{"report_id":"dcfc7d56-f71e-47a5-b703-e569b1fbd5b4","version":6,"status":"done","tags":[],"date":"2026-01-14T15:11:00Z","url":{"schema":"https","addr":"io-28.com","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":0,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"io-28.com/","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"title":"加拿大28 - 官方平台开奖数据 - 实时更新","dom":{"size":12080,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"127e0950377c492b1e955c493b4766d0","sha1":"41b72851dbb997ea995ec1a1e7f80f74ab58e383","sha256":"b0fa65afeff9e2b69bfa059e728e3b906c4dc6b14c18e2396c82bfbd960f7a4e","sha512":"47f080b0d832b80795e0e05181a1bf4f07d6282afc02efc5853a74397c1366c4f7388738102b048ad577d0bdba15acd5cb21482adab5209a3a25d5c22e5b6764","ssdeep":"192:pCC0O/OZwmkPHgFkF0IXvwtNlwiwpp8kp1aCp8ahFwu4LlEa0OjFSXGPnYYsFpWS:MHO/OZniHgFA0IXvwtyFpWS","tlshash":"e1421fb185f6482712b390926969638b2fd9ea73c81b4b417bbc5be89fc7d91cc4310d","dom_hash":"domhash256e285f503b33192764118024c984d8","first_seen":"2026-01-14T15:11:06.679959Z","last_seen":"2026-01-14T15:11:06.679959Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"io-28.com","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":0,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-18T15:11:00Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"cheng88888.com","ip":{"addr":"122.10.18.4","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"domain_registered":"2025-07-15","domain_rank":0,"first_seen":"2025-08-31T14:29:35.029965Z","last_seen":"2026-01-09T10:40:20.235987Z","alert_count":0,"request_count":1,"received_data":3201,"sent_data":423,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"tongji.kaiyunh5.cc","ip":{"addr":"154.85.235.194","port":443,"asn":134175,"as":"UNIT A17,9F SILVERCORP INTL TOWER 707-713 NATHAN RD","country":"Hong Kong","country_code":"HK"},"domain_registered":"2025-07-14","domain_rank":0,"first_seen":"2025-09-22T20:25:40.959647Z","last_seen":"2026-01-09T10:40:20.854342Z","alert_count":0,"request_count":3,"received_data":69588,"sent_data":2207,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"io-28.com","ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":47,"request_count":47,"received_data":4041682,"sent_data":25264,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"cheng88888.com/link.js?0.9237455866470246","fqdn":"cheng88888.com","domain":"cheng88888.com","tld":"com"},"ip":{"addr":"122.10.18.4","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"c7656a07d710557fc36453a5a3177b94","sha1":"3bff2fcfda15ba1b13d0c7d818e6862553978db3","sha256":"a1faf75964265fadea64688779b0d5414f490cbe80ae87c169c4b4ad343062e4","sha512":"21c747a92f5b0e55169112329ea863ca80a12b62a617fd40b7f7d02449422798de20f3043be4414a003fac785dbcd05a7d6c509dd3e9af149fe180fb24a29f66","ssdeep":"","tlshash":"4f51eb6b55d54c44099b90341afb652c90bfb00fe89d98487e9ddb601fb302bfec62b9","size":2842,"data":"","first_seen":"2026-01-14T15:07:41.511254Z","last_seen":"2026-01-14T15:11:41.845833Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"introduction_type":"eventHandler","is_inline":false,"md5":"e56ddbb05a974a6bc5ea44661e509a21","sha1":"448d4cb69f9441e10731b1ff4aa9dc81502589bd","sha256":"1759e8c6c2ce9c987245281cd33bb9260ce82e31b604131a5da486db89369913","sha512":"a3b2b0accbc0f18d13fc0eb6d742a5bf00a9614399e05b97b96ed0963e7d29b5868f73ef541c5f5bf8d125e7f7040d03f39cc853a52ffa2f1e2ebb7a20165242","ssdeep":"","tlshash":"7b700008080000800a002c00e000020080c2000802202008c020a8a0082c088808f800","size":21,"data":"","first_seen":"2023-04-10T22:51:51Z","last_seen":"2026-08-03T23:52:33.487969Z","times_seen":49171,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/io28com/gate.php","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"d36d4a3956121a110a96afd809592903","sha1":"fca59a09b59d11b881d51009ba6cd507d7a2a23f","sha256":"248db9d114b9231135bec02e312a79fa49f85cd6632ff627f42a5bffa61ecca9","sha512":"a4b6c743d53edaf7c02d11dcdeabb859a014242d80a51c08d22518843b09e596875a82e53bd73d7751b55ce17a53d0d972260a662d75d7e1eabbe7595494a593","ssdeep":"","tlshash":"a5412337ba5214311066924d3ab7c70875b2001f9a85e105b3dc901c6fadd6b1cf9bbc","size":1990,"data":"","first_seen":"2026-01-14T15:07:41.501206Z","last_seen":"2026-01-14T15:11:41.810037Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/io28com/js/bootstrap.bundle.min.js","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"536de8addabd2370a5d30ddf84024f6e","sha1":"60935e9d37fef875d40346fa1ca00eade4f0bc9f","sha256":"940460a8a7ce141f03d90f82ed57f95a99ebdab1a50af1ee5b9726c0488f7eeb","sha512":"48a8c2a4a56648e8346283b3bba753f0106e98b21bae75f9a48838c09bfc709df9b2a791c2162997a3150249c360658169fc229a5dbb0e94f83584460406ed23","ssdeep":"1536:WSwJiEbnTl6R2t49CFliFCIg/yWszSraJd5qUFH9tZwcE+iYZMgZdj:lwfs+SSO5q4tZwcEVYZFj","tlshash":"5883b5593244b8730ade85b68037430bf2265998b14b812cb57cadde2a7dcc67277f78","size":80858,"data":"","first_seen":"2026-01-14T15:11:06.681199Z","last_seen":"2026-01-14T15:11:06.681199Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/e/dongpo/tz/yu/yu.php","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"a7a3b03d627d14d94a68e854afca0e38","sha1":"8954ddd88b4043c200eac7794e343fbd0cdfae07","sha256":"e8e21444a4149076011ff28c6af329f7e0110c565db65e324604f97d6e448d1f","sha512":"6d94ebbe32c426bd3fe982437677d76dc4dbd31118874a07deb353d7f4e62e98ae99981ac8ee94a73b9ec9f71fce61585b507954d1c785ea870623f05d03a80d","ssdeep":"","tlshash":"76b02b075d13cd10435400c0d671e118c034e21b9d00c8419098108866507c84c14860","size":129,"data":"","first_seen":"2025-09-25T11:40:08.614354Z","last_seen":"2026-06-06T02:24:29.588427Z","times_seen":30,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tongji.kaiyunh5.cc/matomo.js","fqdn":"tongji.kaiyunh5.cc","domain":"kaiyunh5.cc","tld":"cc"},"ip":{"addr":"154.85.235.194","port":443,"asn":134175,"as":"UNIT A17,9F SILVERCORP INTL TOWER 707-713 NATHAN RD","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"4b32d11120a738ec529e5d64979e9d10","sha1":"deedcd7014f47a999da6c19786713cd7a236040a","sha256":"1762dd6a64fcd59421610b68625258f9224a1f278159c4d99282adb631470465","sha512":"258a126ba730a9f57d0adef037bdf90f349265128ceb8d7d9e5c7754eb14751895dffb3220bc1da307021ea8c37c45b837064c89731313acf22a3245b3812452","ssdeep":"1536:ATgnSINAJrRJqerEKlFXhuXEjmbMNfwS9h2BLy1z71B8I6fJIKIQaFLa:AT+Z2fuqXYy1PGJ9d5","tlshash":"3963d8ce72c2753a4bcb6075a43f114ab27e9caa1448c4b4e62ac4f6383491d657bf7c","size":67972,"data":"","first_seen":"2025-09-25T22:45:46.07207Z","last_seen":"2026-08-03T18:53:25.927801Z","times_seen":17638,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":[{"md5":"772105dfc6d78926aa1162eb63b35b08","sha1":"b3eec84bf82370a6507e4f69094b07f34dbc7b45","sha256":"72aa07a2c0a1633e6a91475508d29f1eff2a1f824da82fe9b7dd247bd22ef5bd","sha512":"7acc66d0fbd46b16953612c2b9a9ca20800faafb77b418965d7aa459533c7a97b47eb30af763f4e68808b2b894a56ba147eb91c0201b6bb8abbd59dbe02e881a","ssdeep":"","tlshash":"b1b012830c11c040874054c4d071f41cc050a30e95a0c88185e4708831245eec9780d4","size":96,"data":"","first_seen":"2026-01-14T15:11:06.721458Z","last_seen":"2026-01-14T15:11:06.721458Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"console":null},"http":[{"url":{"schema":"https","addr":"io-28.com/io28com/js/bootstrap.bundle.min.js","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:39.892Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /io28com/js/bootstrap.bundle.min.js HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:40 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sun, 11 Jan 2026 07:11:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69634d21-13bda\"\r\nexpires: Thu, 15 Jan 2026 03:10:40 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":80858,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65262)","md5":"536de8addabd2370a5d30ddf84024f6e","sha1":"60935e9d37fef875d40346fa1ca00eade4f0bc9f","sha256":"940460a8a7ce141f03d90f82ed57f95a99ebdab1a50af1ee5b9726c0488f7eeb","sha512":"48a8c2a4a56648e8346283b3bba753f0106e98b21bae75f9a48838c09bfc709df9b2a791c2162997a3150249c360658169fc229a5dbb0e94f83584460406ed23","ssdeep":"1536:WSwJiEbnTl6R2t49CFliFCIg/yWszSraJd5qUFH9tZwcE+iYZMgZdj:lwfs+SSO5q4tZwcEVYZFj","tlshash":"5883b5593244b8730ade85b68037430bf2265998b14b812cb57cadde2a7dcc67277f78","first_seen":"2026-01-14T15:11:06.681199Z","last_seen":"2026-01-14T15:11:06.681199Z","times_seen":1,"resource_available":true,"data":null}},"time_used":551,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":551,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/e/dongpo/tz/yu/yu.php","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:40.774Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /e/dongpo/tz/yu/yu.php HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:40 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nset-cookie: PHPSESSID=uvmmd2rhrh8kgeunlcscnsku5o; path=/\njscheck=1; expires=Wed, 14-Jan-2026 16:10:40 GMT; Max-Age=3600; path=/\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":35,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with no line terminators","md5":"b13b6064fca232801a7ed3ca059c449b","sha1":"75e40db5d556460f7721f00204b126399009979c","sha256":"697c72a2041e67629aafea6df1e44ee7d1ecc89c32fbed5e86905a744ac601c0","sha512":"a5e200304051241229c9d96f6aaa0fdfcfce8312c1f9b2aa2b6fe8edc85342adec29e274608752eb07511969072a5369171df2bce50f0124b3a3410ac56e5fe0","ssdeep":"","tlshash":"2c8000ca2f08e2000ac28c2a88b0f00c08b200cb082bf82220ca3002a8083fe0e2380a","first_seen":"2023-07-17T11:42:34Z","last_seen":"2026-06-06T02:24:29.581395Z","times_seen":69,"resource_available":false,"data":null}},"time_used":270,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":270,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/e/dongpo/tz/yu/img/jiuyou.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:10:41.349Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/jiuyou.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/e/dongpo/tz/yu/yu.php\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c; PHPSESSID=uvmmd2rhrh8kgeunlcscnsku5o; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 33260\r\nlast-modified: Sun, 07 Sep 2025 09:34:56 GMT\r\netag: \"68bd51c0-81ec\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":33260,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c8ad931b675f5d8c537b832427535d0f","sha1":"d7a18d16c4a38f97151ad1c02b5c8fbdf3d20f76","sha256":"50bdc8a37b133205854e3d80c490b0f63e4b02837fea30067398075b7e49642d","sha512":"7c55286e0b35a724f116f030b9049857b1d4241aa98597a2e8523bb91a5491f2eb90a375fd4429c3d6ef09c839ff51e95c6efb765440fdbf29ea45b9d4acf195","ssdeep":"768:JONQcgYSNbhjgP6b3vCixS1LHWr9hx7u4ev4SID1z/oX3:INQ4SNBgP6dxS1z4vi4ev4S2zgH","tlshash":"dbe2f1017f06bc3828690d529a1e550d3246dfc61793eef5c5b8374df539724065b4c2","first_seen":"2025-09-24T09:47:29.013234Z","last_seen":"2026-05-18T18:12:32.966501Z","times_seen":23,"resource_available":false,"data":null}},"time_used":205,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":203,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/e/dongpo/tz/yu/img/background.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:10:41.577Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/background.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/e/dongpo/tz/yu/css/main.css\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c; PHPSESSID=uvmmd2rhrh8kgeunlcscnsku5o; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 16850\r\nlast-modified: Sun, 07 Sep 2025 09:34:31 GMT\r\netag: \"68bd51a7-41d2\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16850,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1920x1030, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"0eb2c781e3ba5951441d8cedf9d387e6","sha1":"cbd29ba91f9502cf3757f8d92da29469e196ea2e","sha256":"9e0e142bbb79c40e4ec06b28175c4f2332e8d4e6bcf10db8270418c3c9ba96cf","sha512":"fea86fe00df6dc6de8ee742faf252c575c75e21ad06baf7b4cdf7c9dbe5f0b5c09db00bc637ce16cc4171061d11af4c3219f7abe62a9c2cfbf808de92561e2d0","ssdeep":"384:1a1+BrAsLbqXyH1JVGns2mAPxJErGRL/R1DevdACI1qB:1OfzE1JV4l5Td0VA5a","tlshash":"ee72e0c9c326e485921e09b0949212f871d7bfa6754da61c49f5bfec93a483be845c33","first_seen":"2025-09-24T09:47:29.008993Z","last_seen":"2026-05-18T18:12:32.964182Z","times_seen":24,"resource_available":false,"data":null}},"time_used":202,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":201,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/e/dongpo/tz/yu/img/kaiyunlogo.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:10:41.582Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/kaiyunlogo.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/e/dongpo/tz/yu/css/main.css\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c; PHPSESSID=uvmmd2rhrh8kgeunlcscnsku5o; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 15156\r\nlast-modified: Sun, 07 Sep 2025 09:35:04 GMT\r\netag: \"68bd51c8-3b34\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15156,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"37226afe020294b82ec267fab103cdfd","sha1":"b8b307dde0f00251470672845a819a98205f7389","sha256":"1c9ac810fd7faf1ec1d23b474e580b0d2224e6beb51b5dd8fc8cc131217cccec","sha512":"54d150a734f51d59d8c85f1c158408747c96a28534caaf5f26e0c8d31263d350fe7207a3cddb3db02601f3f9ce4d6bf8a93ed37416e711cfc92ee6869ed5361f","ssdeep":"384:nbTn9tCbMpfXO9KiLsJaLNXAHXk080K40nvqqZNE:bTn9tCbMpfXOIGsJ+NX6Xkyz0ni1","tlshash":"4962d1c17fc81185fa2db77a2a58c2a0d388a90c5ed7c677bd2401d2c78ce14f2a9a1c","first_seen":"2025-09-24T09:47:29.021234Z","last_seen":"2026-05-18T18:12:32.934131Z","times_seen":23,"resource_available":false,"data":null}},"time_used":203,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":203,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/e/dongpo/tz/yu/font/iconfont.599951c1.woff2","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://io-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:10:41.619Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /e/dongpo/tz/yu/font/iconfont.599951c1.woff2 HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/e/dongpo/tz/yu/css/main.css\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c; PHPSESSID=uvmmd2rhrh8kgeunlcscnsku5o; jscheck=1\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:41 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 31460\r\nlast-modified: Sun, 07 Sep 2025 09:00:14 GMT\r\netag: \"68bd499e-7ae4\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31460,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 31460, version 1.0","md5":"b0530b23615e0bdd80af2c1d798dfa67","sha1":"5b81dde90f5c33b9281dde774eb34fec622a3630","sha256":"407a95e9d3f3d987e7f5d7a73e7cb743c3f4525260ae3b00acff310aa719e0dd","sha512":"581639e8a210142ca9e71eeaa0ba00d4e6bdd968b80062d651d6bb04fc2c9b336b4dd39422a74f493675adcb485f70fade26a788260151379a5bc93c0bc65cd8","ssdeep":"768:cIcVR2hPAcTmEgVT9BZlkrnOQZS19fRKf:Y0hPYxxBZ66QZS1JRKf","tlshash":"87e2f147c0397083eeb52629450793e9ddbf2a91be0c5b20061b613f95ee495c3a772b","first_seen":"2023-05-18T07:54:03Z","last_seen":"2026-08-03T14:00:55.310111Z","times_seen":1055,"resource_available":false,"data":null}},"time_used":203,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":201,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cheng88888.com/link.js?0.9237455866470246","fqdn":"cheng88888.com","domain":"cheng88888.com","tld":"com"},"ip":{"addr":"122.10.18.4","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://io-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:10:41.667Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cheng88888.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Nov 2025 05:37:53 GMT","end":"Sat, 28 Feb 2026 05:37:52 GMT"},"fingerprint":{"sha1":"67:68:64:7A:AA:CA:42:94:E8:14:C9:AF:1B:EB:09:E0:6C:BA:7E:8C","sha256":"65:BB:2E:CB:D1:0A:2C:B0:F2:CE:FF:C9:DD:38:65:E0:65:10:1D:74:AB:BC:AB:A0:94:06:C5:A3:9A:80:F9:FD"}}},"request":{"raw":"GET /link.js?0.9237455866470246 HTTP/1.1\r\nHost: cheng88888.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:42 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 14 Jan 2026 15:06:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6967b0f5-b1a\"\r\nexpires: Thu, 15 Jan 2026 03:10:42 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2842,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"c7656a07d710557fc36453a5a3177b94","sha1":"3bff2fcfda15ba1b13d0c7d818e6862553978db3","sha256":"a1faf75964265fadea64688779b0d5414f490cbe80ae87c169c4b4ad343062e4","sha512":"21c747a92f5b0e55169112329ea863ca80a12b62a617fd40b7f7d02449422798de20f3043be4414a003fac785dbcd05a7d6c509dd3e9af149fe180fb24a29f66","ssdeep":"","tlshash":"4f51eb6b55d54c44099b90341afb652c90bfb00fe89d98487e9ddb601fb302bfec62b9","first_seen":"2026-01-14T15:07:41.511254Z","last_seen":"2026-01-14T15:11:41.845833Z","times_seen":5,"resource_available":true,"data":null}},"time_used":1084,"timings":{"blocked":435,"dns":1,"connect":212,"send":0,"wait":214,"receive":0,"ssl":219},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/io28com/css/gongyong.css","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:39.874Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /io28com/css/gongyong.css HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:39 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 11 Jan 2026 07:11:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69634d21-89985\"\r\nexpires: Thu, 15 Jan 2026 03:10:39 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":563589,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65496)","md5":"833cd0b99925698a4e82c61cf37f87e0","sha1":"09c525e58b4cfe28b398fc92802dd8621188f50d","sha256":"206026cc7f0809b70fe8153a062083da24fe401c26070f201ab64d8eb435fdbe","sha512":"2fc0e11bab611f7034a62c13859504a0469986b46a092f7d302fc90b25e7b9ef17b8bdec2fa6171ebf0c8283489e7b86eb5a495a83606314b564b48347e189d0","ssdeep":"3072:K7F2yDDaYMCAMHQ5h8GM2fEN0A0VPhzPF6bqbguBNiPDwYWW0KYoE:iF2yvaYMjMRN0A0PhzPF6ubp0DwYzE","tlshash":"93c4c6689200b03cfc1ff5a89b9887cf7151b412e81267eced86b225c5d76f326b5b49","first_seen":"2026-01-14T15:11:06.686503Z","last_seen":"2026-01-14T15:11:06.686503Z","times_seen":1,"resource_available":false,"data":null}},"time_used":559,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":559,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/skin/cover/io28com/banner1-191.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:40.933Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /skin/cover/io28com/banner1-191.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 190796\r\nlast-modified: Mon, 12 Jan 2026 15:02:39 GMT\r\netag: \"69650d0f-2e94c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":190796,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 814x569, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"ef96ca282dd564614bb96b12cdcde8d0","sha1":"f12b59cd1870f14c1f5b4f410658a9f10d8fd914","sha256":"42624790e6b3433d4fe83a59ecea3ae9bc34209511d37cf3a86dca538d1bd736","sha512":"30a4f7f7bd6a6be2f70f484cc2a2afc9a5bc53c896ca4c2ab19d59a8db44549f0156c5428e497b6c850ada04a345cb14004005fd69d08cf9ee7ad834b47db3ae","ssdeep":"3072:AnU7z1VDS1dU9vmO6t/6i4OD9MO1ZtHbar2fK78BtVXrMJpcHbc3NZ/23CtxVYEh:719gU9+O6tr4sjHHaItVXrMcA9N2Ixm+","tlshash":"a51423145c0373509e91ca87bb8df22118908f61a34792f91af165aafb7c8cd06d7f2d","first_seen":"2026-01-14T15:11:06.687376Z","last_seen":"2026-01-14T15:11:06.687376Z","times_seen":1,"resource_available":false,"data":null}},"time_used":220,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":201,"receive":19,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/skin/tb/io28com/io28comhz5.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:41.156Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /skin/tb/io28com/io28comhz5.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c; PHPSESSID=uvmmd2rhrh8kgeunlcscnsku5o; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 7818\r\nlast-modified: Mon, 12 Jan 2026 15:02:54 GMT\r\netag: \"69650d1e-1e8a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7818,"size_decoded":0,"mime_type":"image/webp","magic":"DOS/MBR boot sector","md5":"fe389d24a84b9f472985105956e211ca","sha1":"e98af1344cab177d571343a54d2400bf841b5095","sha256":"b0d10e20199e4ea56ffebbbd2b542445e63bb47c468815ecdc480feacd1de230","sha512":"e349664da3500812eadfbef73037679cc9ccfef70f541dae1f8271550b2bc155ffdd2563b54e0490253dcaf85bbcc1989d6da406b4537400c968ac75c225a482","ssdeep":"192:XykQoNYJ5uvblVME7ZZ2T0w6icVcNyPeyjpqbkewErhmqCJYo:XCoeJ5uvblVMENg0dTXqDo","tlshash":"37f1bf4aecf4261bc06dcd99e7c2e42f199743c3ca1afa79d98d48144cbdf493244554","first_seen":"2026-01-14T15:11:06.688291Z","last_seen":"2026-01-14T15:11:06.688291Z","times_seen":1,"resource_available":false,"data":null}},"time_used":200,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":200,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/e/dongpo/tz/yu/img/aiyouxi.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:10:41.364Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/aiyouxi.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/e/dongpo/tz/yu/yu.php\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c; PHPSESSID=uvmmd2rhrh8kgeunlcscnsku5o; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 33678\r\nlast-modified: Sun, 07 Sep 2025 09:34:16 GMT\r\netag: \"68bd5198-838e\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":33678,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"20d95f56875543e3db12628ba252f807","sha1":"1d138c27eb58239897fc831978d571fdf268e569","sha256":"1e1fbae436c1c4970035f09993b0c0a41f972933f7144b401972ee23ffdb544a","sha512":"5d86196f17a03aaf428125c66a135590de7ca468c939509732444e26dcb283df179ab2a6db3cb10c0d0b067006126e836b764b9d72fe798674f9cbb601d55880","ssdeep":"768:OvQR9vvZ3UFin5prrozg0wMNLzN0o9+v+P+2bT5+DIqz7bT:OYHuMrmw4zyYPFbgIw7bT","tlshash":"80e2f120dd91e3dfd92193864ed4a2a7ee07f015d49eb0901ab558106639f9ec32a39b","first_seen":"2025-09-24T09:47:29.020056Z","last_seen":"2026-05-18T18:12:32.951107Z","times_seen":23,"resource_available":false,"data":null}},"time_used":212,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":210,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/e/dongpo/tz/yu/img/jiuyoulogo.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:10:41.584Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/jiuyoulogo.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/e/dongpo/tz/yu/css/main.css\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c; PHPSESSID=uvmmd2rhrh8kgeunlcscnsku5o; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 66022\r\nlast-modified: Sun, 07 Sep 2025 09:34:59 GMT\r\netag: \"68bd51c3-101e6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":66022,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f9d82754a0c7289017f556c85562cfb9","sha1":"e326e29943603a7c5d8d345f94a12a84603ab2ee","sha256":"dd566ef9d48ad26fef3383ffcd4eeaebccac502c3a43e97eeec29fc2be67f07c","sha512":"cfdfa4d68e6777dd373062444bdd0b51dcc06680227f205d9ab1fdf4598f2459dce7700c6fe8e2d3ae0dfd38facbb0bbf3a4d73e21885f554f27a3d5add87c7e","ssdeep":"1536:v2GQ+bJZjKVYf/iB8ycpoimjc0YKEO9dChPyFc:ugjK22jcp0oOShPye","tlshash":"ef53022e2218e893d053c560934705dcff9f550eecb0b92b04a4fb0cb9ea6455b45e8f","first_seen":"2025-09-24T09:47:29.022465Z","last_seen":"2026-05-18T18:12:32.939188Z","times_seen":23,"resource_available":false,"data":null}},"time_used":213,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":203,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/io28com/css/bootstrap.min.css","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:39.868Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /io28com/css/bootstrap.min.css HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:39 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 11 Jan 2026 07:11:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69634d21-38a79\"\r\nexpires: Thu, 15 Jan 2026 03:10:39 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":232057,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65303)","md5":"2b9fd62a1d91659cab7daf6d4b3dafce","sha1":"a7ae4d0d790b7e7cdad3ec74830d4f3c9a4c10ac","sha256":"ab8fd2b673c4d6db7a20552d1d5eb8ec7c536493d84db51cc71850707db3ed91","sha512":"684221ca21fda9e8e88b9bd36feea7132baf53d91af25d69009ef4d4d2bc50e76ec30654eedf2bc59d72ad7dee74095b9798d65968eca402a9db6951dedfd8f2","ssdeep":"1536:U9CnXGi9GfJkfvq5wlP7cQZDR9uvV982sYRElV6V6pz600I41r:XnXp9GfrV98II6V6pz600I41r","tlshash":"fe3482d6f590317d9ca7c1499681fefd896fa985cb120aa6f003776807cabd30962dcc","first_seen":"2026-01-14T15:11:06.69019Z","last_seen":"2026-01-14T15:11:06.69019Z","times_seen":1,"resource_available":false,"data":null}},"time_used":604,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":604,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/io28com/css/all.min.css","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:39.872Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /io28com/css/all.min.css HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:39 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 11 Jan 2026 07:11:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69634d21-190a6\"\r\nexpires: Thu, 15 Jan 2026 03:10:39 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":102566,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (52236)","md5":"a835761b33f4ecf5956aff0746aa40ab","sha1":"7fe7f8b0d808c55380a747d1b52fdc41adabb70f","sha256":"9835a490c3cbe8e93e2208beba5c7ae2b2c4195a4a893229e3cf537ff54062fe","sha512":"901daa077361ed265ae54f243ff961f7c4193e9f6f0fd42c1a096a03e5867c43621424ee1bf7a80bea1f1f83b77aa7170fbee6b8fbcee560acba3dcdf62abd79","ssdeep":"1536:cwMCMPMCMjMCM4MCMwMCM3sVMX709gbPMfjSFOTyPG9ZpgmLCq:k709gMGFiyPG9ZimLCq","tlshash":"22a3a7f9e44c05d97732c44bab95b37c65b6f738d5810ca9f02f580c1ad26a822c6f7a","first_seen":"2026-01-14T15:11:06.691145Z","last_seen":"2026-01-14T15:11:06.691145Z","times_seen":1,"resource_available":false,"data":null}},"time_used":602,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":602,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/skin/cover/io28com/io28comfuwu1-191.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:39.878Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /skin/cover/io28com/io28comfuwu1-191.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:39 GMT\r\ncontent-type: image/webp\r\ncontent-length: 186716\r\nlast-modified: Mon, 12 Jan 2026 15:03:03 GMT\r\netag: \"69650d27-2d95c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":186716,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 689x459, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"3bd936c78755abad829d2a3dfd94ef81","sha1":"9ba154819172693d47fa5e4a86f0ef70dd1d54db","sha256":"49c35ccec9edfe8c78be2c0215203a8020b83a9ba0b3b581aad4587accc98bf8","sha512":"03ccea8aafc0badffb60b2b888e7589e753012d95d601a79efa4e493de456a03d36cf9044101ca3e751beffdcdc97f1e2c1f85b8569035adcc705e2b124ba34f","ssdeep":"3072:i4MezqkpgejbMao4l+mCCXOYPKwePDnWLtA62ISWYDHUkb4y/jxGAlQVn8YzRvx7:qkppbMPI+mCC+5ZPKLtAhISWYDbbjxLE","tlshash":"5b0413ae1716366e4487091b7881cb18a7aedaea4662133347121225d3cb7ce7af770d","first_seen":"2026-01-14T15:11:06.691848Z","last_seen":"2026-01-14T15:11:06.691848Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1174,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":558,"receive":616,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/skin/tb/io28com/io28comanquan1-191.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:39.886Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /skin/tb/io28com/io28comanquan1-191.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:40 GMT\r\ncontent-type: image/webp\r\ncontent-length: 20910\r\nlast-modified: Mon, 12 Jan 2026 15:03:35 GMT\r\netag: \"69650d47-51ae\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":20910,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 512x512, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"bf35139a308f42d71b69f382ebbcb055","sha1":"d93503511c2f3600244cf47f35fb2c3151ce025d","sha256":"a7564ca558656666cea11449370d5385df57b8791e4b4c7155867e1179a19c7a","sha512":"7a32f4423b18cd9251d39690f07ee56bed9cffcfac36666cdfbb5ce1c15403a69f73eda23ce6a1a26f3bcf65256eee96581a35e132f14b15742b807db74064fe","ssdeep":"384:usTVVVVVaJmQUt4V8ZYGQxjvsX7sY6fXsrZ3C0f8uHPoBumPgol/uRr8kKHiLOEb:usTVVVVVL83g7sYiWZ3ZfFvGuhfN8kKW","tlshash":"ca92d0064013ad70c49d2ba30ee32778934b7ac11b91b476b4bd6cd6bd438f66239727","first_seen":"2026-01-14T15:11:06.69274Z","last_seen":"2026-01-14T15:11:06.69274Z","times_seen":1,"resource_available":false,"data":null}},"time_used":972,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":555,"receive":417,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/io28com/webfonts/fa-solid-900.woff2","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:40.839Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /io28com/webfonts/fa-solid-900.woff2 HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/io28com/css/all.min.css\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:40 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 158220\r\nlast-modified: Fri, 13 Dec 2024 14:50:06 GMT\r\netag: \"675c499e-26a0c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":158220,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 158220, version 775.1280","md5":"4a6591ab5460ae5cbff1ecbd6e52193a","sha1":"7cd8afd6501962fda35d66f0e4c3b8815ac471d8","sha256":"aa75998623a391e61c6901794ace832e3ecdd288b56d608f21bea0411acc0b8e","sha512":"96c5d3283b71613b595b6b0420333bef5d64451af05c59dde27ec5b3e7cfe6e9549c604cddfbcb79cbc0fd4cd6f2e22a130c9a220b1b7ef933ac9df8c8e695d6","ssdeep":"3072:RauSB5FANIRLpsBaBrJGNG3ECNQztRvHHqkqLrlF:guSqN6ptrJGo3POh9KT9F","tlshash":"0ef312a710c6b95684a3a51b336adeb52c3ed363fcb6cd73be340114689da9c2e4d190","first_seen":"2024-12-19T10:41:23.153533Z","last_seen":"2026-08-04T00:30:09.517448Z","times_seen":33051,"resource_available":false,"data":null}},"time_used":217,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":208,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/skin/cover/io28com/banner3-191.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:40.935Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /skin/cover/io28com/banner3-191.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 135276\r\nlast-modified: Mon, 12 Jan 2026 15:02:53 GMT\r\netag: \"69650d1d-2106c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":135276,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 575x439, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c31e8e2684539ffe18404a453b51daa3","sha1":"e9ed49024ee42ff28478d5847353689a9f60da2a","sha256":"e365088626d4fc2e096ed45af7dff3a46fcb8d3e28ba6f4ce601bc43a3921012","sha512":"39e744884bd518a3abb58e96754744f949a032f0d0db9b5e436facaccfbae85673f259b6e9ee37befa4713b0b1c5e1efedbcaae9f0ad1e79c136ad26a4f4efd0","ssdeep":"3072:ilj/s40F2084kfjUpEjMuuqfjAJX1eQ54jGMkBLViOJxKBh37/qe:uE1FrwjOEjMPzP+GhZJQBx","tlshash":"7ad312e0c5bdef976842cea065e75f727249263dafeec311d63b51040eb842ad192d2c","first_seen":"2026-01-14T15:11:06.694312Z","last_seen":"2026-01-14T15:11:06.694312Z","times_seen":1,"resource_available":false,"data":null}},"time_used":287,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":234,"receive":53,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/e/dongpo/tz/yu/yu.php","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:41.096Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /e/dongpo/tz/yu/yu.php HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://io-28.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c; PHPSESSID=uvmmd2rhrh8kgeunlcscnsku5o; jscheck=1\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:41 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\nx-robots-tag: noindex, nofollow\r\ncache-control: no-store, no-cache, must-revalidate, max-age=0\r\npragma: no-cache\r\nexpires: 0\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12392,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"8ac98c83f220ee895bcdcf424131e8df","sha1":"779f8eb397e8dbaaa45fba781cae4a07ca7b324c","sha256":"6227c7978500207c2652ade91d370e1772c6c62eac1b16954f0eceb27be752c0","sha512":"6dd23a7eb982578d866ec2da194bf5c163fe06b5d67db6e2a79edb7836544723d0bbeac62baf70310b81ce8ade50aaed543eb0792f85cc76a5850f51ba9a0bca","ssdeep":"192:zlC0O/OZPmkPHgFkF0IXvwtNlwuu5pTpp8vTp1aWTp8aDTFwuUTLlEuT0ybFSXGe:BHO/OZOiHgFA0IXvwt65wFpWa","tlshash":"e84220b181f6086712b39092696963ab2fd9ea73c81b1b417bbc5be95fc3d91cc4310d","first_seen":"2026-01-14T15:11:06.695112Z","last_seen":"2026-01-14T15:11:06.695112Z","times_seen":1,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":224,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/skin/tb/io28com/io28comhz3.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:41.152Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /skin/tb/io28com/io28comhz3.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c; PHPSESSID=uvmmd2rhrh8kgeunlcscnsku5o; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 6508\r\nlast-modified: Mon, 12 Jan 2026 15:02:46 GMT\r\netag: \"69650d16-196c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6508,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 220x220, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c20138bcda0f60d58d7913b9690aed2c","sha1":"94fe8d798f53b2a835407a5c7e38b8a416ca436f","sha256":"eeedce0bd84bc776c8f39045843755131a952d627b62fff9254278fe112792dc","sha512":"f9e5e349c35a421a37fdb92dd301228bfb59d1ebb3c6e5e9fe13670d242d730f607f68dadf4ac0f6b9bdb6ae71739b2c32c45420e09aa6bd2a2f46df56b478ae","ssdeep":"192:ae+LbSAUNW2Opl/OmaS9snE4aUOHhsstXd:axf3MmmmaS21c2Qd","tlshash":"d8d1ae58319f2dec3a84e1fd59f3d3528a1ebe43426d78907e0984c528b8020fa9f766","first_seen":"2026-01-14T15:11:06.696108Z","last_seen":"2026-01-14T15:11:06.696108Z","times_seen":1,"resource_available":false,"data":null}},"time_used":200,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":200,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/io28com/css/swiper-bundle.min.css","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:39.871Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /io28com/css/swiper-bundle.min.css HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:39 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 11 Jan 2026 07:11:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69634d21-46b9\"\r\nexpires: Thu, 15 Jan 2026 03:10:39 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":18105,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (17812)","md5":"7a1f7c8f81ed3830afac8f5c27502f52","sha1":"c7f99899ef81dcf14cf4ff11c3b02e169a560dd5","sha256":"5424afd58ff6f69c522643b36b1b2124734a0a70fb5ad36752accac1fba2eb41","sha512":"eed1f4559c02d001924ca2b9dbaef5189d191223d75b0f7cb34958fb140037108695ad20971bfcd1f5265cc7185f51e2dba37ede6ce26943f0d17dbece79d2ab","ssdeep":"192:cVmUJbiKne0JlXZHZ+Sme+jexS4nxep/a2GZb0Q5nfufKlAYfg5fyeesedOJ9A5Q:cgUbe0JdZHZ+W+SFnZ24tlWfF4XYz","tlshash":"cd8244a85340282753274f364b71cbb9dd7444d20f9389ae91c0ee48d7fadb9132f6a9","first_seen":"2026-01-14T15:11:06.697127Z","last_seen":"2026-01-14T15:11:06.697127Z","times_seen":1,"resource_available":false,"data":null}},"time_used":603,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":603,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/skin/tb/io28com/io28comanquan4-191.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:39.889Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /skin/tb/io28com/io28comanquan4-191.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:40 GMT\r\ncontent-type: image/webp\r\ncontent-length: 26862\r\nlast-modified: Mon, 12 Jan 2026 15:03:37 GMT\r\netag: \"69650d49-68ee\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":26862,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 512x512, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"9b6ed6313bdbe78ede9b8144edc37eaa","sha1":"fb5172bd771cc653c76a82b0d38ac97f20fe71e1","sha256":"d27e9be882a3e032b84649d799132e034edffed11c9642ceab5518ddae4072f6","sha512":"3b14a9263942e1c5d5acbc1b12ef9fbb34f9f345de4bf65fc92547ed7389bf79f8316424be03a6e6787a2fd2b40a41728927502e15e1d1569b0f49c30cbf645d","ssdeep":"768:nYo9oisqjvNqU15kjlIoFoMc+8v4/xPWezaOj:YWs+vIo5kjSOU+KqeeW","tlshash":"72c2f1e3376e860a32f06a3e8654973ccda9148e8d9dee0148f130769305bab556ae02","first_seen":"2026-01-14T15:11:06.698051Z","last_seen":"2026-01-14T15:11:06.698051Z","times_seen":1,"resource_available":false,"data":null}},"time_used":977,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":553,"receive":424,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/e/dongpo/tz/yu/img/niubn.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:10:41.347Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/niubn.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/e/dongpo/tz/yu/yu.php\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c; PHPSESSID=uvmmd2rhrh8kgeunlcscnsku5o; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 29966\r\nlast-modified: Sun, 07 Sep 2025 09:35:24 GMT\r\netag: \"68bd51dc-750e\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":29966,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"28945c9503b45b2eb3025544093bf6af","sha1":"2d6943e01038a2498ec7207d8ab0fc8357ecd44e","sha256":"1dd82145b81a3fa77ea6b01ac046589c5dbc29cbd453e631aa9456ff7d4be1e8","sha512":"1321ff8e699c208178d1a89631ac0dcf1869573be344372df610019ec21c0c83169ebfa8a5fdeea8a328ab7a2c731f1782d533b40c9ae45c905818fc674b45c3","ssdeep":"768:Q0f+OlvtP1RystngUGaprs4uD4uj1ACbBtl3/+o4:Q0mmtNkEBpVusIbBthG","tlshash":"8ed2e115beb2674b172530aea9cde0e8d20aafd4c96f8361d03bd523551f15ab30f923","first_seen":"2025-09-24T09:47:29.018607Z","last_seen":"2026-05-18T18:12:32.958213Z","times_seen":23,"resource_available":false,"data":null}},"time_used":203,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":201,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/e/dongpo/tz/yu/img/MKAPP.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:10:41.357Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/MKAPP.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/e/dongpo/tz/yu/yu.php\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c; PHPSESSID=uvmmd2rhrh8kgeunlcscnsku5o; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 46428\r\nlast-modified: Sun, 07 Sep 2025 09:35:20 GMT\r\netag: \"68bd51d8-b55c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":46428,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"99b9b60cd4776d948a16be0b496663c0","sha1":"e7eafeda1d0c51f3244b312de85e942e111ec1cb","sha256":"7c2c028999ec7e450fb3bac79804f0a4973062e1e1b39dd70fdc198899b6bff1","sha512":"0e7c5119a59190463f5d603201d8cc969afd5bec0dd10a7e06dbf027fb36cdba8f74687b46ddc6a9bb7d7171c44eed24209e9fef10bd17086368e64969ba99a8","ssdeep":"768:HzYqO3sUrrM+5sV/IYe5q0YAzQJ1HIAzJ1MZcmRt/errw0AZrzK7kA7co:HzYqOcIw7V/E0jJ1HIiJpwt/Sr2xzno","tlshash":"48230132f61b22b85fbdb3f694217d708c018f11ca7d49c680e295d2f45b0f4a25b9b9","first_seen":"2025-09-24T09:47:29.00799Z","last_seen":"2026-05-18T18:12:32.942574Z","times_seen":23,"resource_available":false,"data":null}},"time_used":208,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":204,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/e/dongpo/tz/yu/img/huatihui.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:10:41.369Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/huatihui.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/e/dongpo/tz/yu/yu.php\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c; PHPSESSID=uvmmd2rhrh8kgeunlcscnsku5o; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 38434\r\nlast-modified: Sun, 07 Sep 2025 09:34:49 GMT\r\netag: \"68bd51b9-9622\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":38434,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f0d558526a340ef0a4ccd0b356468053","sha1":"d8c68232c6a01412dc710dc3c0a550a009abc3c9","sha256":"83f7a5c4d6e61fc0e54132461a188922075b494a18fb23208380894fe89a1823","sha512":"dd606c59a5ae84bb2252807c59941f37073b7cd8dad6bfb51140a7319041e5354353563a2f9632e0d10ca7a96dd7d83f355c8b2475355177df40ecc8a15c7f8c","ssdeep":"768:kZkA5GmGFqyNA4RaqIx0mSfl51sUCRPvFvuXT7frG+1j2:Gkz7FrNDaqIxGmr9u3frJ2","tlshash":"ca03010162c54baa8e6f6129f51abe77404409f2c87ef970d0d40fce1b9f983674c758","first_seen":"2025-09-24T09:47:29.027715Z","last_seen":"2026-05-18T18:12:32.933309Z","times_seen":23,"resource_available":false,"data":null}},"time_used":206,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":204,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/e/dongpo/tz/yu/img/mk.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:10:41.585Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/mk.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/e/dongpo/tz/yu/css/main.css\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c; PHPSESSID=uvmmd2rhrh8kgeunlcscnsku5o; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 2556\r\nlast-modified: Sun, 07 Sep 2025 09:35:15 GMT\r\netag: \"68bd51d3-9fc\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2556,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"749ab1e814e220249ab6246cbdc05e68","sha1":"f002cda193dfd314b074b0c8fbe604e3e238c19f","sha256":"e4d2ef9496fedbf3fa99ff4dd0c8423fab07809830d2911b2ba3f27b25f8c6d0","sha512":"8cd6670382843930aaaf812d278e9c3645ae27c0de9c2de5cdac04c014ebac5971250b02b4e94c24f630c4f1ab5e34639b5ecbc92e7fa0797d1445726f31f420","ssdeep":"","tlshash":"80514c667118947bcbee53af81d6934602fb980257e8c4899ac30e26f012dd99fed705","first_seen":"2025-09-24T09:47:29.017519Z","last_seen":"2026-08-02T01:38:09.076786Z","times_seen":76,"resource_available":false,"data":null}},"time_used":212,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":212,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/skin/tb/io28com/io28comanquan2-191.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:39.887Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /skin/tb/io28com/io28comanquan2-191.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:40 GMT\r\ncontent-type: image/webp\r\ncontent-length: 40920\r\nlast-modified: Mon, 12 Jan 2026 15:03:36 GMT\r\netag: \"69650d48-9fd8\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":40920,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 512x512, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"eec4d493504f3c3a2d5422a73585f960","sha1":"375ea5540a85dfd51ce89bf512249f1cd54bf99c","sha256":"69dcd3a2f0797d074e308203eeefae8e3a23288ff1b0f6d1ab088fa1f8a14dc9","sha512":"091d64e656a3fac67aa5e8e5031fa7eadfeeaa2b64d829e972cda73af1ca250ce5e15d80f080b7c1097bb4794c12dfca4abcfa4a1e84fe5855655172611a5e24","ssdeep":"768:hwq3/37aRUa56Jtzz1m8xV3QguvxMbtAAXWLkHr1WDBgS/6PX70i7aGVP:l37abUzk8xCvPEeCr1kh/6D17aGVP","tlshash":"d503f1f1beda9ce9f1cf0bb99d7bca182061d76d928d0b250711593620a5ef0910d8f7","first_seen":"2026-01-14T15:11:06.701122Z","last_seen":"2026-01-14T15:11:06.701122Z","times_seen":1,"resource_available":false,"data":null}},"time_used":975,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":554,"receive":421,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/skin/tb/io28com/io28comanquan3-191.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:39.888Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /skin/tb/io28com/io28comanquan3-191.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:40 GMT\r\ncontent-type: image/webp\r\ncontent-length: 25474\r\nlast-modified: Mon, 12 Jan 2026 15:03:37 GMT\r\netag: \"69650d49-6382\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":25474,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 512x512, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d86d91624bad86bb6d5071715cb038c3","sha1":"1769a87a25d6963ed0f2833f301a7c001daf2392","sha256":"76d475ea69c050ff3620de9de8e86459357ec49ae3268b6f74179f0253b8e811","sha512":"0e6fc0e35f9fcaa0795e487bfc60c2ee52d78db37b16a113a36d70d007e1367859eab6dca146cc937098397ff104ff07739399015b606fc1dae84ceba83fbc23","ssdeep":"768:/qJBejFkmYpiEIeh9inggg2cdSUXgOefu2:/4ejOmYMEIWinbpUXF2","tlshash":"e2b2e16bf67930129d0633b61f0bb7450bd40e1bfad5e63de29ad4c286ec26491882c7","first_seen":"2026-01-14T15:11:06.702176Z","last_seen":"2026-01-14T15:11:06.702176Z","times_seen":1,"resource_available":false,"data":null}},"time_used":976,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":554,"receive":422,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/e/dongpo/tz/yu/css/main.css","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://io-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:10:41.343Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /e/dongpo/tz/yu/css/main.css HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/e/dongpo/tz/yu/yu.php\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c; PHPSESSID=uvmmd2rhrh8kgeunlcscnsku5o; jscheck=1\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:41 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 08 Oct 2025 18:15:31 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68e6aa43-7af3\"\r\nexpires: Thu, 15 Jan 2026 03:10:41 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31475,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (31475), with no line terminators","md5":"1ea9b2c05a6abb63da00557d5cbe1de5","sha1":"c9a9df6e272943334ca12acde761d9f528b6e4aa","sha256":"137a20af221196335af9b436c05e0f37cb786532fb998b5cc91834884bc1b510","sha512":"f893782306d1ac52d319c96b2f4c4330521f55f339140e4091ce1f7867179d9a6f340cdf1d7d2aa8f6c03e30d66ac22b04533a685de9f0a67b106d16d6a160ae","ssdeep":"384:UwK6gPuYSi9lD5e115JwKUbeQuebD5YLXm3hKaJW/:w6W9lD5GabwLsJW/","tlshash":"cee2ea3c96a1503bb1778e7f61dd321d7c298813ce022799b26859ecf7c67a702a3752","first_seen":"2026-01-13T02:35:24.402443Z","last_seen":"2026-01-14T15:11:41.857902Z","times_seen":12,"resource_available":false,"data":null}},"time_used":201,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":201,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/e/dongpo/tz/yu/img/ag-66.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:10:41.580Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/ag-66.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/e/dongpo/tz/yu/css/main.css\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c; PHPSESSID=uvmmd2rhrh8kgeunlcscnsku5o; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 33604\r\nlast-modified: Sun, 07 Sep 2025 10:09:28 GMT\r\netag: \"68bd59d8-8344\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":33604,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e92b11204749525f981459967df19ab7","sha1":"f515e14ebfe3c0b9861f5af195ce60124a2d2982","sha256":"a841caa2ae77d709aa75182c640051f701e8397c7dd0b1c0ff9504f8b6f8e50a","sha512":"e2e11799713df02f0453f39172651bdc1e7f95004f3bff06c5994928f66f67f4ff03eb101ed71941483555486403f8660c8268d7bc3e7aad43cc2598dbc6c5ca","ssdeep":"768:HfDRTz7L+b1oFmVe/hqyqjSnx92h9hJ8oFaYPpQo7q3:LRrfmVqhkjCxkFjpQo4","tlshash":"0ae2f1b2e022c5f4bef18d4929c634d8596b74814cbac957bec048c39c595fb53b8a4b","first_seen":"2025-09-24T09:47:29.016414Z","last_seen":"2026-05-18T18:12:32.937739Z","times_seen":23,"resource_available":false,"data":null}},"time_used":203,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":201,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/e/dongpo/tz/yu/img/ayxlogo.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:10:41.587Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/ayxlogo.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/e/dongpo/tz/yu/css/main.css\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c; PHPSESSID=uvmmd2rhrh8kgeunlcscnsku5o; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 9546\r\nlast-modified: Sun, 07 Sep 2025 09:34:22 GMT\r\netag: \"68bd519e-254a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9546,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"be5dcef31622cbfb260097a78d11dca4","sha1":"869ef9932a30393dfaa89d8ff0892f113a99ab1f","sha256":"40dd354a3543414ee6a058890017485b24e8c7265fc2d61f0ad4b708451a6bce","sha512":"27ee1e7f6d965882d58858d3f2f55da2ba1a870c46f911100acf65e975927c447e63cd5d3fab71b2534b9b3f2b5206841b6dc27737777ad945c651738104e138","ssdeep":"192:CpDUlXyfWmsSgh38yuGh8yNpyEOtS+3TnNb51fgYD92Ojg0ok:UYRmsS5yPtNhWS+jd51fB2OE5k","tlshash":"4112bfca34e67542158441259fa2178cd8c29c0654cf74b7ccee3eb71e6be6d1e38411","first_seen":"2025-09-24T09:47:29.024403Z","last_seen":"2026-05-18T18:12:32.943641Z","times_seen":23,"resource_available":false,"data":null}},"time_used":210,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":210,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tongji.kaiyunh5.cc/matomo.php?action_name=%E5%8A%A0%E6%8B%BF%E5%A4%A728%20-%20%E5%AE%98%E6%96%B9%E5%B9%B3%E5%8F%B0%E5%BC%80%E5%A5%96%E6%95%B0%E6%8D%AE%20-%20%E5%AE%9E%E6%97%B6%E6%9B%B4%E6%96%B0\u0026idsite=17\u0026rec=1\u0026r=721375\u0026h=15\u0026m=10\u0026s=41\u0026url=https%3A%2F%2Fio-28.com%2F\u0026_id=b87b695a793d071f\u0026_idn=1\u0026send_image=0\u0026_refts=0\u0026pv_id=ziaVQF\u0026pf_net=610\u0026pf_srv=399\u0026pf_tfr=0\u0026pf_dm1=1076\u0026uadata=%7B%7D\u0026pdf=1\u0026qt=0\u0026realp=0\u0026wma=0\u0026fla=0\u0026java=0\u0026ag=0\u0026cookie=1\u0026res=1280x1024","fqdn":"tongji.kaiyunh5.cc","domain":"kaiyunh5.cc","tld":"cc"},"ip":{"addr":"154.85.235.194","port":443,"asn":134175,"as":"UNIT A17,9F SILVERCORP INTL TOWER 707-713 NATHAN RD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"beacon","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:41.682Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tongji.kaiyunh5.cc","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 05 Jan 2026 10:00:50 GMT","end":"Sun, 05 Apr 2026 10:00:49 GMT"},"fingerprint":{"sha1":"EE:CC:71:C4:91:67:2F:88:E3:4E:4C:71:56:F8:74:AB:2B:90:EE:FD","sha256":"CD:BE:A5:E6:92:95:9A:C0:54:69:D8:53:C2:69:5D:E9:D7:D2:00:F4:4B:C2:06:6B:3D:B1:1F:C5:A4:67:71:51"}}},"request":{"raw":"POST /matomo.php?action_name=%E5%8A%A0%E6%8B%BF%E5%A4%A728%20-%20%E5%AE%98%E6%96%B9%E5%B9%B3%E5%8F%B0%E5%BC%80%E5%A5%96%E6%95%B0%E6%8D%AE%20-%20%E5%AE%9E%E6%97%B6%E6%9B%B4%E6%96%B0\u0026idsite=17\u0026rec=1\u0026r=721375\u0026h=15\u0026m=10\u0026s=41\u0026url=https%3A%2F%2Fio-28.com%2F\u0026_id=b87b695a793d071f\u0026_idn=1\u0026send_image=0\u0026_refts=0\u0026pv_id=ziaVQF\u0026pf_net=610\u0026pf_srv=399\u0026pf_tfr=0\u0026pf_dm1=1076\u0026uadata=%7B%7D\u0026pdf=1\u0026qt=0\u0026realp=0\u0026wma=0\u0026fla=0\u0026java=0\u0026ag=0\u0026cookie=1\u0026res=1280x1024 HTTP/1.1\r\nHost: tongji.kaiyunh5.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=utf-8\r\nContent-Length: 0\r\nOrigin: https://io-28.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 204 No Content\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:42 GMT\r\naccess-control-allow-origin: https://io-28.com\r\naccess-control-allow-credentials: true\r\nset-cookie: SITE_TOTAL_ID=1f758ccbdf4eef690599569b09ba5efb; Path=/; Max-Age=259200000; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-04T01:30:21.968587Z","times_seen":17700196,"resource_available":true,"data":null}},"time_used":440,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":440,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-14T15:10:38.510Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:39 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\nset-cookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c; Path=/; Max-Age=259200000; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":37384,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (32074), with no line terminators","md5":"668862c079d05e3c66505ef7c9c041a5","sha1":"5d247f8dc3bcf8e5d9dbaaf6fc4e5d73032ac3b7","sha256":"0949ad19874063979df7a6426eff527ddb212278a125cb8236d1e38ecbb6adad","sha512":"3c8095cca57217c851e40795194e3a3b7b074f9e3e6f680afd946dc044fea9a0b8cbd63a5cdbfc675f15d929c7eb22b7ae5b41948e47487a12dc7d493f05d528","ssdeep":"768:fIISXlZZKPqWQNbPi44JIFajBTnYZ11LmJzy5:fIIaZKPqWWbq44JIFoTYfxmJzY","tlshash":"3df29437e38b397b212b8ae96097332670c3f21dc4a644558bfc979b57e5ce4b9020a5","first_seen":"2026-01-14T15:11:06.705059Z","last_seen":"2026-01-14T15:11:06.705059Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1582,"timings":{"blocked":590,"dns":183,"connect":199,"send":0,"wait":399,"receive":0,"ssl":207},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/skin/cover/io28com/io28comyoushi1-191.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:39.884Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /skin/cover/io28com/io28comyoushi1-191.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:40 GMT\r\ncontent-type: image/webp\r\ncontent-length: 155180\r\nlast-modified: Mon, 12 Jan 2026 15:03:32 GMT\r\netag: \"69650d44-25e2c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":155180,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 762x508, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"a2a3e35f07c901cd0e9f7b6748a0221e","sha1":"57d41b6fafb068f0ecabe4e653317833b63253bb","sha256":"4e12946d7e50004caa0a32940d132d4ca15bbfed5d46670b150ce7f6d3a8128d","sha512":"9eade5ce384e7dd35cf97d5196ae99ef872a61f499d36bb002327b246785ee5f3996fe24fa95313c801491cc8f38b678fc780906a369d77e3763d93e137bb05e","ssdeep":"3072:MWg+YB09TQOVAetCMEU9SYaz36AtpP5nkd4IiKWy3ND+91EvuuwiC3gB4elabFII:MyUfnMg5pP+d4dq3NDH2uwi7mBbFIxm","tlshash":"66e3125eaf212cc7429cc714eb9998e8a876eb6f7b6da010cf105b2c43a530506e37dd","first_seen":"2026-01-14T15:11:06.705985Z","last_seen":"2026-01-14T15:11:06.705985Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1183,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":556,"receive":627,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/skin/cover/io28com/banner2-191.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:40.934Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /skin/cover/io28com/banner2-191.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 185812\r\nlast-modified: Mon, 12 Jan 2026 15:02:45 GMT\r\netag: \"69650d15-2d5d4\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":185812,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 738x492, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"949a5f92244b3abd4c53074b1bffacc9","sha1":"efcc723abd79264d2b1ad9dba03ff28894891384","sha256":"f9165fe90dde2a2422fba8f1b4241aca16aeae9af0af7673408f0b008e7d6e5b","sha512":"82bd80bc8f340cc7fcc3585c724604f67be45567f146e6c6cda5e81775994452e4234bb22ceb6671b469823ce0f40ce3c393985b49dc6e1fb0b6bd9120e0769d","ssdeep":"3072:+a1/bfiIW/2Qeriu9zEHAywt81G1tvCu1ythY+AGcEXL2KbgNLGsMP+Lq63PoDzW:nOIvQeeu9YgFK1gMu1yt++AEXi3LGsOY","tlshash":"850412d52e17699a8028c35fd319802e1ed55dcea37f4a0067878285f5722f7ae9e30f","first_seen":"2026-01-14T15:11:06.706846Z","last_seen":"2026-01-14T15:11:06.706846Z","times_seen":1,"resource_available":false,"data":null}},"time_used":234,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":219,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/skin/tb/io28com/io28comhz1.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:41.146Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /skin/tb/io28com/io28comhz1.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c; PHPSESSID=uvmmd2rhrh8kgeunlcscnsku5o; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 8228\r\nlast-modified: Mon, 12 Jan 2026 15:02:40 GMT\r\netag: \"69650d10-2024\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8228,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 220x220, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"94784154d16e312ccf01878945fefa12","sha1":"8d8a0d7b0d99a9ef6ab908e1ec13ad7603470b7d","sha256":"92697a26dffc03c8da4c5834496f5c948eda65e69377724aa2bf94b5c5ae137b","sha512":"1f4e062bda9b23cba1f13821c073432f6e06c2e04bc31e6dd3071d1514155ca0f4b8cb3c2115af40f6ead7f37814b66c7a8a63d7392ce5485c1fbf5f18ea7b98","ssdeep":"192:se7So4qs474ve27gOad7qPYyDWCrY/0ribNDMe2:se7SPqH74vx4UnTrfripM","tlshash":"0702b0e4a617388ae3c7d5b74cec12510e88367fc69218b22195ce1fe6d653c52e7f21","first_seen":"2026-01-14T15:11:06.707722Z","last_seen":"2026-01-14T15:11:06.707722Z","times_seen":1,"resource_available":false,"data":null}},"time_used":200,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":200,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/skin/tb/io28com/io28comhz2.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:41.149Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /skin/tb/io28com/io28comhz2.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c; PHPSESSID=uvmmd2rhrh8kgeunlcscnsku5o; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 9920\r\nlast-modified: Mon, 12 Jan 2026 15:02:42 GMT\r\netag: \"69650d12-26c0\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9920,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 220x220, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"649e732236361505c6aec4ac4919bdcf","sha1":"6fc65677514e587f50f4d395927c374da2e4d858","sha256":"23ccde44618bab9e85de2889b2d48648d894fe84e99ea1c48ea79ab43917abef","sha512":"f3ca01f9885874f4c101fe2546c57ecb6d29ba6f9cfbed7208424a7ff898ed2497f5f8d1d3482f5884fab45c524de5313c8979f3b9a9c045739dc7aef597fc55","ssdeep":"192:c+35HYMwWMGL+1j/Z4M5wZZTTuFhDKxfAfCqL3oO9rWQk+DOXEehF:LHiL/9JwZZ/VCCQ3pb8EeT","tlshash":"c522af00783dd6ba41d011daa627bba04e2b83bdb415e5bf7c000aa8e5725c8899cc77","first_seen":"2026-01-14T15:11:06.708603Z","last_seen":"2026-01-14T15:11:06.708603Z","times_seen":1,"resource_available":false,"data":null}},"time_used":201,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":200,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/skin/tb/io28com/io28comhz4.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:41.154Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /skin/tb/io28com/io28comhz4.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c; PHPSESSID=uvmmd2rhrh8kgeunlcscnsku5o; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 3608\r\nlast-modified: Mon, 12 Jan 2026 15:02:48 GMT\r\netag: \"69650d18-e18\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3608,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 220x220, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"3da6bdfd834a41e4009bf3c73fc09a95","sha1":"8ce42d717c7c123d3625f4fb6912fc4d04941948","sha256":"741b76fc9a557233655c708236684502f5255e0c9605549aa13647fe00ce6e01","sha512":"c1c24f0f58c4dad6b76c84304a27583845cad3ec0480489b51b0e6462e0656c5b3264cf0f2a89c2c30cc6bf1dfc5ca6e52f201ce1561cf75529f7c4cfb8dcb04","ssdeep":"","tlshash":"39714c284f4f4ff8beda817a70162196cc2b90781a9494e9c8a48c005b64a245e3ea7d","first_seen":"2026-01-14T15:11:06.70944Z","last_seen":"2026-01-14T15:11:06.70944Z","times_seen":1,"resource_available":false,"data":null}},"time_used":200,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":200,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/skin/tb/io28com/io28comhz6.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:41.157Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /skin/tb/io28com/io28comhz6.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c; PHPSESSID=uvmmd2rhrh8kgeunlcscnsku5o; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 7702\r\nlast-modified: Mon, 12 Jan 2026 15:02:57 GMT\r\netag: \"69650d21-1e16\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7702,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 220x220, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"cd43ee3e70a9e174beae61f38f321428","sha1":"44759d02bd7121633f1459223caa02196844298c","sha256":"8c2ce444a4c76de28a14d3475f023ed85ebfcdd8a664916a3e1851a0e020a97e","sha512":"ea6c20361ebb6106ff5d05f58bda0626f01ba553b62811f66ded2816b3abf3028340def6c560606022e6cf69c20c03562c3b45a28756371b36180badd4fed336","ssdeep":"192:VjobG/m9KZ9Rje7PLrBN7PH3ZxHiyXZjvbX6SgO8aVs0S:ZV/mejgPZBv3ZxCy5X6E8KZS","tlshash":"18f18e0cead60472d96f4dc28be79926c1e1208667fc4c96d3af8af4443f3899541979","first_seen":"2026-01-14T15:11:06.710444Z","last_seen":"2026-01-14T15:11:06.710444Z","times_seen":1,"resource_available":false,"data":null}},"time_used":200,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":200,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/e/dongpo/tz/yu/img/leyulogo.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:10:41.586Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/leyulogo.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/e/dongpo/tz/yu/css/main.css\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c; PHPSESSID=uvmmd2rhrh8kgeunlcscnsku5o; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 11032\r\nlast-modified: Sun, 07 Sep 2025 09:35:07 GMT\r\netag: \"68bd51cb-2b18\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11032,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"10fb9b87015af763733ca7aae9f8fd72","sha1":"22b85d9ba6d73c7318b91797df836c6dfd4c9bb8","sha256":"005515860b53ba77db3f2b66788345c397fe73449f589f426864829442c1690e","sha512":"146449caad3ea28cf16b700248d77549bb925fd2f33db7a1d614530e8fb6d47d00d873c88d654fedc9068e2ac9e529943916ddb35817d135b0257ec4a3bf978b","ssdeep":"192:zIZCU4S/HrTYSbgrqGvXdxyT6Tl+Kib2fMSk9NpduGGbh1R7bPL8P:MKWkFvryT6Via0SsXGFX","tlshash":"fd32bfb636c0359ae0c49ab56dbfb440968a065e7cdad7e3b4bd0200146eb7b3b35d81","first_seen":"2025-09-24T09:47:29.01019Z","last_seen":"2026-05-18T18:12:32.968408Z","times_seen":23,"resource_available":false,"data":null}},"time_used":211,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":211,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/e/dongpo/tz/yu/img/hthlogo.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:10:41.588Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/hthlogo.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/e/dongpo/tz/yu/css/main.css\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c; PHPSESSID=uvmmd2rhrh8kgeunlcscnsku5o; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 18412\r\nlast-modified: Sun, 07 Sep 2025 09:34:44 GMT\r\netag: \"68bd51b4-47ec\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":18412,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a856a132c94cfe122c65e3fea41155f7","sha1":"b891eee6bcbbc6d239a88da6803d7962e5053aa3","sha256":"74f75d276694dbde95b6faba24ddc0f1f0fdd9bcadac15247a85c37920191792","sha512":"fe66855b60ae68d968788e70060e4461ae338c7d3106f7fe43a2284ec7ed228e2043bb26bc41b5a43584d05ce72cb966559d57dc3619655a5d724f9f473def19","ssdeep":"384:pRLF+p03tqJ9CMVckEWu73VRfjxdk7hllIjdlbng45YeBWK:9+m969pNEWu7FRr/k7HlQg4yeBW","tlshash":"ee82d0b63909725ed2450ce8f4146243fb95faa914391ced34afc1a32c77a64ae2384b","first_seen":"2025-09-24T09:47:29.003621Z","last_seen":"2026-05-18T18:12:32.940732Z","times_seen":23,"resource_available":false,"data":null}},"time_used":209,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":209,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tongji.kaiyunh5.cc/matomo.php?action_name=%E5%8A%A0%E6%8B%BF%E5%A4%A728%20-%20%E5%AE%98%E6%96%B9%E5%B9%B3%E5%8F%B0%E5%BC%80%E5%A5%96%E6%95%B0%E6%8D%AE%20-%20%E5%AE%9E%E6%97%B6%E6%9B%B4%E6%96%B0\u0026idsite=7\u0026rec=1\u0026r=832625\u0026h=15\u0026m=10\u0026s=41\u0026url=https%3A%2F%2Fio-28.com%2F\u0026_id=0d8662fbe2898679\u0026_idn=1\u0026send_image=0\u0026_refts=0\u0026pv_id=EKFWz4\u0026pf_net=610\u0026pf_srv=399\u0026pf_tfr=0\u0026pf_dm1=1076\u0026uadata=%7B%7D\u0026pdf=1\u0026qt=0\u0026realp=0\u0026wma=0\u0026fla=0\u0026java=0\u0026ag=0\u0026cookie=1\u0026res=1280x1024","fqdn":"tongji.kaiyunh5.cc","domain":"kaiyunh5.cc","tld":"cc"},"ip":{"addr":"154.85.235.194","port":443,"asn":134175,"as":"UNIT A17,9F SILVERCORP INTL TOWER 707-713 NATHAN RD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"beacon","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:41.686Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tongji.kaiyunh5.cc","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 05 Jan 2026 10:00:50 GMT","end":"Sun, 05 Apr 2026 10:00:49 GMT"},"fingerprint":{"sha1":"EE:CC:71:C4:91:67:2F:88:E3:4E:4C:71:56:F8:74:AB:2B:90:EE:FD","sha256":"CD:BE:A5:E6:92:95:9A:C0:54:69:D8:53:C2:69:5D:E9:D7:D2:00:F4:4B:C2:06:6B:3D:B1:1F:C5:A4:67:71:51"}}},"request":{"raw":"POST /matomo.php?action_name=%E5%8A%A0%E6%8B%BF%E5%A4%A728%20-%20%E5%AE%98%E6%96%B9%E5%B9%B3%E5%8F%B0%E5%BC%80%E5%A5%96%E6%95%B0%E6%8D%AE%20-%20%E5%AE%9E%E6%97%B6%E6%9B%B4%E6%96%B0\u0026idsite=7\u0026rec=1\u0026r=832625\u0026h=15\u0026m=10\u0026s=41\u0026url=https%3A%2F%2Fio-28.com%2F\u0026_id=0d8662fbe2898679\u0026_idn=1\u0026send_image=0\u0026_refts=0\u0026pv_id=EKFWz4\u0026pf_net=610\u0026pf_srv=399\u0026pf_tfr=0\u0026pf_dm1=1076\u0026uadata=%7B%7D\u0026pdf=1\u0026qt=0\u0026realp=0\u0026wma=0\u0026fla=0\u0026java=0\u0026ag=0\u0026cookie=1\u0026res=1280x1024 HTTP/1.1\r\nHost: tongji.kaiyunh5.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=utf-8\r\nContent-Length: 0\r\nOrigin: https://io-28.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 204 No Content\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:42 GMT\r\naccess-control-allow-origin: https://io-28.com\r\naccess-control-allow-credentials: true\r\nset-cookie: SITE_TOTAL_ID=98b9e2f4344e8c7c809da17116d0bd3b; Path=/; Max-Age=259200000; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-04T01:30:21.968587Z","times_seen":17700196,"resource_available":true,"data":null}},"time_used":446,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":446,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/io28com/css/home.css","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:39.866Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /io28com/css/home.css HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:39 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 11 Jan 2026 07:11:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69634d21-90302\"\r\nexpires: Thu, 15 Jan 2026 03:10:39 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":590594,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65496)","md5":"6ba912f17c8274598ae8d68f28b02545","sha1":"dcb55eb5cd8b4a8c0a3f25f3bf9d13e15c131a16","sha256":"0a6dc4c85985497fced0b143a7b7090f5d46f848776c0adacd6754548c514d6f","sha512":"135a4123e51e6245e8f75869e1a01cb9aff213f11f0e0093cf6edbf3bd912e4eb28b7a135c1034093107bad4def88557f60db010908fb970004bb95015a0e781","ssdeep":"12288:V+qNgxamFIN8Wwx21EmLsXeuZU5nh8I22Bg0jH:UqNgxTINWx21P","tlshash":"76c4c8a49340b17dbc1bfa9897cc868e71217423e82277fced96b521c4c76f31664b89","first_seen":"2026-01-14T15:11:06.712427Z","last_seen":"2026-01-14T15:11:06.712427Z","times_seen":1,"resource_available":false,"data":null}},"time_used":204,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":204,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/io28com/css/zhibo.css","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:39.876Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /io28com/css/zhibo.css HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:39 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 11 Jan 2026 07:11:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69634d21-62609\"\r\nexpires: Thu, 15 Jan 2026 03:10:39 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":402953,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65496)","md5":"63b4c605d7086f2e021778f22d3c3a7f","sha1":"7eeec160032ddc9aacba1c127fbd221702250a8a","sha256":"465bc9f63c9ff74ff52edd30365b0da63ee77beda84565b0a2f2c785fdd0c321","sha512":"430de195718bd32ad2ea4d452f7b42759d9cd611a249df4b8815977e831b24d3e1e5ac032633d2148c4b65e0980623e5ea18ef81402af03e5db0e8fc6a03222b","ssdeep":"1536:nBy1YRODkZqdC+c2NnRLRCPlzXAV8hDGcDsl6mcwm7VU/doDk02XLFa7b1f8FMHS:By1RRPNm722XMYUtSWEBKVN","tlshash":"2c841fb6f1f52175eb1af4df110c7a9e39e069afd0115ebdd8c3a326c4c3aa3026454a","first_seen":"2026-01-14T15:11:06.713356Z","last_seen":"2026-01-14T15:11:06.713356Z","times_seen":1,"resource_available":false,"data":null}},"time_used":559,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":559,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/io28com/gate.php","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:39.877Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /io28com/gate.php HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:39 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nx-robots-tag: noindex, noarchive, nosnippet\r\nx-content-type-options: nosniff\r\ncross-origin-resource-policy: same-site\r\ncache-control: private, max-age=600\r\nvary: Accept-Encoding, User-Agent, Referer, Sec-Fetch-Site, Sec-Fetch-Dest\r\netag: W/\"d36d4a3956121a110a96afd809592903\"\r\nlast-modified: Sat, 10 Jan 2026 19:04:34 GMT\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1990,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Unicode text, UTF-8 text","md5":"d36d4a3956121a110a96afd809592903","sha1":"fca59a09b59d11b881d51009ba6cd507d7a2a23f","sha256":"248db9d114b9231135bec02e312a79fa49f85cd6632ff627f42a5bffa61ecca9","sha512":"a4b6c743d53edaf7c02d11dcdeabb859a014242d80a51c08d22518843b09e596875a82e53bd73d7751b55ce17a53d0d972260a662d75d7e1eabbe7595494a593","ssdeep":"","tlshash":"a5412337ba5214311066924d3ab7c70875b2001f9a85e105b3dc901c6fadd6b1cf9bbc","first_seen":"2026-01-14T15:07:41.501206Z","last_seen":"2026-01-14T15:11:41.810037Z","times_seen":5,"resource_available":true,"data":null}},"time_used":559,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":559,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/skin/cover/io28com/io28comfuwu2-191.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:39.880Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /skin/cover/io28com/io28comfuwu2-191.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:39 GMT\r\ncontent-type: image/webp\r\ncontent-length: 147752\r\nlast-modified: Mon, 12 Jan 2026 15:03:13 GMT\r\netag: \"69650d31-24128\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":147752,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 583x388, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c63c7ed624ca6f73c4d7d6a211b65cdd","sha1":"90d60c56f798b9eae2f5b1d5b938ac344c75bb11","sha256":"0133e0d19b1ee382f30146b266d67d4148d40f14fbe32e27a4c54d4b49a0c535","sha512":"b584fc75c953f0e1915ae483fa729be64bf2ee64ddbd2dca8d0b605d6ecc07fc8bd9d8ddd4545eb802bd6b7b23f304eeb86edd43a60ad0f456b8d4d53266468d","ssdeep":"3072:eXLD+aiRvQN5r5gUWG4RTeJzf6vHKi0CO5GviyhNy7Q:e78RvQNjWG4RyJz8v0l5siyh","tlshash":"9ce312d38ab6d44ceb3d707218de13e4711cd2a881b56b6bf546b2864a123b3987e734","first_seen":"2026-01-14T15:11:06.714959Z","last_seen":"2026-01-14T15:11:06.714959Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1176,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":557,"receive":619,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/skin/logo/io28com/logo.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:39.891Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /skin/logo/io28com/logo.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:40 GMT\r\ncontent-type: image/webp\r\ncontent-length: 9358\r\nlast-modified: Mon, 12 Jan 2026 15:02:34 GMT\r\netag: \"69650d0a-248e\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9358,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 487x156, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"fc3a362197809531dfe1842c2fc25d3c","sha1":"19f82d30abfaa7de4015ca6b94738be6ebdbd199","sha256":"c256917dd7b792aec7403943f470b07830b1e0306f0bef304428dc6199bb9a21","sha512":"545c4e04c995073d26d160b8944a2e6fdb077f56c34723d259edeb3522609a5d8d77dba2b65bd74bc7c736ba698aa77c93b9b02b91b005436d990701084a48cf","ssdeep":"192:RDv9uGtOJY2NVxO4thsMbqq4Ab1Kg3v3dWWdPgkUyOg75VaGHU:Rb9uiO66iOr/1KSNWYgyOgL/","tlshash":"4712c0bbd3c651e2bc48b4494e38f9612f72de41621b0a7098e0b1b8d6764763c1814f","first_seen":"2026-01-14T15:11:06.715917Z","last_seen":"2026-01-14T15:11:06.715917Z","times_seen":1,"resource_available":false,"data":null}},"time_used":977,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":552,"receive":425,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tongji.kaiyunh5.cc/matomo.js","fqdn":"tongji.kaiyunh5.cc","domain":"kaiyunh5.cc","tld":"cc"},"ip":{"addr":"154.85.235.194","port":443,"asn":134175,"as":"UNIT A17,9F SILVERCORP INTL TOWER 707-713 NATHAN RD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:40.768Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tongji.kaiyunh5.cc","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 05 Jan 2026 10:00:50 GMT","end":"Sun, 05 Apr 2026 10:00:49 GMT"},"fingerprint":{"sha1":"EE:CC:71:C4:91:67:2F:88:E3:4E:4C:71:56:F8:74:AB:2B:90:EE:FD","sha256":"CD:BE:A5:E6:92:95:9A:C0:54:69:D8:53:C2:69:5D:E9:D7:D2:00:F4:4B:C2:06:6B:3D:B1:1F:C5:A4:67:71:51"}}},"request":{"raw":"GET /matomo.js HTTP/1.1\r\nHost: tongji.kaiyunh5.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:41 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 10 Dec 2025 14:05:52 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69397e40-10984\"\r\nexpires: Thu, 15 Jan 2026 03:10:41 GMT\r\ncache-control: max-age=43200\r\nset-cookie: SITE_TOTAL_ID=49c5bd1a9cf0518878d05c4556d2ae8f; Path=/; Max-Age=259200000; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":67972,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2923)","md5":"4b32d11120a738ec529e5d64979e9d10","sha1":"deedcd7014f47a999da6c19786713cd7a236040a","sha256":"1762dd6a64fcd59421610b68625258f9224a1f278159c4d99282adb631470465","sha512":"258a126ba730a9f57d0adef037bdf90f349265128ceb8d7d9e5c7754eb14751895dffb3220bc1da307021ea8c37c45b837064c89731313acf22a3245b3812452","ssdeep":"1536:ATgnSINAJrRJqerEKlFXhuXEjmbMNfwS9h2BLy1z71B8I6fJIKIQaFLa:AT+Z2fuqXYy1PGJ9d5","tlshash":"3963d8ce72c2753a4bcb6075a43f114ab27e9caa1448c4b4e62ac4f6383491d657bf7c","first_seen":"2025-09-25T22:45:46.07207Z","last_seen":"2026-08-03T18:53:25.927801Z","times_seen":17638,"resource_available":true,"data":null}},"time_used":1082,"timings":{"blocked":434,"dns":1,"connect":212,"send":0,"wait":212,"receive":0,"ssl":220},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/e/dongpo/tz/yu/img/9gamebn.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:10:41.360Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/9gamebn.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/e/dongpo/tz/yu/yu.php\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c; PHPSESSID=uvmmd2rhrh8kgeunlcscnsku5o; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 27892\r\nlast-modified: Sun, 07 Sep 2025 09:33:44 GMT\r\netag: \"68bd5178-6cf4\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":27892,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ce77c899674f0fbbb251da4359cd697f","sha1":"235c35f6f643584a20bfa71157129284a4088e8a","sha256":"6b12d808aa923bd5b8fd72fa6448aca5b15b7b0a04cb7c47b35dcaca0801f57d","sha512":"dfcdfb85450ad4dcd889893901416e4935e95fc88c7e1856d1103771e30ea8e381b1256798da33fe5bb1648fb71479594339d8c9fbf19ba243c1399b9766a978","ssdeep":"384:zjT/vsXC1mmPYGjSiM2FZrYKjFUb8mLg9vf44pgGDC7eqsyYyFWWby4zVZJH10/l:wy1myiiDUbzx4LO7tsjyFWWZvqE","tlshash":"86c2e187bf5cb40888b4b2cfb93ef9e6028446bc6f871175c428859a0d5b5c776d30ba","first_seen":"2025-09-24T09:47:29.014809Z","last_seen":"2026-05-18T18:12:32.950317Z","times_seen":23,"resource_available":false,"data":null}},"time_used":208,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/favicon.svg","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:41.469Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c; PHPSESSID=uvmmd2rhrh8kgeunlcscnsku5o; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:41 GMT\r\ncontent-type: image/svg+xml; charset=utf-8\r\nvary: Accept-Encoding\r\ncache-control: public, max-age=604800\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3338,"size_decoded":0,"mime_type":"image/svg+xml; charset=utf-8","magic":"SVG Scalable Vector Graphics image","md5":"34ec509d0f37e213c5525f3f9067fe79","sha1":"9d57c838b067f7bc7b7674975c219abcb1d4ac6c","sha256":"e86c68535c6fc37baeeb7ba434f613755ce0e31391e3d203488ec1b87a1ebc0f","sha512":"f6093e5d9c1b45e96fd4613724d047c94bbf8ec876abce46a4894e21c7c85d27f4026972db8007163441779b9565b313c29b8fefa169b40e103abf70b120f785","ssdeep":"","tlshash":"90617459c7b5eab5bbc84b5c4fb421c266f9102efe308fa7c25a9d213153db11040ea7","first_seen":"2026-01-14T15:11:06.718261Z","last_seen":"2026-01-14T15:11:06.718261Z","times_seen":1,"resource_available":false,"data":null}},"time_used":201,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":201,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-28.com/skin/cover/io28com/io28comabout1-191.webp","fqdn":"io-28.com","domain":"io-28.com","tld":"com"},"ip":{"addr":"38.238.25.9","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-28.com/","date":"2026-01-14T15:10:39.882Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mark-zh-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 15:45:55 GMT","end":"Sun, 12 Apr 2026 15:45:54 GMT"},"fingerprint":{"sha1":"66:2E:A1:8C:AB:46:8D:47:B9:42:76:E6:BE:FD:24:E5:10:66:B1:A3","sha256":"67:5B:67:3F:47:A5:E4:DA:E6:F4:EA:1B:BC:CB:A5:59:91:F3:80:C5:89:B6:D5:F7:9E:DE:1F:6D:5C:3E:92:12"}}},"request":{"raw":"GET /skin/cover/io28com/io28comabout1-191.webp HTTP/1.1\r\nHost: io-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-28.com/\r\nCookie: SITE_TOTAL_ID=efaafda97c858aef6d8d800455ea7b1c\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:10:39 GMT\r\ncontent-type: image/webp\r\ncontent-length: 201062\r\nlast-modified: Mon, 12 Jan 2026 15:03:20 GMT\r\netag: \"69650d38-31166\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":201062,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 818x548, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"619f9cece3257868e9df9ccba680e08e","sha1":"5e7326a80c413c9e4f4f0d7dc93b6904ec687bc5","sha256":"d5717b39dfcc8fd29cb94a8749dcb623a1ae14fb04e0f79ddf31c0393c49656a","sha512":"622ec618bbbea7625ae78d0f7194101973e43f3ad91deb4a07d0e46d0f6a3317d190a7873c17151b2b45d69c0388907b0f484e9df74f3365176d9e2ad75457dc","ssdeep":"3072:XDmt9ulX3ByLm+prXfGARtm/PO40v9acnIBXy5z1acE4i6fs0augR:XDm2sLm+prvtr1vB0ez1iD0","tlshash":"a51412e2848469edcfebf7b7165bcaec3d710c85a8329b890a5d3e8d87154cd683d046","first_seen":"2026-01-14T15:11:06.719381Z","last_seen":"2026-01-14T15:11:06.719381Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1180,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":556,"receive":624,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}