0c0f","first_seen":"2026-04-24T23:10:16.876074Z","last_seen":"2026-09-07T08:08:08.397214Z","times_seen":1051,"resource_available":false,"data":null}},"time_used":3656,"timings":{"blocked":3278,"dns":0,"connect":0,"send":0,"wait":323,"receive":55,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_d991353f-39ff-4552-be18-848fc3fabfb2.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.614Z","timestamp":1788741144614,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_d991353f-39ff-4552-be18-848fc3fabfb2.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/webp\r\nContent-Length: 47886\r\nConnection: keep-alive\r\netag: \"ba0be3142a5adac8fdffb8c21b319dbb\"\r\nLast-Modified: Sat, 06 Dec 2025 06:30:09 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 53763\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fds0eai53ajy%2BzXwob%2Fk4AK9SW6xp2hhyaYzRS7URDo9V3kq7g3N%2F9Kqwl0zc6bjH0Ht8XNo4ijhWE9GmtFPRhZg61%2BQuOnwGWwx%2FWYkDwZQ2CvXp6vv3u8dQqtioK%2FeXwIArN9VE5kpWh62LhTbrKo%3D\"}]}\r\nCF-RAY: a36c7d3e9ec29590-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8c1a07947df568127\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47886,"size_decoded":48801,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ba0be3142a5adac8fdffb8c21b319dbb","sha1":"86a3734ad3716c5ecf67412f804a881fc9eaf4ca","sha256":"c3d9e9184bc542699b269037e068dd63803352fc1feaf06695ec888185f77bd0","sha512":"da43e90eef8c8f0aa5daf006910fe64bb579b9a0083df3c06b0f21c8f175d5dacc0b31009365ec391f0482e62f0b8449b98407b5a2423c20fc021aeead097296","ssdeep":"768:zpFTQF6ySs7gk0G8b/lE4qxGPlMt63JKVB/JmKjmz+0N2pqQg6yQV:fpyt7y/y4qoet63UbJRa+Fqwy4","tlshash":"ec2301147718d91012a1a6dbebcc1b6d6cae4947a4457a338d8770ccc7bdc9ee53ce82","first_seen":"2026-04-24T23:10:16.87696Z","last_seen":"2026-09-08T23:44:55.153179Z","times_seen":1059,"resource_available":false,"data":null}},"time_used":4074,"timings":{"blocked":3718,"dns":0,"connect":0,"send":0,"wait":323,"receive":33,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/config/gd.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:19.383Z","timestamp":1788741139383,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /config/gd.js HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:20 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-4420\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8f1a07947be917872\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17440,"size_decoded":5311,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"368318100a3c0f64373230a250953d5a","sha1":"6e0d91639cafd23f1b22aecee332da83c70b93ea","sha256":"dffc9b203a19b9e70363f75f737b7afe2164d6b8c045800d4dd7931d9093aff4","sha512":"91077ca792821795a816a0ee1a9cef242bf2915c02402706c7bd5c027c62f4bc52517b6a5e3db9f4b873e5a3c9d652758cc277c1f5ba07dc12e0d69b4f6e9eeb","ssdeep":"384:bJA61XVpi5LH4NmeJPXwXkQdcAwR0Nw3zzbSGwYg1C:bJA6BZX+oJjzzgY","tlshash":"80721f4d68f7905345a3b03c8bafa114b5388643181cde457e9ce394af6843d97babdc","first_seen":"2026-05-19T02:14:56.346288Z","last_seen":"2026-09-08T23:44:55.048931Z","times_seen":1411,"resource_available":true,"data":null}},"time_used":933,"timings":{"blocked":-1,"dns":0,"connect":295,"send":0,"wait":331,"receive":0,"ssl":306},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/21954.1781011881923.57c97863.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:21.974Z","timestamp":1788741141974,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /js/21954.1781011881923.57c97863.js HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:22 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-a3da\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8e1a07947c65d77db\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":41946,"size_decoded":9245,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (41946), with no line terminators","md5":"35aef3c03c45b75cc6c2851265c30f23","sha1":"54874afc1d2d6391142418c6c17d7639247b6c9b","sha256":"c7a0283f3d2fde40ce97fe3bb5e79621f9939000c50c3c781a4597c3242ebae2","sha512":"f74356629d65ff26f6928ad3183ba8e6e01848921202f9c14c5aef758ef72acdcabf523209e892df42d230d9c87cb47cda7bd106105ed8447718fc502b2d71db","ssdeep":"768:U/aSfmzKrMdvf0eMQ/96loumY1PI1yBK9LudEz+yUy51y9y0yk6Dio+ILqpTeY:z81R6Ipyk6o","tlshash":"33132088fac2b06dd3eb7330857f505ae66a1dc0668c5434e260d6917e7198dc1fb9f8","first_seen":"2026-05-29T16:01:53.086335Z","last_seen":"2026-09-07T08:08:08.429388Z","times_seen":1212,"resource_available":true,"data":null}},"time_used":313,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":313,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/83cee3c8ed82494fadeabb45051754a5?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.404Z","timestamp":1788741144404,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/83cee3c8ed82494fadeabb45051754a5?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:27 GMT\r\nContent-Type: image/png\r\nContent-Length: 29714\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 32543\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"83cee3c8ed82494fadeabb45051754a5\"; filename*=utf-8''83cee3c8ed82494fadeabb45051754a5\r\nContent-Md5: KXYTWbL/ICU1rapFpWFaLg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fj0x0s29HfYY0PnqveWydhN3Me-W\"\r\nLast-Modified: Mon, 31 Aug 2026 19:03:14 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: v3S6IpDpv\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: V6sAAACg3sn_xNIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":29714,"size_decoded":30470,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"29761359b2ff202535adaa45a5615a2e","sha1":"3d31d2cdbd1df618d0f9eabde5b276137731ef96","sha256":"2c0e85244fc0f74fe1e18b9ef613c4ae4942e7232817a95348e629154f6b44c3","sha512":"ba6ac81cf24945b6642b8ad6409afcbcde0651e162df4934a188a649432a2068b5db7d5b0af38cde9ef8d42cbf83845ca0c76ea95d2c8131ee9439b416fe5224","ssdeep":"768:CSNcYh0wn8tIX5Rjo5mAQgtUH8sfEm2XiTw8XhIz84LM3GtiwBT:C8h06AC5WkALCZKXi0IuM3H2","tlshash":"37d2e1f545a3456e0e410604d7fe193a642def8ff93f8666d8e81348e1b48ea8783286","first_seen":"2025-02-26T14:48:47.752396Z","last_seen":"2026-09-07T08:08:08.130287Z","times_seen":28,"resource_available":false,"data":null}},"time_used":3418,"timings":{"blocked":3148,"dns":0,"connect":0,"send":0,"wait":259,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/d749639e255d4e21b18846da2ae56124?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.481Z","timestamp":1788741144481,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/d749639e255d4e21b18846da2ae56124?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:31 GMT\r\nContent-Type: image/png\r\nContent-Length: 5774\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 20838\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"d749639e255d4e21b18846da2ae56124\"; filename*=utf-8''d749639e255d4e21b18846da2ae56124\r\nContent-Md5: oQF8LbqMYvb09HeyzD1/DA==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fv9bzRlIeAN06OuDgPhu_KC9A9LN\"\r\nLast-Modified: Tue, 01 Sep 2026 18:49:21 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: JnjBZ6uKo\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: JY8AAABA9eSlz9IY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5774,"size_decoded":6529,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"a1017c2dba8c62f6f4f477b2cc3d7f0c","sha1":"ff5bcd1948780374e8eb8380f86efca0bd03d2cd","sha256":"9e8786b72b3036ff1c787d009de137b021652bb9fbcae95dfcc56f186d534ebd","sha512":"b5d1f893a676ce0ccd067d399ecac5077061bac22d21fe3f011b1b09d8de10e4f921b7dec4cd8f67b14a9e903bbd49a72b97dd2322bb2a16828af87a0a8b5efb","ssdeep":"96:y3NvPriEbV3pfeDsdR34Xw9CpkKMd8siwta/iKxRfpKsStNETj2Plk:y3NvziEbV1eDsnR4WK1uGR0sStCTiPlk","tlshash":"53c18e94e9b9826c9004b739c07a9789b4e9c77c5ce562e00914de693d47d3e19031c7","first_seen":"2023-12-17T14:36:27Z","last_seen":"2026-09-07T08:08:08.119244Z","times_seen":143,"resource_available":false,"data":null}},"time_used":7486,"timings":{"blocked":7225,"dns":0,"connect":0,"send":0,"wait":261,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_07a2d840-d1e1-4217-9d3b-badf80b88abd.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.613Z","timestamp":1788741144613,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202503/_webp_size649x578_07a2d840-d1e1-4217-9d3b-badf80b88abd.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/webp\r\nContent-Length: 77072\r\nConnection: keep-alive\r\netag: \"81934df1c48f153ec91149ba3c3beb37\"\r\nLast-Modified: Sat, 06 Dec 2025 06:20:21 GMT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6%2F9u2eEqLMS72YWo0LOoxOaK8fQhXhtaWJ6%2BIGdLRKaq08XFAeMoTqRR4HppjLkyF7HWpOWORlxpoUP2GTqe12I78I5P33F2pC3zMJxchJSpUdW5gaGQajjG52bBIbWqvdY3NCdOQ29ovYDZVl9Uw2Q%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 48501\r\ncf-cache-status: HIT\r\nCF-RAY: a36cfdb61da9d50d-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c921a07947deb683f5\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":77072,"size_decoded":77979,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"81934df1c48f153ec91149ba3c3beb37","sha1":"263dec3db6f316ad859fae46f18adc5cbb9e5c61","sha256":"9393129dc2d2eb90aa6b0e3cae170e77eccc785d4fca575804e1d25a2bee1383","sha512":"9d322a35877bc71c33fad174b47d6377f214fba0f11bc6a6180c5032765a9f4332354a4e6192a33049ab7a20a79ef58804de08d54098f64d8511c08b50e2b6ca","ssdeep":"1536:vow5Jv2vmGSpZk1IdIwZojJkcFgxPAifiE3TcBUPpCoS+LsAEZhO96:vowCOGYZk1w7q+PaE3T8uS+Lr2hO96","tlshash":"a573127b5c2c0bb32fc676c6e2e9b5c82cc817b1478556cf5b7958af95a4311232c02a","first_seen":"2026-04-24T23:10:16.861629Z","last_seen":"2026-09-08T23:44:55.194852Z","times_seen":1040,"resource_available":false,"data":null}},"time_used":3890,"timings":{"blocked":3559,"dns":0,"connect":0,"send":0,"wait":309,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/62a30e783f89487caf89c541194866f2?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.503Z","timestamp":1788741144503,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/62a30e783f89487caf89c541194866f2?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:33 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 8288\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 1947\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"62a30e783f89487caf89c541194866f2\"; filename*=utf-8''62a30e783f89487caf89c541194866f2\r\nContent-Md5: RdFTOThrBLUjBEbunthDOQ==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fu0d1F1pFIs31j-8-1S2t2dQ9Gj6\"\r\nLast-Modified: Mon, 31 Aug 2026 18:51:38 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: HucmTifvL\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: 89EAAABNZ9rU4NIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8288,"size_decoded":9043,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 225x225, components 3","md5":"45d15339386b04b5230446ee9ed84339","sha1":"ed1dd45d69148b37d63fbcfb54b6b76750f468fa","sha256":"72bf2a0f6b92ded9cb06c8258dbfbfc0cbb432066303f390db4b1a44143126e5","sha512":"e4677dd2e999c368275379841e7455935a4364f0ef231be226b340fd395dae5a6c014839df3d8b5827c9f1d14dc08689da82b06c865b4cb8723de136a553cbbe","ssdeep":"192:/vEmdqgCaNr/Y9vnbvGaUbAXv4TU4kWCRHql:ogLRAwbAf4TUXju","tlshash":"7202bf43dcafe84ed506df7f87ba5b00e23ea104be1a7d195a70322948606f7981fb54","first_seen":"2025-10-03T21:17:32.503442Z","last_seen":"2026-09-07T08:08:08.352264Z","times_seen":77,"resource_available":false,"data":null}},"time_used":8608,"timings":{"blocked":8354,"dns":0,"connect":0,"send":0,"wait":254,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/img/LOTTERY.4e81790a.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.606Z","timestamp":1788741144606,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /img/LOTTERY.4e81790a.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:27 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-e929\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nAge: 42552\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c911a07947dc2a7f47\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59689,"size_decoded":60217,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"f86c9671c7aed55212fe0eb5219a664d","sha1":"6e765dfb0ce3c646d8c808940071554e78e7d409","sha256":"4ba3fff550a17eff9585d6acbc4a96bd515149510f6a8bb7638985fb4b41a181","sha512":"706aa66f138a3459eaf34f5b7a8ffed3dfacecec6adf14a2e83f1149143cfbb059f97aaaac2032587a80c0e30c62e5b46b07b4dc6f3cf5925e6e1db2a8ed45d6","ssdeep":"1536:Cyp1EBaRnsFt9ZXZj0wEYsRvqm1waPbZsY:CLB+sFtzXN0w2ym1fFsY","tlshash":"914302f36beb0bc5b07adbcf4ed354f0067a71496b42dcd44f4120e61ea6199bac420a","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-09-08T23:44:55.211128Z","times_seen":2451,"resource_available":false,"data":null}},"time_used":3297,"timings":{"blocked":2908,"dns":0,"connect":0,"send":0,"wait":315,"receive":74,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_df036cfa-66a5-49f7-b863-3c22d1a3d180.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.634Z","timestamp":1788741144634,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1298x1156_df036cfa-66a5-49f7-b863-3c22d1a3d180.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/webp\r\nContent-Length: 120978\r\nConnection: keep-alive\r\netag: \"1af718e662844a31716cc9bf3248f8e4\"\r\nLast-Modified: Wed, 10 Dec 2025 11:52:31 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 42527\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oJux%2FzHsXylFwNNtAqnOsrTI3NI5uyAnHPz5aeUWcRO2ys%2FN0451Teg8x1E0qg0aCxofZ9u5DqNsXHPHsv24m%2BwORYhkRs3q56YC0mNDhFuXtWUaQgRebyR1YTZd8rp9x4RhEMmZhbvx7gki1JEjiJI%3D\"}]}\r\nCF-RAY: a36d8f97d84906f0-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5cc51a07947e4568b5d\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":120978,"size_decoded":121888,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"1af718e662844a31716cc9bf3248f8e4","sha1":"e54b87093f05f4d0c5d96fbc689f0ed37ffcbcaa","sha256":"670ccce96c9f21fc7364791b4870e1915788e14fb105a16cae131cae271279b4","sha512":"93a7b9e3a5b4438343a8f1abe967cf1b3d21a347b42526dd8604da5f9c953c14ad2dc83bcd7e3f340a9b3b90b9a4c98f90ec88c689875b8e2b0536f0b9ca7975","ssdeep":"3072:nO0/MDrjGP/ngyzlMkxT730AhwPBv78vHWJ8AxCsDozmmeYj:JgrA/nnKBrpvovHWLxCqImE","tlshash":"a0c312ee7ec309b8e112676d12dd07968e16e06f482b0d959e2f40392b02716ef7dc5d","first_seen":"2026-04-24T23:10:16.785822Z","last_seen":"2026-09-07T08:08:08.121116Z","times_seen":1062,"resource_available":false,"data":null}},"time_used":5413,"timings":{"blocked":4996,"dns":0,"connect":0,"send":0,"wait":314,"receive":103,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/configPage.js?v=6/9/2026,%2021:37:10","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:19.380Z","timestamp":1788741139380,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /configPage.js?v=6/9/2026,%2021:37:10 HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:19 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 949\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:20 GMT\r\nETag: \"6a281710-3b5\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c921a07947bc3483e5\r\nX-Cache-Status: BYPASS\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":949,"size_decoded":1409,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with very long lines (917), with no line terminators","md5":"e6aa74bb352ef198ba3e1c9a4b01b014","sha1":"2ea8bd6b5045475a36432f7665a129728e822d9e","sha256":"73828e873c0b6e847b37d78941ca436247471dfc90a12f743964f869f75abd5c","sha512":"2faaf24fdf1e4da637af8e9f82d1778bf061b00752dfca0c8f73432ba236a7b69410a7ad2a73727bc83e6cd631fd6555c3cc0d9d3a5d8a7f81818dd66566011f","ssdeep":"","tlshash":"be117aaf57444dffcf1d7e00a08b0a5ea8bc61d261889d4da8e9cf29e1c99002378978","first_seen":"2025-09-04T00:49:32.949926Z","last_seen":"2026-09-08T23:44:55.151667Z","times_seen":3024,"resource_available":true,"data":null}},"time_used":319,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":319,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/img/zeren.c0aa584f.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.683Z","timestamp":1788741142683,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /img/zeren.c0aa584f.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:25 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-cfa\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nAge: 34401\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c921a07947d4dd83ef\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3322,"size_decoded":3839,"mime_type":"image/png","magic":"PNG image data, 414 x 130, 4-bit colormap, non-interlaced","md5":"217588cbcd6216a09cac17953ae710b1","sha1":"de250755d284bb75dcee38ee45f2fc839987dcba","sha256":"24c2821b322d0c9087bcb0727dc0307311f6cfbb52af9f8a93308e48705f706e","sha512":"da190054ec0862c9927bb3bd928481459d53d4d778e9b2928c2507f2a34df5791d43adda750fcf184b767c1ba3a3f92e45dc57242a80869e253a9b37639abb4a","ssdeep":"","tlshash":"50616c01eb9130b8129c286701bd3fcda4c64d993d203d798d87b29bd6f970d288b123","first_seen":"2025-08-29T11:05:53.326961Z","last_seen":"2026-09-07T08:08:08.246691Z","times_seen":2532,"resource_available":false,"data":null}},"time_used":3314,"timings":{"blocked":3010,"dns":0,"connect":0,"send":0,"wait":304,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/kc523-1/sponsor/sponsor_web_3.png?1781011825626","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.716Z","timestamp":1788741142716,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_web_3.png?1781011825626 HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:27 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 30 Sep 2025 12:19:27 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68dbcacf-9faf\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nAge: 43147\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c911a07947d99c7f45\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40879,"size_decoded":41038,"mime_type":"image/png","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 428x169, components 3","md5":"c26161f438986f6e2d677c34d653285e","sha1":"faf6c47a013a9944bb8cac197688908422992039","sha256":"58d11e173550b3420b35c4e4be3eeb76b59ac790d9fb59b535ffe55d3b470fa9","sha512":"97649de556447ef6aa6cdd7d0bec46837cfb328335daa3b862cbaa5e23ca5a8f2af296703c9e961cbad02bb797ebf1f99ced2d1d245fbbb3a428e39d26428c76","ssdeep":"768:ub+4OMIuYE3McXMuDR64Q7sRFKJdsCA1Hunj5tyKxGGTVtkDGlT2oTO:uS4OMXYODNDR6XsRFisCAk39t6oi","tlshash":"db03f108254f2d4466ec90bbc7a1e0f7ee1d103dddb7e30c35a685163e46ca559fa0e6","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-09-07T08:08:08.403639Z","times_seen":2408,"resource_available":false,"data":null}},"time_used":4550,"timings":{"blocked":4191,"dns":0,"connect":0,"send":0,"wait":315,"receive":44,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/d3eaf0760bfa485b941aaf5d302dc787?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.379Z","timestamp":1788741144379,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/d3eaf0760bfa485b941aaf5d302dc787?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:26 GMT\r\nContent-Type: image/png\r\nContent-Length: 7475\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 2480\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"d3eaf0760bfa485b941aaf5d302dc787\"; filename*=utf-8''d3eaf0760bfa485b941aaf5d302dc787\r\nContent-Md5: 4dK0z5QAOfBLiKfDHnGT5Q==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fk0stwwwGKJqZ6GGwIqC4Yk6GaNH\"\r\nLast-Modified: Mon, 31 Aug 2026 18:52:28 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: V7gaSfCHI\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: KLYAAAAy_QRX4NIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":7475,"size_decoded":8229,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 8-bit colormap, non-interlaced","md5":"e1d2b4cf940039f04b88a7c31e7193e5","sha1":"4d2cb70c3018a26a67a186c08a82e1893a19a347","sha256":"3d4f9c6f6b53a03d87469cae121e50713fc51ce807cfae6088fbda7bf224b975","sha512":"84005963bfcc71deef2b2a46e26b0eeaa3e856e5dfd89ae80dd3d6b72fe20935c71f0ee7e583f75462b82ce7148655f36d46216e558ee1c9a69a4cd41ea1eaa8","ssdeep":"192:eAvmzQY1ALTW9PVbPmlg7rrHucDSTuelicGvA:eA+zjNFulg7PHucmrsFA","tlshash":"4ff1ad67dc07dfb828951d42c90420e9a0ed4f82a611906aecbf31b0d8f982f58fe547","first_seen":"2023-11-24T00:58:42Z","last_seen":"2026-09-07T00:33:21.894165Z","times_seen":17,"resource_available":false,"data":null}},"time_used":1759,"timings":{"blocked":1478,"dns":0,"connect":0,"send":0,"wait":281,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.esportsdata.cc/202/1/9dafb490add16b2663c21d290ee8b327.png?win007=sell","fqdn":"img.esportsdata.cc","domain":"esportsdata.cc","tld":"cc"},"ip":{"addr":"104.26.3.221","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.484Z","timestamp":1788741144484,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esportsdata.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 14 Jul 2026 09:01:04 GMT","end":"Mon, 12 Oct 2026 10:00:52 GMT"},"fingerprint":{"sha1":"02:2C:76:E1:47:AB:DD:DF:78:F5:11:A8:4B:B9:89:0D:00:17:5A:00","sha256":"38:CC:62:D9:EA:20:2D:41:D0:01:77:C5:A3:E1:31:1D:2E:4A:68:8A:C9:01:14:FB:56:DB:59:4E:F0:B1:B5:08"}}},"request":{"raw":"GET /202/1/9dafb490add16b2663c21d290ee8b327.png?win007=sell HTTP/1.1\r\nHost: img.esportsdata.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Mon, 07 Sep 2026 00:32:24 GMT\r\ncontent-type: image/png\r\ncontent-length: 10674\r\nserver: cloudflare\r\naccept-ranges: bytes\r\netag: \"a14e3851634a4e52557e01d33864b45a\"\r\nlast-modified: Mon, 13 Jul 2026 13:22:03 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Origin, Accept-Encoding\r\nx-amz-id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8\r\nx-amz-request-id: 18D2D8A6E69ADCFB\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nage: 3344\r\ncache-control: max-age=2678400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GDhuCI3z62lHaT6J3d81rVc7PBtYxj2AjkSegZXGnN0qON9lp9b%2FT5ryHZApPGOhfQtX2T8aaiGTVdXKup2hSd0UDb0UeMJ%2B0PfFvAWTYZ%2Fz8fCB2O6yNEXY4XBqzN4XLk6RDg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3719db90c4f56b4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10674,"size_decoded":11623,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"a14e3851634a4e52557e01d33864b45a","sha1":"0c7c29ab0e5204b17b45470c9405ae9db77c394e","sha256":"8b0c8b8edbfe14f10bf64d5ad6343034bf14fb5b6427b693e1be0fd3f2e5304f","sha512":"8ca9319f56bc4059a503332ed35d7f1e52ad55566c356eaef3249acedda6cacb72d4929441deb2b6b3975668568ff49087888d515d356c4ecee9c8f3aaf5c7ef","ssdeep":"192:BdqInyMZnJgWgVytL4VAokM2h/0AXkJvYkvltsTm63D8rw5IIN/jSk+5c:OIyMTeVy12AokB1tQlKSw5dN/2k+C","tlshash":"a222c0539537b427ea91e81b186da823ce810532853208c662b460bd2d6bf6df6e8137","first_seen":"2025-07-02T05:27:53.707214Z","last_seen":"2026-09-07T08:08:08.211061Z","times_seen":156,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-06","alert":"Sinkholed","trigger":"img.esportsdata.cc","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/api/sport/match/list?sportId=1\u0026client=web","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:34.411Z","timestamp":1788741154411,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /api/sport/match/list?sportId=1\u0026client=web HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nx-request-source: https://g36b.top\r\nXign: Wx2TLuJb3rkvo1j/9if+qijePwKPXVmfFLK1rftoHlZQ2eNgOpH71vU+HmVZy3YpWgAPCgP7Mc1W/Y0ViPBO32v2+goHRb1ZOj84JWUkQ5o+GEQnVaKjTyKuxtG/eGWFNORaXdJm24JaNWmYfaeB2O9ERhDHqosABlmVC9iaESs=\r\ntimestamp: 1788741154407\r\nsign: 21116n5g1k4p682v\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: aDntxNnwbrytXeEW4SJfGsaRdsx3tyZ3\r\nlang: zh-CN\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:34 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nCache-Control: no-cache, no-store, max-age=0\r\ncontent-encoding: gzip\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c921a07947f6ec83fd\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":43155,"size_decoded":7993,"mime_type":"application/json","magic":"Unicode text, UTF-8 text, with very long lines (41333), with no line terminators","md5":"3b440ce0b34025506039466efadecb45","sha1":"3f85b3595e6500fdbc3ee6784f34e9aba1c8f919","sha256":"f82788589fb4e8328d93a98db6933677ade975e71af899fcfe98f83f7960685a","sha512":"c920d9c4c1de903d14f0234dba4466b4907186abe559a6efc13a123ba58c248be10efda0db8b1127f1620596cc3d3866675a624fdeba3c65e71dd42a48d74cda","ssdeep":"768:eNCrhqfHg2vcycTd1i0hEKpRb3qOv4dxvUwQYRwJCdxtdtgHRsX16sQP2ssc5sj9:es2mp3/JVsUsdslsgR6RiRR00S0D0jHd","tlshash":"64130e5291de28961b9c61d55d1d3f4d887eba0b0a9ef6c9ee4ecf1821b43fb9300d21","first_seen":"2026-09-07T00:33:21.617637Z","last_seen":"2026-09-07T00:33:21.617637Z","times_seen":1,"resource_available":false,"data":null}},"time_used":314,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":314,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/js/chunk-init-c0d76f48.1781011881923.0f397bb1.js","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:19.392Z","timestamp":1788741139392,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /js/chunk-init-c0d76f48.1781011881923.0f397bb1.js HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:20 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-275ca\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c921a07947bf9983e7\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":161226,"size_decoded":53051,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65535), with no line terminators","md5":"815f2acbd0918250f25d4f71409219b0","sha1":"d5778078df7eada22b3175f9182b8b22e828c433","sha256":"12a61f287da39190db34dff1de7188c3d8b76ffbd1c11290962db88fd5e2ab46","sha512":"5ba4adaf4b36b4a402c30c3aaa5be5f02e292391d79400d353a5ca6c61405cb40e5179858abddb1af6dad243899e420111e49004d01d339ce9de23d8f522c379","ssdeep":"1536:zG5qxPvO2lSV822bv0bcbpM/igw/aIwC23QOoKILbjxo4wc0tvB6xVS/J+pKY3Ns:iQz/Dp5/92xoKa/x5wc0dB5/J+UU0","tlshash":"5ef31b987392b1b847dba6e152371075b57e1dd73088e8f0c169a6803f31a9cd52afec","first_seen":"2026-05-11T06:12:53.502908Z","last_seen":"2026-09-07T08:08:08.385656Z","times_seen":1243,"resource_available":true,"data":null}},"time_used":1554,"timings":{"blocked":840,"dns":0,"connect":0,"send":0,"wait":427,"receive":287,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/ecb/8f83064249b06e0660afdb30b60772fdcdfbb3036fb467600d10b16d76dc640e","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:23.436Z","timestamp":1788741143436,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /ecb/8f83064249b06e0660afdb30b60772fdcdfbb3036fb467600d10b16d76dc640e HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://g36b.top\r\nXign: x/OsoXGyEwrEmFjCJTTlYa35BTeghRYaBbCDghCEICGazxzubyveV43bv93mgF8yn9NZQQq52mCE10VKv6izyqHRpojevlTeePy7pYmK1tjQiq8TS8zApMAjZITmQCkJf6GUbntBynaBnryhBinu777Vy3u8MALoFPXuCs5fOSo=\r\ntimestamp: 1788741143420\r\nsign: a4k3g2qk52623j5a\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: aDntxNnwbrytXeEW4SJfGsaRdsx3tyZ3\r\nlang: zh-CN\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:23 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Mon, 07 Sep 2026 00:42:23 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nX-Request-ID: 883262cc74eb4aea8de0eb3f89edfe6b\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8e1a07947cd6777dd\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3828,"size_decoded":4648,"mime_type":"application/json","magic":"data","md5":"d0df1c010cfce9385feaa719e8bad30f","sha1":"ce37001cbf48dc8db38ef5c1c51a8821ad3ebfe9","sha256":"36a2ca76ebb3e8a73b162d1a106a194d99d1485385a712e508de69e015727a52","sha512":"cce3b19ce95df559288a77e392e80d73ceba6f34608933e162c396822b755a702f49c56986b0715c378216fa3109bab350637dd2e46d5615632b81feb431e5b6","ssdeep":"96:eOG3iMFIo2z+WuQFdcSssJ1OIKOC2jqk8yxtxghfchDsjdnv+CXVXdkzs3uJ8jc:VL02JuZ5sJcOCCq8xtxb5UN2qdkY3ij","tlshash":"a4c16c09f7e4b7a09b4653fa74d710a8a21f1dbbb64b6e7ac7b0c36b045770a425e304","first_seen":"2026-09-07T00:32:02.790634Z","last_seen":"2026-09-07T08:08:08.314844Z","times_seen":3,"resource_available":false,"data":null}},"time_used":644,"timings":{"blocked":341,"dns":0,"connect":0,"send":0,"wait":303,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1884x434_8953c3b5-a3a1-4b97-a677-4b5efb3fb94a.jpg","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.029Z","timestamp":1788741144029,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/202508/_webp_size1884x434_8953c3b5-a3a1-4b97-a677-4b5efb3fb94a.jpg HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:24 GMT\r\nContent-Type: image/webp\r\nContent-Length: 37528\r\nConnection: keep-alive\r\netag: \"906ab41cba21ba54bbb80ed3dacbb04b\"\r\nLast-Modified: Wed, 10 Dec 2025 10:48:21 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 53755\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tsyQZNT%2BiddvqPankYyQt6hllDIaDys6JJlwr%2F7bQpr2xBXY3JTnrywWGSTyrnCBpWu4kOtxOe7hrZayE3LUrYCV5LLAO8PqxAjqF7G4yQoknV%2FsmabymrF3pdI7FZuGILk9ZdfPrcTGu%2FTAMwgQLYg%3D\"}]}\r\nCF-RAY: a36c7d596ef809fc-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5cc51a07947ce5c8b59\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":37528,"size_decoded":38439,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1884x434, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"906ab41cba21ba54bbb80ed3dacbb04b","sha1":"e08f7dbbfa8dbd35da5d1dcd0f053655549ab960","sha256":"a1ab44f6e154a62ec1ef0e0298fd9b4844f915511f4f611b7c0249fe0c18cf96","sha512":"e2f606f28782502ed4817ea9526830bb828b6519748e5ffb9877151958d0e4b971f028c39fe42c321df89af615265f25fce12495edfc0a668b07032b17b38f1e","ssdeep":"768:FlLwXc9bK7xo/wY1n6usZ+BDB6rZgXCEMyLjPzfQ/rbRe:XLwc9e7xoR5BDCgPMQfU3I","tlshash":"56f2f12f58773be86d763b7184e94068b008659b7f4b0c56087f338b866f73617e11a6","first_seen":"2026-04-24T23:10:16.777817Z","last_seen":"2026-09-08T23:44:55.179033Z","times_seen":1404,"resource_available":false,"data":null}},"time_used":638,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":433,"receive":205,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/a82ca9605b4140cbbfc044bcd7752cf8?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.389Z","timestamp":1788741144389,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/a82ca9605b4140cbbfc044bcd7752cf8?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:26 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 13767\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 55922\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"a82ca9605b4140cbbfc044bcd7752cf8\"; filename*=utf-8''a82ca9605b4140cbbfc044bcd7752cf8\r\nContent-Md5: p1Kh9Fq6YQfOJ8L6DunvrQ==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fkcg51YbLQx9MO5nQsSWVFLyTbQ8\"\r\nLast-Modified: Sun, 30 Aug 2026 18:56:51 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg119;QNM3\r\nX-M-Reqid: W1lM1pv4P\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: o1AAAACWRDK8r9IY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13767,"size_decoded":14524,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 225x225, components 3","md5":"a752a1f45aba6107ce27c2fa0ee9efad","sha1":"4720e7561b2d0c7d30ee6742c4965452f24db43c","sha256":"6fd2efe42cbf85720706e6a175d597ba4c75e923fd7fc95a3c219384150b57eb","sha512":"05d38a4d295668a9f5acadf2c1564d1b3a7e1b96d66a2cc72276ad30f87154c72f9b08a4d74087fdece4ad65187c59e6a82410673176dbb599da98dcfc62db00","ssdeep":"384:7OX1j4GdG0hlZQLuBTZja/eYCdCh9eIOGfSlcoi8F02:CFj4GsK6MQfmChoIlSu2F02","tlshash":"6a527dfd6eb0c12ec5de5ea6d2b6179753638258fa0f9035b580c6c34b3a729211cc9a","first_seen":"2024-08-19T15:01:26.082997Z","last_seen":"2026-09-07T08:08:08.228848Z","times_seen":10,"resource_available":false,"data":null}},"time_used":2614,"timings":{"blocked":2305,"dns":0,"connect":0,"send":0,"wait":309,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/7ac35ae602884ab19c64034091efbf63?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.390Z","timestamp":1788741144390,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/7ac35ae602884ab19c64034091efbf63?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:26 GMT\r\nContent-Type: image/png\r\nContent-Length: 22062\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 55922\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"7ac35ae602884ab19c64034091efbf63\"; filename*=utf-8''7ac35ae602884ab19c64034091efbf63\r\nContent-Md5: phFN2LJWy/1zHCBYiPUCuA==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fv8PhOCARNslZSo0sZ4_9I0ISBBr\"\r\nLast-Modified: Sun, 30 Aug 2026 18:56:51 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: 4GQaEhuhW\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: b7AAAADnBzO8r9IY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":22062,"size_decoded":22818,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"a6114dd8b256cbfd731c205888f502b8","sha1":"ff0f84e08044db25652a34b19e3ff48d0848106b","sha256":"6528d2c89abe8c56f9633d2df48c588f69c994699c6d5783f72a36237846e17e","sha512":"2de345c46e49d017768a6e93e90642ae00c7fde3300cd28d58cfca1a465014ca4c77a4710684cc563b5e9cf0a2687227b1b757275076476e99edcace3292c535","ssdeep":"384:WcIHK3j2mSCCJ6xiMXJ6ktVHdQA0ubFf9zvhhe4NpmRwJQW4u4t3xYLD:KKdCExTJ6SVOivvhkWpmKQJhiD","tlshash":"04a2d1ea1a152e26c5f9469395ba0f95c409c19c45800322d1f2dab1fcf9c907bd9f4b","first_seen":"2025-02-26T14:48:47.788238Z","last_seen":"2026-09-07T08:08:08.457667Z","times_seen":29,"resource_available":false,"data":null}},"time_used":2679,"timings":{"blocked":2331,"dns":0,"connect":0,"send":0,"wait":312,"receive":36,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/e97056976eb249419eff56ef55014133?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.432Z","timestamp":1788741144432,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/e97056976eb249419eff56ef55014133?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/png\r\nContent-Length: 143477\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 28037\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"e97056976eb249419eff56ef55014133\"; filename*=utf-8''e97056976eb249419eff56ef55014133\r\nContent-Md5: paG5aI25ckgcB1mehDyYUA==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FnDYfyJ8vumsiAAfIvZtYuvNq__p\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:44 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: kaArQdgrW\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: -6QAAADyYloZydIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":143477,"size_decoded":144234,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"a5a1b9688db972481c07599e843c9850","sha1":"70d87f227cbee9ac88001f22f66d62ebcdabffe9","sha256":"5c68a3d28d79046688186200e055798ec482f40d85b98b39743a13644461caf0","sha512":"217a0268d1220319be8a26459cec78ea15fe949efc9319a0df6892acb4ec7ae8bebb9de3d993d23cbbbf5029e6365c58cbb26b15298160ba590199e9055500dc","ssdeep":"3072:SDqODVFnhvxFr3IXRuZEIR9Vay26ieEAzE3a8BQiZpbUiTpZ7eO0sgiy:cDVFnhTr3SRuOWiy213t7bUmaO0viy","tlshash":"21e312cf6edd11e03efead50dee853414014a87993eb42600a59a4dabbf47731bd2982","first_seen":"2025-03-28T18:20:50.099538Z","last_seen":"2026-09-07T08:08:08.409896Z","times_seen":17,"resource_available":false,"data":null}},"time_used":5153,"timings":{"blocked":4639,"dns":0,"connect":0,"send":0,"wait":268,"receive":246,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/c87a991bca06435a9cd8d79f108796e9?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.443Z","timestamp":1788741144443,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/c87a991bca06435a9cd8d79f108796e9?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/png\r\nContent-Length: 48372\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 27129\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"c87a991bca06435a9cd8d79f108796e9\"; filename*=utf-8''c87a991bca06435a9cd8d79f108796e9\r\nContent-Md5: OW7k/dXM1Djiht27tCnhkg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FtSccDNUdaY55HgR6bMASdcG-I3H\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:54 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: ahJx60R3n\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: OtAAAACVhsfsydIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":48372,"size_decoded":49128,"mime_type":"image/png","magic":"PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced","md5":"396ee4fdd5ccd438e286ddbbb429e192","sha1":"d49c70335475a639e47811e9b30049d706f88dc7","sha256":"4d6afc2c34275e35e5c95ac3ab72056be88c2f3befe7d3ea418b7e742b8128a4","sha512":"cacc91d306380336979779f3c8e9480a286dc5802893d1598bb0394c71234eff77fb574db3e1cfbf914bb3fea0c6c3f207948f689bccb77e0e3e708d18d497c2","ssdeep":"768:yyHFN2QyOyXT4dbqs7io6Jf0adA1Obndw0CXgRyTuv9Sa4/NRn2G7JzVST4Ew3:yaeQ+T45qCQf0adaObO0v4up4FRJP","tlshash":"df23f1681194e1f86eeffc7cf852b06c2d2a50d9d46f1978340d1261811dcda63ca6ee","first_seen":"2024-12-22T16:23:43.793135Z","last_seen":"2026-09-07T08:08:08.24078Z","times_seen":72,"resource_available":false,"data":null}},"time_used":5467,"timings":{"blocked":5183,"dns":0,"connect":0,"send":0,"wait":252,"receive":32,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/img/away-bg.00d4ba2a.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.512Z","timestamp":1788741144512,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /img/away-bg.00d4ba2a.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://g36b.top/css/home.1781011881923.38488e2a.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:26 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:10 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281706-f2b\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nAge: 48510\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8c1a07947d6c78122\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3883,"size_decoded":4395,"mime_type":"image/png","magic":"PNG image data, 277 x 80, 8-bit colormap, non-interlaced","md5":"ce3e5a71ef5dcf15c030882243e12315","sha1":"d4fdd1329ecac30941a67bd5108bad525c791c12","sha256":"3c2aad01ce2fce6463d6ed3bde348515922dd019d8a670b07b53d66b39c68d3d","sha512":"f6a55d8c079529988760a1c22541c097af159a3653f5ffe89c5c31ee20371f2c879c64797319f4176be77c821294f0f72d83ad77f2a0141203c857c8f987966c","ssdeep":"","tlshash":"6f815cf693e66bd0d5675106a3a14c89624d69d925a325530923f45ec3bb1ac02fe381","first_seen":"2025-08-29T11:05:53.10673Z","last_seen":"2026-09-08T23:44:55.164977Z","times_seen":2420,"resource_available":false,"data":null}},"time_used":1912,"timings":{"blocked":1602,"dns":0,"connect":0,"send":0,"wait":310,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x422_936e6f39-c72d-42ec-ab51-2bd5a806c902.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.642Z","timestamp":1788741144642,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.gasdg646fs224cn.com/gpmaster/_webp_size328x422_936e6f39-c72d-42ec-ab51-2bd5a806c902.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/webp\r\nContent-Length: 15760\r\nConnection: keep-alive\r\netag: \"dbd5bbca2ac98b7327bec49ec9e17a87\"\r\nLast-Modified: Tue, 02 Dec 2025 14:11:52 GMT\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nAge: 42523\r\ncf-cache-status: HIT\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9IH20hJdNVfdCVPgsjMjxMMtVmRLmZEYeRmjP1ldtbhr85m1ZFE6gjgObS4mRHOy%2FNR%2BTV4Hm1WziRlIuF1OAQx7ODWolFYafXeoNH8Yst4z5W%2BnLnGrL6JpjtEUUPmGelBDObapMOlAc3dZU4UAWe4%3D\"}]}\r\nCF-RAY: a36d8fb62e6f3424-HKG\r\nCache-Control: public, max-age=2592000, immutable, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8e1a07947e68177ee\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":15760,"size_decoded":16669,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"dbd5bbca2ac98b7327bec49ec9e17a87","sha1":"7ad876b6c3f6922c1cff9db452948604cfc691cf","sha256":"12e3a0e3de790b5f640b48e4fede8f5d1c881e23b4d710d1971282362277eee3","sha512":"c96a4f88a602c4bd5d8ccc3a0ae44ca9d85d5a75175b8b8c219c527d2ed1338b8d65e9bc52e9c1e844f34aa76e6d0d1d81c4eea6b28592de710a4f4922b11701","ssdeep":"384:z25GXKCP2DdvL8cWHImH7LKcCZzFwu/6unzgL4X9:S55Ce/xsln46un88","tlshash":"f462d0149f5537278cc4787941315fbf7f601c42b208e45296ffa86bba2c2957a146f3","first_seen":"2026-04-24T23:10:16.813188Z","last_seen":"2026-09-07T08:08:08.144453Z","times_seen":1154,"resource_available":false,"data":null}},"time_used":5846,"timings":{"blocked":5543,"dns":0,"connect":0,"send":0,"wait":303,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/ab51fdcf93da4720aaa914f6bc79e046?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.377Z","timestamp":1788741144377,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/ab51fdcf93da4720aaa914f6bc79e046?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:25 GMT\r\nContent-Type: image/png\r\nContent-Length: 18742\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 90117\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"ab51fdcf93da4720aaa914f6bc79e046\"; filename*=utf-8''ab51fdcf93da4720aaa914f6bc79e046\r\nContent-Md5: CzcX8wQRCEcFp1EpD4yy8A==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fj-F0yNunwsUHDOwmADN5N72oRKr\"\r\nLast-Modified: Mon, 31 Aug 2026 18:52:26 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: eq8DDJ4vM\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: lj4AAADaVkKikNIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18742,"size_decoded":19498,"mime_type":"image/png","magic":"PNG image data, 196 x 238, 8-bit/color RGBA, non-interlaced","md5":"0b3717f30411084705a751290f8cb2f0","sha1":"3f85d3236e9f0b141c33b09800cde4def6a112ab","sha256":"e82cdc68654a7b3d7154aae6b69abdd68d5a0ee8d4b85c34e3e36bd700a6976f","sha512":"a74c0fc219ac4b7b6bccbcb29e3bd3fd65551fb26f0ab826c74fc8dc790b17f4b22ea25a4d7e95b473aaff905619092b9a080709cf444455fcecf156239cd483","ssdeep":"384:yjY6LbA/z6CpVOtOYRl1zTq0wZd/m8+3PevkVy3yD:YdA76CPO51/q00m0kVQO","tlshash":"9382e1503f1f20495a2168aac67c0fb9c4bd5fbc2a53b317317d7aa689982f033e5355","first_seen":"2025-07-04T22:03:39.323145Z","last_seen":"2026-09-07T00:33:21.907272Z","times_seen":34,"resource_available":false,"data":null}},"time_used":1661,"timings":{"blocked":1319,"dns":0,"connect":0,"send":0,"wait":318,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/54c8c3d7a2994598ae6cd0ae89bc399b?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.403Z","timestamp":1788741144403,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/54c8c3d7a2994598ae6cd0ae89bc399b?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:27 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 13101\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 30442\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"54c8c3d7a2994598ae6cd0ae89bc399b\"; filename*=utf-8''54c8c3d7a2994598ae6cd0ae89bc399b\r\nContent-Md5: Jy523aTNV03jpem9iBuG0A==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"Fkr_IeIlg1lcUkArNOp0TWtHrMST\"\r\nLast-Modified: Tue, 01 Sep 2026 18:50:27 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: Q99j3G7KS\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: viIAAAA9OdDoxtIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13101,"size_decoded":13858,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 225x225, components 3","md5":"272e76dda4cd574de3a5e9bd881b86d0","sha1":"4aff21e22583595c52402b34ea744d6b47acc493","sha256":"678a2046d7fb5a0e3dfbd8bab4fb856cad030fe218c1fbc5c1cdf92ae902e76b","sha512":"4efbbfda7aef8acb34adba3af5c9c2c58a07b5ec6a9ee5d9b9c1d4e34d0d40c244576e1d8c46a4313bb659aa6867a463abcddc57c46fdd52d96f74e8a411e5a8","ssdeep":"192:0NBCO4zd3rLHu7gD2KY98T+VLPWEZfpqsbDtChBd+LmL6s4N:Sl4ZXHu7gKxOTOPhptbRSBd+LmWs4N","tlshash":"2e42ae2a4c80e81fdf8fc16f605bc337f65a9a36b0f9db056c4d2ae6c80c452641d315","first_seen":"2025-02-26T14:48:47.839336Z","last_seen":"2026-09-07T08:08:08.269599Z","times_seen":20,"resource_available":false,"data":null}},"time_used":3328,"timings":{"blocked":3060,"dns":0,"connect":0,"send":0,"wait":268,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/ecb/8f8306425eba6e0167bcdb25a31b67ec8f","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:23.425Z","timestamp":1788741143425,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /ecb/8f8306425eba6e0167bcdb25a31b67ec8f HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://g36b.top\r\nXign: teAnffdHmAJIDyOZf9o/MTrSBaVnTrbkV1HjiqVXOCYEAyt+aEbMFdfBMgH4e2C40tg8xFk0tsfoFZExNDvcErT+/bUxDzJnZrg34twYv/DTrnrgBz5cu6qba9jBTomTPPk2p1tOH91MVosQX9cHtZQ7mLhExNS79zlXOajwIWo=\r\ntimestamp: 1788741143420\r\nsign: 63o37l597s7o5622\r\nversion: 5.6.12.0\r\nclient-type: web\r\ndevice-id: aDntxNnwbrytXeEW4SJfGsaRdsx3tyZ3\r\nlang: zh-CN\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:23 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Mon, 07 Sep 2026 00:35:23 GMT\r\nCache-Control: public, max-age=180, s-maxage=180, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nX-Request-ID: fbc435067cf04520838efe8f696e59ea\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c941a07947cc018266\r\nX-Cache-Status: BYPASS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4063,"size_decoded":4883,"mime_type":"application/json","magic":"data","md5":"cbe451604d9b3537f1c7e08876e47a9c","sha1":"4e69c8423a61b1c38e078d5c2684fe606fda6e8c","sha256":"9c777c114539f2e6ab176e6a3fc4b20fa9a353b4e4ababb9fa6d50f3316f6579","sha512":"00f3fa0cc5e9be950206ba3bcfc631f373d39e85b8d483678884c95332bcdf3f563db8aaa36211ea525ae2a5770b8065ec4c3324a3cce551fb4487eb51245115","ssdeep":"96:eOGS7hTEAzTS6qcngDyVxtSy8F0gudjORXWaVcTi4HM/Bkzu4n79LANSW2lONSVg:VP7Sa7qcgDMxC0fxaVaM/BkzlSo0NSq","tlshash":"6bc16dd08330e320f625e7dd0ed79ac19345299d93be7602ee2053d66da42da63ac72d","first_seen":"2026-09-07T00:32:02.866395Z","last_seen":"2026-09-07T00:33:21.910282Z","times_seen":2,"resource_available":false,"data":null}},"time_used":306,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":306,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/985a6b66f4c04262b22803fd1f735e7f?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.448Z","timestamp":1788741144448,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/985a6b66f4c04262b22803fd1f735e7f?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:30 GMT\r\nContent-Type: image/png\r\nContent-Length: 56118\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 27129\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"985a6b66f4c04262b22803fd1f735e7f\"; filename*=utf-8''985a6b66f4c04262b22803fd1f735e7f\r\nContent-Md5: Nr9b8Mj98IwScBJICPBg4Q==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FgpG1pA3Z2x7nDjpQECNF2DXgGAu\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:50 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: 5cCNyy4I9\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: ZbwAAADmT-nsydIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":56118,"size_decoded":56874,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"36bf5bf0c8fdf08c1270124808f060e1","sha1":"0a46d69037676c7b9c38e940408d1760d780602e","sha256":"418356a85970daaa8cfe95a4531db04a3739609c5ab7d5d07450f53db473002f","sha512":"53b38b34f05f564aafd8d22e0b634b24a9c16f56a8c52ccba18aaa33d54cd0706f7e388ef1657f36ebef98dd213a27d1fc1d311c0282c9ae869d9faf800c8e0a","ssdeep":"1536:wyHMLt/aAv+GzelUeq5/qplJVRCrfwV10tK:wyHM/aS3SUee/2lJVUrYV10M","tlshash":"ce43f2cae2406d5346fb513479f964aac9f5902ec842c906e8b85099f09332ed5cfb6e","first_seen":"2025-02-04T17:13:01.158425Z","last_seen":"2026-09-07T08:08:08.161482Z","times_seen":256,"resource_available":false,"data":null}},"time_used":5708,"timings":{"blocked":5421,"dns":0,"connect":0,"send":0,"wait":260,"receive":27,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"g36b.top/img/pay.8f35ebe1.png","fqdn":"g36b.top","domain":"g36b.top","tld":"top"},"ip":{"addr":"154.39.104.134","port":443,"asn":140224,"as":"STARCLOUD GLOBAL PTE., LTD.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:22.682Z","timestamp":1788741142682,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"g36b.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Aug 2026 08:35:54 GMT","end":"Sat, 28 Nov 2026 08:35:53 GMT"},"fingerprint":{"sha1":"24:D0:45:66:DE:8F:B3:7B:2B:10:72:96:8A:59:56:DB:65:A9:08:38","sha256":"ED:45:48:A1:BD:03:DA:45:8D:97:7A:A3:5B:AF:BB:56:C7:EC:95:81:48:FD:F5:B7:5D:A8:6D:99:1F:EA:82:A2"}}},"request":{"raw":"GET /img/pay.8f35ebe1.png HTTP/1.1\r\nHost: g36b.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:32:26 GMT\r\nContent-Type: image/png\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Tue, 09 Jun 2026 13:37:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"6a281707-154d\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nAge: 34402\r\nL-VIA: l1=TqoDVanjjr6wMExF\r\nL-VERSION: 1788082833\r\nL-Request-Id: 5c8e1a07947d80f77e2\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5453,"size_decoded":5932,"mime_type":"image/png","magic":"PNG image data, 492 x 132, 4-bit colormap, non-interlaced","md5":"05d444b76263f6958a37ac82e45daa67","sha1":"a067d3a654da1ec4c51d8f049aabaa112183e355","sha256":"49166910b376f5487f30174e60fcf13aaaca9620ef1aa58cfb2c94a8c111ea8d","sha512":"7d276d57b068ec4a0125512e0781c501a96bf6c30b30304d247251190c6421a9ed7a03ec208a590d19d9a1183e3837b06d141bddd99abb7b0ee4e2a1ba28b28b","ssdeep":"96:u9g9Yof8+keuD1Kai/MXG5BHMsDiCNPFH/qX4iWXnqvcIzDRHSVyl07TrOKCm0R4:u9g9rJuYai//7FiSXnqvNYGmrOKcPwzp","tlshash":"74b18e749d6efb2a26b315c30d7499c21ea45c9e0d94f1c2244776963c732de3270985","first_seen":"2025-08-29T11:05:53.301829Z","last_seen":"2026-09-07T08:08:08.102445Z","times_seen":2558,"resource_available":false,"data":null}},"time_used":4120,"timings":{"blocked":3821,"dns":0,"connect":0,"send":0,"wait":299,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"g36b.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"g36b.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/d5fe7e41c97b4648b531e2655864c1c2?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.416Z","timestamp":1788741144416,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/d5fe7e41c97b4648b531e2655864c1c2?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:28 GMT\r\nContent-Type: image/png\r\nContent-Length: 115550\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 30442\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"d5fe7e41c97b4648b531e2655864c1c2\"; filename*=utf-8''d5fe7e41c97b4648b531e2655864c1c2\r\nContent-Md5: nXDAMDyZQtwL4wzH4f5Gcw==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FkhV7rApBUZfjjF9TdHwzDa3efyl\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:36 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: d4jg7bIcC\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: d20AAAC43gXpxtIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":115550,"size_decoded":116307,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"9d70c0303c9942dc0be30cc7e1fe4673","sha1":"4855eeb02905465f8e317d4dd1f0cc36b779fca5","sha256":"d4d176ab43ecdef2eed76ef6ab5ec972de80c9a48f4f99e10fb55e7d3282b020","sha512":"ca43dfc3afa500febaec6e0c43e1ddb0a06c9c79a21aedc123ea9c16131d9d9e20cd47d6706ea589522e21613902408fcaf3c9b4553cb7edf4ac67e544655e93","ssdeep":"3072:3Qh6LCgq+0IxWGwF0CC1hu75l1jmgJmFHChx:AEZ0IwG7A1jmqx","tlshash":"2db3122f41ac83b4d2a32e06fd5f2ff1d282d4ab60d36ec8e952593614771ecc92159b","first_seen":"2023-08-17T12:39:32Z","last_seen":"2026-09-07T08:08:08.149207Z","times_seen":43,"resource_available":false,"data":null}},"time_used":4018,"timings":{"blocked":3693,"dns":0,"connect":0,"send":0,"wait":259,"receive":66,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/27fc6bfd948c400cbf88f7917acbdef4?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.240","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://g36b.top/","date":"2026-09-07T00:32:24.442Z","timestamp":1788741144442,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/27fc6bfd948c400cbf88f7917acbdef4?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://g36b.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Mon, 07 Sep 2026 00:32:29 GMT\r\nContent-Type: image/png\r\nContent-Length: 8139\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: X-Log, X-Reqid\r\nAccess-Control-Max-Age: 2592000\r\nAge: 27129\r\nCache-Control: public, max-age=31536000\r\nContent-Disposition: inline; filename=\"27fc6bfd948c400cbf88f7917acbdef4\"; filename*=utf-8''27fc6bfd948c400cbf88f7917acbdef4\r\nContent-Md5: eVcSf5ZDTW57dUHSlDZVGg==\r\nContent-Transfer-Encoding: binary\r\nEtag: \"FtXm9YpIjacI6t1E4XAYzUPnHhjH\"\r\nLast-Modified: Tue, 01 Sep 2026 18:48:54 GMT\r\nX-Log: X-Log\r\nX-M-Log: QNM:wldsg121;QNM3\r\nX-M-Reqid: RYjHsyoff\r\nX-Qiniu-Zone: as0\r\nX-Qnm-Cache: Hit\r\nX-Reqid: -2IAAACBY8DsydIY\r\nX-Svr: IO\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8139,"size_decoded":8894,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 8-bit colormap, non-interlaced","md5":"7957127f96434d6e7b7541d29436551a","sha1":"d5e6f58a488da708eadd44e17018cd43e71e18c7","sha256":"12f01e15a93c7c871289f0b963b577b43a72ea85abc5c4df5c7176da9d186feb","sha512":"3bce424d574ad3ffe1f86b51bbc8cc3b55fbc66c067007373796665293c739b26c8c3dd4bdc7702c800efced16cda872f23a1e7adfdd7fec1d55ac43d1c67424","ssdeep":"192:0+U83BNcZMB3hWeJEApc1U7ZweNcSA1IxwvGko:0kBNdhmiUIGo","tlshash":"ebf19f474f832f60c6243d7b1d131dea2aa71c2f72457ab12968cd4f6f26b001a526db","first_seen":"2026-08-08T00:56:42.163413Z","last_seen":"2026-09-07T08:08:08.086491Z","times_seen":23,"resource_available":false,"data":null}},"time_used":5405,"timings":{"blocked":5149,"dns":0,"connect":0,"send":0,"wait":256,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}