{"report_id":"f21faf60-0732-43c3-a3b5-0b1c16c0fdb1","version":6,"status":"done","tags":[],"date":"2026-01-19T14:26:39Z","url":{"schema":"http","addr":"promohero.vip/","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":0,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"promohero.vip/pages/ap/RegionNotSupported","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"title":"promohero.vip/","dom":{"size":3875,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (1364)","md5":"33a0e9258902f630f35765b4162ed0c1","sha1":"20b466f5c48a9b1629e975ef2c342f87dec56aa2","sha256":"fd28e1e1babd53e7d08068c05d0ed5c95c109643d36d99d0af860bd9239a2494","sha512":"06935c1cd93708177563985425e0b81a2d002062424c95260a50ae81c518155b21388b0a3ac61ab4cb3ad4412b147566779c025a5d2eaed6045914f4ac5ce444","ssdeep":"","tlshash":"2381850c3408981b113223caf485be24bc97773a8745d671a6fa82349be5edacc6ad35","dom_hash":"domhashcc6c36f6ccb79eb51af1285a37e4a27d","first_seen":"2026-01-19T13:29:22.542447Z","last_seen":"2026-01-19T14:26:42.17146Z","times_seen":3,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"promohero.vip/","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":0,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-23T14:26:39Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-19","alert":"Phishing Block","trigger":"promohero.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null},"summary":[{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"151.101.193.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2026-01-18T22:30:25.777558Z","alert_count":0,"request_count":1,"received_data":34553,"sent_data":452,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-01-18T22:17:29.309663Z","alert_count":0,"request_count":1,"received_data":13321,"sent_data":476,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-01-18T22:25:16.015191Z","alert_count":0,"request_count":1,"received_data":103030,"sent_data":465,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"promohero.vip","ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"domain_registered":"2026-01-17","domain_rank":0,"first_seen":"2026-01-19T14:26:40.040523Z","last_seen":"2026-01-19T14:26:40.040523Z","alert_count":92,"request_count":23,"received_data":592285,"sent_data":10456,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]},{"name":"FingerprintJS:3","description":"FingerprintJS is a browser fingerprinting library that queries browser attributes and computes a hashed visitor identifier from them.","website":"https://fingerprintjs.com","common_platform_enumeration":"","icon":"FingerprintJS.svg","categories":["JavaScript libraries","Browser fingerprinting"]}]},{"fqdn":"cdn.dcloud.net.cn","ip":{"addr":"124.221.80.91","port":443,"asn":45090,"as":"Shenzhen Tencent Computer Systems Company Limited","country":"China","country_code":"CN"},"domain_registered":"2013-07-17","domain_rank":296858,"first_seen":"2018-09-15T09:18:08Z","last_seen":"2026-01-14T11:37:09.481821Z","alert_count":0,"request_count":1,"received_data":578,"sent_data":444,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"promohero.vip/","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"9fb9d2c62d0b53b369d827901c46d31c","sha1":"bb623e7486aa9ba44851ecc6ae01db5fe42d83a1","sha256":"b02ca87ad43e5ca61f953b2e414559e63f426c8513f7808707f39a4ba04ab219","sha512":"48cbe981398942910959f746a8225a91578752b67121817ae3b6b85859d0e97f9d89e96f1672b63d758f3148f3f37034017fd93d83415097616a90af285f0a18","ssdeep":"","tlshash":"afe061c3506e394c02108119304ac0075bb908b2de8549611c5837a58af9e4bc569455","size":363,"data":"","first_seen":"2025-03-05T00:30:25.174857Z","last_seen":"2026-05-31T15:28:13.961746Z","times_seen":455,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"promohero.vip/","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"9549491fa69813d582450290c39998b2","sha1":"e5994dcd04f3a660c8b11fc387ad191452c4bdf3","sha256":"2a3d691b2933dc59b8bca5b587316b9606b723e2c4b5ec9fc80ecddb5698b77b","sha512":"f953999686d22954c2aa187d0f35384bf02532e8bba254aca9c2e62cbf952549c1fa8f1ad647cd5091acf36f0a8075ff07367bb25a4b4867924da53af90883bd","ssdeep":"","tlshash":"c7a002ec01c8063dd13170b9ab2b3eb03f595c510343116f9699bb157146a17c70b4ec","size":76,"data":"","first_seen":"2025-09-27T19:31:00.108292Z","last_seen":"2026-03-08T23:08:16.643086Z","times_seen":71,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"promohero.vip/assets/index-DLgUzMRo.js","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"049668222db4642100d4ff1529d0ec6a","sha1":"60d9352ca62168e95e1a01b601efb3ff712239db","sha256":"44b4bd5aea19a1046f65432fb167f994c3f13df219ec7074a3f5c62da9989dda","sha512":"42c99d2730f0ce887d367f015d43fa4e1b84e5f60b8d8f15a56ebba10280c9b35f5ebf3917e48cc2e3a14a369d0646012b9f0efb70a74e4866e6d73cbeba188c","ssdeep":"12288:38lX/qx7zvIczg7/v8dpnVPTUD9iwug151ilcOZWENJqKI5:38lX/qx7zvIczg7HMpnVPAD9iwug151D","tlshash":"cf844bd4b685b46903b639f6403f1101f33e1d16b80d8498f66ce9db3d2a99962b7f38","size":399136,"data":"","first_seen":"2026-01-19T13:29:22.555536Z","last_seen":"2026-01-19T14:26:42.201041Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"promohero.vip/assets/page_header.7sZiNXYm.js","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"introduction_type":"importedModule","is_inline":false,"md5":"9bf3d36fac6c5033f107ecbb46524da2","sha1":"c79081ab444f6bf547c6bee94c2b9c350d104f85","sha256":"96e1385f0b9c47bcd46616a5013c427520f3a37da51a1e6dc9f3e54e6c08ee16","sha512":"f31fa232adeeda48c10dfebba771ee67f1cdf8d23ba4febb4f9a1bd119abfc96429edd89e90366f63d2d80d880318093262a2562547433c3a5694442eb366f77","ssdeep":"","tlshash":"2401c04d6c0fc17a622254ded43258382144077e93249cd1c0fccc396bd5dacb65bf29","size":756,"data":"","first_seen":"2026-01-19T13:29:22.550512Z","last_seen":"2026-01-19T14:26:42.180848Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"promohero.vip/assets/page_footer.DeUJ_Joh.js","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"introduction_type":"importedModule","is_inline":false,"md5":"62c1050cf8319b6c8d3614caa6a77617","sha1":"88e16dce038882242cac06a9dc37391a6fc93b08","sha256":"4d966afae13d6c965d6ed83cb7f6937419e9b89850f50140a762c771979628c4","sha512":"1df54792942e4ff93bbde67c8f7fa684bac314df0f8840f328c03f3e8921ae82cf0621596f89d21a4c4edaa18696c3f2aaf7d61375a2a23cf97e3bc3ba67db9f","ssdeep":"","tlshash":"ff41b0581c4b823f259b91bad522a430b68a1ff0cb74cc92d8f98e55669ddfc3c16d2c","size":2290,"data":"","first_seen":"2026-01-19T13:29:22.546668Z","last_seen":"2026-01-19T14:26:42.17858Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"promohero.vip/assets/pages-ap-RegionNotSupported.CeWBxXXf.js","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"4f425d2bfa816a21fdb92f1825da43ba","sha1":"7d5a1a0ffd36c02555eea5cdd4d164df808444e6","sha256":"1b676fda439e9f1acdc9f4deb158feafc743cbbf4f364fdb49cbf45d0e371d57","sha512":"e1af211c44f21e63265a0fea99210136fb6e50afbbd7544e0d0059c303f2fc64da02aa8811c97e01b8b57e1621b5f241aa7fd026901ba57205d43bc1de22a481","ssdeep":"","tlshash":"da21cd8d7f5c817a3213a5c9651870147d6d266d6394b0c2aaf8443c92b5a882cbf7aa","size":1277,"data":"","first_seen":"2026-01-19T13:29:22.554078Z","last_seen":"2026-01-19T14:26:42.206736Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/@fingerprintjs/fingerprintjs@3/dist/fp.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.193.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"375436f436cc1022d7b4569a817c1a6b","sha1":"9359415cc419874654000870ca54523875c12c16","sha256":"99dc3803d1f19c8103f79f834044b2afd4c8af5b7927efbd36b1052d528b40ae","sha512":"077cb9e67a028f8ffc6c9f19793c15e20379840da1a927e711a0ac4dcf15fe6e1a15cee75436df340c707b9e77118f3cd38ede493e060c592069f39bc6001a92","ssdeep":"384:chQYSwHRBcifEJzXhGUa4LdsF7wRuCfLVg5+pCqNFaiE8E0QIQfJW7us6RfGDUPX:cSMHRU7Lic9NwlJW5iffPREA75","tlshash":"c5e207d8b2c3b029227378b6497f6007b63abd15242d4843d57be4c17ca5e5a813bfb9","size":33780,"data":"","first_seen":"2023-07-07T04:22:54Z","last_seen":"2026-08-12T05:15:49.073831Z","times_seen":8828,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"promohero.vip/assets/_plugin-vue_export-helper.BCo6x5W8.js","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"introduction_type":"importedModule","is_inline":false,"md5":"41bf66d156aac38dbf7a45b53cb4db18","sha1":"4aa693a2afcc34b6a577e1bfc4be3ef5a458dce0","sha256":"a7dbb0eaed9de79041d555c4563be4bb0514099b8d169a2b548ab2d07102cb55","sha512":"64e1a5c2939052c93692338bf78b66723ae6673121d2915a9fb0848449e4b2657c1a31c8940bc7c9ec77554fd4c04ffae1b787297f0fba23983a987e85caee15","ssdeep":"","tlshash":"40b012e500824138432175c796f444649e08005c394756d144480d52c143080541bc3c","size":91,"data":"","first_seen":"2023-03-26T04:51:44Z","last_seen":"2026-08-12T12:12:38.217345Z","times_seen":1804,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"promohero.vip/assets/uni-app.es.BjJyHCkd.js","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"introduction_type":"importedModule","is_inline":false,"md5":"f54dbbb7ec6ce71a8e0c2c23fa3fc2a8","sha1":"3632390b05a14f4dd7e6548f1df79176c232b4f1","sha256":"2d936cc1fe9ed89d81e7c282adfb4260183819e74cb51bf115ba10c3d421b5fb","sha512":"c59ecd177b5515938b43b99013c1e512c1c7aee1539d279fdd38a087793cc95c6eef68036e104934989480c2c786fdf0733c97ed8cb88e219bda6a196903b2ef","ssdeep":"","tlshash":"9aa0120b784120632802048001755406117614d289c98720c5c083244af44b5c128e0a","size":84,"data":"","first_seen":"2026-01-19T13:29:22.54556Z","last_seen":"2026-01-19T14:26:42.20297Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"promohero.vip/assets/pages-ap-login.AJhI2k2s.js","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"a6e5b78030d338495196dd91c681236d","sha1":"c815186b18b10568c84d0033d8654ae44f381fce","sha256":"bdd436aecaa930fa4a658f7767d4b6d328774f628d41b0a09ba193637b4ccce9","sha512":"fb5560b5296a54bc342e6314caee89ff85a5aab361d2b64cbe3621b846f8fb1f51d0609dd3f80cdaf3d5bb10a127eb51eb100b9533f238a4d124d9fc0940769f","ssdeep":"192:FHo8PrRby4titatCksPgPtNbkIUBzl8Q//BxR1750rnVVrZ39WgcIMWESwvvWyNy:FIy0taFex8Q//v7QTr1THhZMfw","tlshash":"bd52641db92ac374b33b06c861665404b01b1ffed550bdd250f90b1c7ab6eac119a77e","size":13244,"data":"","first_seen":"2026-01-19T13:29:22.543961Z","last_seen":"2026-01-19T14:26:42.176257Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":[{"md5":"3d5272693eb411e5b8b13a243f76c720","sha1":"6a586ab8e0a4bf12bbc60eea6ca9f2418625a22c","sha256":"9582f31f9eb892b8823a780e579d464d54e26d97d65dc327d2b2bdd92d47c4b8","sha512":"03fc5614f48fc9a2e3c4a30626fdbacde74c1fda09ffa9d1cde0393d31cd5fe1588e270c241f4cedb473c6e5cc224ff16c141468a29519ea6159accf3e3a18f1","ssdeep":"","tlshash":"a4c08c8350e2080c8210861b848880050b8808b04f9308a22cd85b7ecc9ae88c8f804c","size":148,"data":"","first_seen":"2023-03-07T01:10:06Z","last_seen":"2026-06-07T08:18:02.151537Z","times_seen":15899,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"console":null},"http":[{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.25.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://promohero.vip/","date":"2026-01-19T14:26:18.041Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 13 Jan 2026 22:16:05 GMT","end":"Mon, 13 Apr 2026 23:15:55 GMT"},"fingerprint":{"sha1":"D9:00:47:77:A5:47:66:A1:6F:DA:EB:4B:BB:BF:67:49:BF:2C:A4:75","sha256":"07:A7:3E:4A:B2:9F:0A:07:6C:78:A7:7B:DC:2B:68:A1:84:7A:7F:1B:45:6C:71:8E:5E:79:F3:11:1A:6C:4F:62"}}},"request":{"raw":"GET /ajax/libs/font-awesome/6.4.0/css/all.min.css HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://promohero.vip/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 19 Jan 2026 14:26:18 GMT\r\ncontent-type: text/css; charset=utf-8\r\ncontent-length: 18752\r\ncf-ray: 9c07019eee3b56c7-OSL\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\netag: \"6421d693-4940\"\r\nlast-modified: Mon, 27 Mar 2023 17:46:59 GMT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/kv\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 475239\r\nexpires: Sat, 09 Jan 2027 14:26:18 GMT\r\naccept-ranges: bytes\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=UBtsS4PM08KlbbU7E5kvSK7gDJunYEFI63SUFNR1L%2FcVzPefkBjAi0vV66rRreRN%2B3yhHD%2F7dky5Y15afH3qBeI3XCXnoGRRZoRl9IwajYurkwFr7wT%2FUBA1I8g9rDlKuAdtiqiP\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nstrict-transport-security: max-age=15780000\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":102025,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (52276)","md5":"ded1c367363e8b20bdc6a19b8350a737","sha1":"8c06d82739d14b094ff6d9036021a252bd1d985d","sha256":"1edb1725a9ea8ca4dcf2f5508cee183218aa1685e47c1b23056717f754f58ebf","sha512":"89e71d2e66ac925ec2564aa45cd43f647fd72e5bd664e2728fb632eed71e9e6a43d72a404a8ce9993fc4d223ed985201e3a66676d01cf5e341bc7d07fd9a6207","ssdeep":"1536:OwMCMPMCMjMCM4MCMwMCM3sVMX709gbPMfjSFOTyPGuZprfZCl:S709gMGFiyPGuZpfZCl","tlshash":"2ea3a7f9e44c05d97732c44bab95b37c65b6f738d5810ca9f02f580c1ad26a822c6f7a","first_seen":"2023-04-06T15:05:25Z","last_seen":"2026-08-12T22:38:07.840373Z","times_seen":59716,"resource_available":false,"data":null}},"time_used":63,"timings":{"blocked":19,"dns":0,"connect":6,"send":0,"wait":14,"receive":1,"ssl":19},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"promohero.vip/assets/pages-ap-login.AJhI2k2s.js","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://promohero.vip/","date":"2026-01-19T14:26:19.386Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"promohero.vip","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 17 Jan 2026 10:47:25 GMT","end":"Fri, 17 Apr 2026 10:47:24 GMT"},"fingerprint":{"sha1":"01:1D:4B:6F:14:B4:6C:1E:CB:CB:33:BC:6E:07:D8:CC:46:F4:75:33","sha256":"40:05:1D:39:DC:B7:C5:70:49:C4:B6:43:09:21:AB:00:61:7D:43:4B:28:83:CC:33:E1:5C:E1:1D:1B:06:69:2D"}}},"request":{"raw":"GET /assets/pages-ap-login.AJhI2k2s.js HTTP/1.1\r\nHost: promohero.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://promohero.vip/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.20.1\r\nDate: Mon, 19 Jan 2026 14:26:19 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 13244\r\nLast-Modified: Sun, 18 Jan 2026 12:04:31 GMT\r\nConnection: keep-alive\r\nETag: \"696ccc4f-33bc\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13244,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (13243)","md5":"a6e5b78030d338495196dd91c681236d","sha1":"c815186b18b10568c84d0033d8654ae44f381fce","sha256":"bdd436aecaa930fa4a658f7767d4b6d328774f628d41b0a09ba193637b4ccce9","sha512":"fb5560b5296a54bc342e6314caee89ff85a5aab361d2b64cbe3621b846f8fb1f51d0609dd3f80cdaf3d5bb10a127eb51eb100b9533f238a4d124d9fc0940769f","ssdeep":"192:FHo8PrRby4titatCksPgPtNbkIUBzl8Q//BxR1750rnVVrZ39WgcIMWESwvvWyNy:FIy0taFex8Q//v7QTr1THhZMfw","tlshash":"bd52641db92ac374b33b06c861665404b01b1ffed550bdd250f90b1c7ab6eac119a77e","first_seen":"2026-01-19T13:29:22.543961Z","last_seen":"2026-01-19T14:26:42.176257Z","times_seen":3,"resource_available":true,"data":null}},"time_used":992,"timings":{"blocked":317,"dns":0,"connect":167,"send":0,"wait":325,"receive":1,"ssl":178},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-19","alert":"Phishing Block","trigger":"promohero.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"promohero.vip/assets/page_footer.DeUJ_Joh.js","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://promohero.vip/","date":"2026-01-19T14:26:19.394Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"promohero.vip","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 17 Jan 2026 10:47:25 GMT","end":"Fri, 17 Apr 2026 10:47:24 GMT"},"fingerprint":{"sha1":"01:1D:4B:6F:14:B4:6C:1E:CB:CB:33:BC:6E:07:D8:CC:46:F4:75:33","sha256":"40:05:1D:39:DC:B7:C5:70:49:C4:B6:43:09:21:AB:00:61:7D:43:4B:28:83:CC:33:E1:5C:E1:1D:1B:06:69:2D"}}},"request":{"raw":"GET /assets/page_footer.DeUJ_Joh.js HTTP/1.1\r\nHost: promohero.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://promohero.vip/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.20.1\r\nDate: Mon, 19 Jan 2026 14:26:19 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 2290\r\nLast-Modified: Sun, 18 Jan 2026 12:04:34 GMT\r\nConnection: keep-alive\r\nETag: \"696ccc52-8f2\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2290,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (2289)","md5":"62c1050cf8319b6c8d3614caa6a77617","sha1":"88e16dce038882242cac06a9dc37391a6fc93b08","sha256":"4d966afae13d6c965d6ed83cb7f6937419e9b89850f50140a762c771979628c4","sha512":"1df54792942e4ff93bbde67c8f7fa684bac314df0f8840f328c03f3e8921ae82cf0621596f89d21a4c4edaa18696c3f2aaf7d61375a2a23cf97e3bc3ba67db9f","ssdeep":"","tlshash":"ff41b0581c4b823f259b91bad522a430b68a1ff0cb74cc92d8f98e55669ddfc3c16d2c","first_seen":"2026-01-19T13:29:22.546668Z","last_seen":"2026-01-19T14:26:42.17858Z","times_seen":3,"resource_available":true,"data":null}},"time_used":805,"timings":{"blocked":301,"dns":1,"connect":165,"send":0,"wait":162,"receive":0,"ssl":173},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-19","alert":"Phishing Block","trigger":"promohero.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"promohero.vip/assets/page_header.7sZiNXYm.js","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://promohero.vip/","date":"2026-01-19T14:26:19.756Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"promohero.vip","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 17 Jan 2026 10:47:25 GMT","end":"Fri, 17 Apr 2026 10:47:24 GMT"},"fingerprint":{"sha1":"01:1D:4B:6F:14:B4:6C:1E:CB:CB:33:BC:6E:07:D8:CC:46:F4:75:33","sha256":"40:05:1D:39:DC:B7:C5:70:49:C4:B6:43:09:21:AB:00:61:7D:43:4B:28:83:CC:33:E1:5C:E1:1D:1B:06:69:2D"}}},"request":{"raw":"GET /assets/page_header.7sZiNXYm.js HTTP/1.1\r\nHost: promohero.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://promohero.vip/assets/pages-ap-login.AJhI2k2s.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.20.1\r\nDate: Mon, 19 Jan 2026 14:26:19 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 756\r\nLast-Modified: Sun, 18 Jan 2026 12:04:35 GMT\r\nConnection: keep-alive\r\nETag: \"696ccc53-2f4\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":756,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (755)","md5":"9bf3d36fac6c5033f107ecbb46524da2","sha1":"c79081ab444f6bf547c6bee94c2b9c350d104f85","sha256":"96e1385f0b9c47bcd46616a5013c427520f3a37da51a1e6dc9f3e54e6c08ee16","sha512":"f31fa232adeeda48c10dfebba771ee67f1cdf8d23ba4febb4f9a1bd119abfc96429edd89e90366f63d2d80d880318093262a2562547433c3a5694442eb366f77","ssdeep":"","tlshash":"2401c04d6c0fc17a622254ded43258382144077e93249cd1c0fccc396bd5dacb65bf29","first_seen":"2026-01-19T13:29:22.550512Z","last_seen":"2026-01-19T14:26:42.180848Z","times_seen":3,"resource_available":true,"data":null}},"time_used":162,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":162,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-19","alert":"Phishing Block","trigger":"promohero.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"promohero.vip/static/favicon.ico","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://promohero.vip/","date":"2026-01-19T14:26:20.077Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"promohero.vip","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 17 Jan 2026 10:47:25 GMT","end":"Fri, 17 Apr 2026 10:47:24 GMT"},"fingerprint":{"sha1":"01:1D:4B:6F:14:B4:6C:1E:CB:CB:33:BC:6E:07:D8:CC:46:F4:75:33","sha256":"40:05:1D:39:DC:B7:C5:70:49:C4:B6:43:09:21:AB:00:61:7D:43:4B:28:83:CC:33:E1:5C:E1:1D:1B:06:69:2D"}}},"request":{"raw":"GET /static/favicon.ico HTTP/1.1\r\nHost: promohero.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://promohero.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.20.1\r\nDate: Mon, 19 Jan 2026 14:26:20 GMT\r\nContent-Type: image/x-icon\r\nContent-Length: 17542\r\nLast-Modified: Sun, 18 Jan 2026 12:04:55 GMT\r\nConnection: keep-alive\r\nETag: \"696ccc67-4486\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17542,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 4 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel","md5":"ca6619b86c2f6e6068b69ba3aaddb7e4","sha1":"c44a1bb9d14385334eb851fbb0afb19d961c1ee7","sha256":"17d02e2db6dbedb95dd449d06868c147ac2c3b5371497bcb9407e75336a99e09","sha512":"30f8f8618bfbcd57925411e6860a10b6ad9a60f2a6b08d35c870ea3f4cec4692596a937ff1457ceff5847d5da2b86ceba0200706625e28c56a2455e6a8c121d3","ssdeep":"192:9dLhJ6/f2dh+xQLeZ10TLwhwOHae6nmErcglsIZS3F:3jaOdhQQu0TLwaOHEr6IZ","tlshash":"ae72f191ad68c084c37ef432dd69deab66467de2b6c26c071fb53f86f23821e7901106","first_seen":"2023-04-17T01:45:41Z","last_seen":"2026-08-12T15:48:32.893978Z","times_seen":19460,"resource_available":false,"data":null}},"time_used":165,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":162,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-19","alert":"Phishing Block","trigger":"promohero.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"promohero.vip/assets/pDxWAF1pBB0dzGB-D7NyJrii.woff2","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://promohero.vip/","date":"2026-01-19T14:26:20.201Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"promohero.vip","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 17 Jan 2026 10:47:25 GMT","end":"Fri, 17 Apr 2026 10:47:24 GMT"},"fingerprint":{"sha1":"01:1D:4B:6F:14:B4:6C:1E:CB:CB:33:BC:6E:07:D8:CC:46:F4:75:33","sha256":"40:05:1D:39:DC:B7:C5:70:49:C4:B6:43:09:21:AB:00:61:7D:43:4B:28:83:CC:33:E1:5C:E1:1D:1B:06:69:2D"}}},"request":{"raw":"GET /assets/pDxWAF1pBB0dzGB-D7NyJrii.woff2 HTTP/1.1\r\nHost: promohero.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://promohero.vip/assets/index-BJ6U4fM6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.20.1\r\nDate: Mon, 19 Jan 2026 14:26:20 GMT\r\nContent-Type: font/woff2\r\nContent-Length: 16616\r\nLast-Modified: Sun, 18 Jan 2026 12:04:36 GMT\r\nConnection: keep-alive\r\nETag: \"696ccc54-40e8\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16616,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 16616, version 1.655","md5":"4afcd3b79b78d33386f497877a29c518","sha1":"cc7ebaa05a2cd3b02c0929ac0475a44ab30b7efa","sha256":"cded49f94fc16dc0a14923975e159fbf4b14844593e612c1342c9e34e2f96821","sha512":"2dc9fff1d57d5529c9c7bff26fa9f3f94adc47e9cef51d782e55ecf93045200140706ab5816dfd4a0b49b8db2263320fa2f0fa31a04e12d0c91fea79b127255d","ssdeep":"384:0qJzQ61qLjMj2JfDC3uq2B/YgduJyovfw4TQRJGL7VGhX8aJl/hObP:x8LHMjGbCeqEFuBwkqJGLhGhVLsP","tlshash":"a772d03d74972759eac2ce7f720d228627d6f9888e615fe83817d00c657604e6a603ec","first_seen":"2023-04-05T14:54:42Z","last_seen":"2026-08-12T14:12:32.325626Z","times_seen":26058,"resource_available":false,"data":null}},"time_used":174,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":173,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-19","alert":"Phishing Block","trigger":"promohero.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"promohero.vip/assets/WOnTLzkiaEccV7F-8TP-lpnZ.woff2","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://promohero.vip/","date":"2026-01-19T14:26:20.445Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"promohero.vip","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 17 Jan 2026 10:47:25 GMT","end":"Fri, 17 Apr 2026 10:47:24 GMT"},"fingerprint":{"sha1":"01:1D:4B:6F:14:B4:6C:1E:CB:CB:33:BC:6E:07:D8:CC:46:F4:75:33","sha256":"40:05:1D:39:DC:B7:C5:70:49:C4:B6:43:09:21:AB:00:61:7D:43:4B:28:83:CC:33:E1:5C:E1:1D:1B:06:69:2D"}}},"request":{"raw":"GET /assets/WOnTLzkiaEccV7F-8TP-lpnZ.woff2 HTTP/1.1\r\nHost: promohero.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://promohero.vip/assets/index-BJ6U4fM6.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.20.1\r\nDate: Mon, 19 Jan 2026 14:26:20 GMT\r\nContent-Type: font/woff2\r\nContent-Length: 17336\r\nLast-Modified: Sun, 18 Jan 2026 12:04:41 GMT\r\nConnection: keep-alive\r\nETag: \"696ccc59-43b8\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17336,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 17336, version 1.655","md5":"b39e082c6b983705892045fd87e0b9a8","sha1":"9cc1bb64eb270135f1adf3a4881c2ee5e7c37be5","sha256":"cb0f25ca005489d2399434c33762f291bd8746714eae3aa72de20aca08edc458","sha512":"ddbb8b598854dd829befb27641b1c56f23fce55283d3fa33f0bfda1c3b38ce7dc03a799e84902c580ba8a54361d33a49038368c96d9fcde6a50fe83514774d17","ssdeep":"384:e5synBGYXpmI4lCKsduXVgswk7BlSOSEtMoFr2h:usyJXpmDlgex73R1qox2h","tlshash":"c072d01575bc16e692c078df0ecd95b010ad80b1ea9d4093a37bdf5324f8295b0fc99d","first_seen":"2023-04-05T14:54:43Z","last_seen":"2026-08-12T14:12:32.450863Z","times_seen":25066,"resource_available":false,"data":null}},"time_used":182,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":172,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-19","alert":"Phishing Block","trigger":"promohero.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.dcloud.net.cn/img/shadow-grey.png","fqdn":"cdn.dcloud.net.cn","domain":"dcloud.net.cn","tld":"net.cn"},"ip":{"addr":"124.221.80.91","port":443,"asn":45090,"as":"Shenzhen Tencent Computer Systems Company Limited","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://promohero.vip/","date":"2026-01-19T14:26:21.749Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.dcloud.net.cn","organization":""},"issuer":{"commonName":"Certum Domain Validation CA SHA2","organization":"Unizeto Technologies S.A."},"validity":{"start":"Tue, 26 Aug 2025 11:47:17 GMT","end":"Fri, 25 Sep 2026 11:47:16 GMT"},"fingerprint":{"sha1":"47:A7:6C:09:6B:1D:CA:2D:7D:39:2E:C1:7F:15:DE:5D:F2:C4:0F:77","sha256":"EA:73:37:83:D0:38:44:D9:3C:0B:26:F0:DD:D1:22:2F:36:F7:F2:86:A1:B0:58:52:DE:4E:0A:21:D6:89:E7:3E"}}},"request":{"raw":"GET /img/shadow-grey.png HTTP/1.1\r\nHost: cdn.dcloud.net.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://promohero.vip/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 19 Jan 2026 14:26:22 GMT\r\ncontent-type: image/png\r\ncontent-length: 136\r\nlast-modified: Thu, 06 Jun 2019 06:42:07 GMT\r\netag: \"5cf8b5bf-88\"\r\nexpires: Mon, 19 Jan 2026 15:26:22 GMT\r\ncache-control: max-age=3600\r\nset-cookie: __uni__uid=rBEQVWluPw4KH3T8A1l4Ag==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=dcloud.net.cn; path=/; secure; httponly; samesite=none\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":136,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1 x 6, 4-bit colormap, non-interlaced","md5":"5a962adf74d92ae702467b3f47976547","sha1":"36f74049375584e3fa69b5ef87e9572336ff9e7a","sha256":"ad4ebea1c3496dd2924789ee009174a2c6289d1200e9811f458fd46f172d1d6f","sha512":"4ace23fe7ec6c7271710030fd423aace13eafac68ac3e76366ce4ce9bdc702caf71c9bdc2fb6a32c8e9791546098617cc0259decd8bb8489afdbce43e1b53a73","ssdeep":"","tlshash":"47c09bf3a615dc754a0d153b42e98271f429511e07046d0e5a13c216741e3448d56793","first_seen":"2023-04-15T10:50:30Z","last_seen":"2026-08-12T17:58:05.004946Z","times_seen":20215,"resource_available":false,"data":null}},"time_used":1501,"timings":{"blocked":627,"dns":43,"connect":245,"send":0,"wait":245,"receive":1,"ssl":336},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"promohero.vip/","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-19T14:26:17.176Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"promohero.vip","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 17 Jan 2026 10:47:25 GMT","end":"Fri, 17 Apr 2026 10:47:24 GMT"},"fingerprint":{"sha1":"01:1D:4B:6F:14:B4:6C:1E:CB:CB:33:BC:6E:07:D8:CC:46:F4:75:33","sha256":"40:05:1D:39:DC:B7:C5:70:49:C4:B6:43:09:21:AB:00:61:7D:43:4B:28:83:CC:33:E1:5C:E1:1D:1B:06:69:2D"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: promohero.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.20.1\r\nDate: Mon, 19 Jan 2026 14:26:17 GMT\r\nContent-Type: text/html\r\nLast-Modified: Sun, 18 Jan 2026 12:03:18 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"696ccc06-528\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]},{"name":"FingerprintJS:3","description":"FingerprintJS is a browser fingerprinting library that queries browser attributes and computes a hashed visitor identifier from them.","website":"https://fingerprintjs.com","common_platform_enumeration":"","icon":"FingerprintJS.svg","categories":["JavaScript libraries","Browser fingerprinting"]}],"data":{"size":1320,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, CR, LF line terminators","md5":"1b1ab474ecdead017c7743881bb9bc55","sha1":"67452f8866f1196bab7f086c61ffba2d3559afe8","sha256":"a7f7d5cea02a942ce8b32fbc1276557fe5f09c0b2c1aee451bc291793d78427a","sha512":"ecd427dc0d8594083bc440d85bd0a5e535c3c87a74780e826689fd906c67228d25fbb3576921eada3356cfbd3de241399f040c069d3c76718a00cdf574324d3b","ssdeep":"","tlshash":"c121a5493848af0d122092867032e03e9cb74c363e80d97328b2513ba7a438fcc0c898","first_seen":"2026-01-19T13:29:22.548031Z","last_seen":"2026-01-19T14:26:42.19216Z","times_seen":3,"resource_available":false,"data":null}},"time_used":947,"timings":{"blocked":392,"dns":57,"connect":164,"send":0,"wait":163,"receive":0,"ssl":168},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-19","alert":"Phishing Block","trigger":"promohero.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"promohero.vip/assets/page_header-BavpIdKa.css","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://promohero.vip/","date":"2026-01-19T14:26:19.364Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"promohero.vip","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 17 Jan 2026 10:47:25 GMT","end":"Fri, 17 Apr 2026 10:47:24 GMT"},"fingerprint":{"sha1":"01:1D:4B:6F:14:B4:6C:1E:CB:CB:33:BC:6E:07:D8:CC:46:F4:75:33","sha256":"40:05:1D:39:DC:B7:C5:70:49:C4:B6:43:09:21:AB:00:61:7D:43:4B:28:83:CC:33:E1:5C:E1:1D:1B:06:69:2D"}}},"request":{"raw":"GET /assets/page_header-BavpIdKa.css HTTP/1.1\r\nHost: promohero.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://promohero.vip/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.20.1\r\nDate: Mon, 19 Jan 2026 14:26:19 GMT\r\nContent-Type: text/css\r\nContent-Length: 1241\r\nLast-Modified: Sun, 18 Jan 2026 12:04:35 GMT\r\nConnection: keep-alive\r\nETag: \"696ccc53-4d9\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1241,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1240)","md5":"90fb8b7b14dfd383bafdd233eb5ac3da","sha1":"c0f0c8ad1e1aea242312b13009ee84d13a11e697","sha256":"27b4b0a6d5113763c60af9b46dd862d7a0785dcdcad5ebf12be3230f97f326a4","sha512":"a40f1ac22707a5dc28539d6fb38aa008cd133f4c64a5ea09b578143ddecaab1d78ab070aa70cb5e68d8dc7e68528147a4684b1ed395e270d3716b8cde7d8ecbe","ssdeep":"","tlshash":"09219d5d63cd1c2cf563c17dd5af534810b03237c363c5b9848ba5198d678251b57dc6","first_seen":"2025-09-27T19:31:00.068652Z","last_seen":"2026-02-26T01:00:45.924658Z","times_seen":70,"resource_available":false,"data":null}},"time_used":163,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":163,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-19","alert":"Phishing Block","trigger":"promohero.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"promohero.vip/assets/page_footer-75n2Pr1D.css","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://promohero.vip/","date":"2026-01-19T14:26:19.366Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"promohero.vip","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 17 Jan 2026 10:47:25 GMT","end":"Fri, 17 Apr 2026 10:47:24 GMT"},"fingerprint":{"sha1":"01:1D:4B:6F:14:B4:6C:1E:CB:CB:33:BC:6E:07:D8:CC:46:F4:75:33","sha256":"40:05:1D:39:DC:B7:C5:70:49:C4:B6:43:09:21:AB:00:61:7D:43:4B:28:83:CC:33:E1:5C:E1:1D:1B:06:69:2D"}}},"request":{"raw":"GET /assets/page_footer-75n2Pr1D.css HTTP/1.1\r\nHost: promohero.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://promohero.vip/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.20.1\r\nDate: Mon, 19 Jan 2026 14:26:19 GMT\r\nContent-Type: text/css\r\nContent-Length: 3851\r\nLast-Modified: Sun, 18 Jan 2026 12:04:34 GMT\r\nConnection: keep-alive\r\nETag: \"696ccc52-f0b\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3851,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (3850)","md5":"3ed08c7713abd1971eb2ec52bff7b810","sha1":"ca4622427871ade27539e4ef2631ccb6735198d7","sha256":"f6605a4d5c826c26f546de757c33568d246b6040ab6ddfd9a81966e399a93ab0","sha512":"9d0ab6db3558d0ad46fb7de5bcfb6481f08fa79b26d496b0141842ab0e11849d3c46352c11dead1d14e542e3af748476d19132fa81d3c908b559cd3897f7405f","ssdeep":"","tlshash":"5f81d011df494c53b66bde39e667638c7b360723a53284af9423e21dd86b0862333d6c","first_seen":"2026-01-15T14:00:58.770397Z","last_seen":"2026-02-26T01:00:45.913019Z","times_seen":59,"resource_available":false,"data":null}},"time_used":166,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":166,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-19","alert":"Phishing Block","trigger":"promohero.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"promohero.vip/assets/pages-ap-login.AJhI2k2s.js","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://promohero.vip/","date":"2026-01-19T14:26:19.533Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"promohero.vip","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 17 Jan 2026 10:47:25 GMT","end":"Fri, 17 Apr 2026 10:47:24 GMT"},"fingerprint":{"sha1":"01:1D:4B:6F:14:B4:6C:1E:CB:CB:33:BC:6E:07:D8:CC:46:F4:75:33","sha256":"40:05:1D:39:DC:B7:C5:70:49:C4:B6:43:09:21:AB:00:61:7D:43:4B:28:83:CC:33:E1:5C:E1:1D:1B:06:69:2D"}}},"request":{"raw":"GET /assets/pages-ap-login.AJhI2k2s.js HTTP/1.1\r\nHost: promohero.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://promohero.vip/assets/index-DLgUzMRo.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.20.1\r\nDate: Mon, 19 Jan 2026 14:26:19 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 13244\r\nLast-Modified: Sun, 18 Jan 2026 12:04:31 GMT\r\nConnection: keep-alive\r\nETag: \"696ccc4f-33bc\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13244,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (13243)","md5":"a6e5b78030d338495196dd91c681236d","sha1":"c815186b18b10568c84d0033d8654ae44f381fce","sha256":"bdd436aecaa930fa4a658f7767d4b6d328774f628d41b0a09ba193637b4ccce9","sha512":"fb5560b5296a54bc342e6314caee89ff85a5aab361d2b64cbe3621b846f8fb1f51d0609dd3f80cdaf3d5bb10a127eb51eb100b9533f238a4d124d9fc0940769f","ssdeep":"192:FHo8PrRby4titatCksPgPtNbkIUBzl8Q//BxR1750rnVVrZ39WgcIMWESwvvWyNy:FIy0taFex8Q//v7QTr1THhZMfw","tlshash":"bd52641db92ac374b33b06c861665404b01b1ffed550bdd250f90b1c7ab6eac119a77e","first_seen":"2026-01-19T13:29:22.543961Z","last_seen":"2026-01-19T14:26:42.176257Z","times_seen":3,"resource_available":true,"data":null}},"time_used":168,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":164,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-19","alert":"Phishing Block","trigger":"promohero.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"promohero.vip/assets/_plugin-vue_export-helper.BCo6x5W8.js","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://promohero.vip/","date":"2026-01-19T14:26:19.750Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"promohero.vip","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 17 Jan 2026 10:47:25 GMT","end":"Fri, 17 Apr 2026 10:47:24 GMT"},"fingerprint":{"sha1":"01:1D:4B:6F:14:B4:6C:1E:CB:CB:33:BC:6E:07:D8:CC:46:F4:75:33","sha256":"40:05:1D:39:DC:B7:C5:70:49:C4:B6:43:09:21:AB:00:61:7D:43:4B:28:83:CC:33:E1:5C:E1:1D:1B:06:69:2D"}}},"request":{"raw":"GET /assets/_plugin-vue_export-helper.BCo6x5W8.js HTTP/1.1\r\nHost: promohero.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://promohero.vip/assets/pages-ap-login.AJhI2k2s.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.20.1\r\nDate: Mon, 19 Jan 2026 14:26:19 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 91\r\nLast-Modified: Sun, 18 Jan 2026 12:04:52 GMT\r\nConnection: keep-alive\r\nETag: \"696ccc64-5b\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":91,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"41bf66d156aac38dbf7a45b53cb4db18","sha1":"4aa693a2afcc34b6a577e1bfc4be3ef5a458dce0","sha256":"a7dbb0eaed9de79041d555c4563be4bb0514099b8d169a2b548ab2d07102cb55","sha512":"64e1a5c2939052c93692338bf78b66723ae6673121d2915a9fb0848449e4b2657c1a31c8940bc7c9ec77554fd4c04ffae1b787297f0fba23983a987e85caee15","ssdeep":"","tlshash":"40b012e500824138432175c796f444649e08005c394756d144480d52c143080541bc3c","first_seen":"2023-03-26T04:51:44Z","last_seen":"2026-08-12T12:12:38.217345Z","times_seen":1804,"resource_available":true,"data":null}},"time_used":163,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":162,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-19","alert":"Phishing Block","trigger":"promohero.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/@fingerprintjs/fingerprintjs@3/dist/fp.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.193.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://promohero.vip/","date":"2026-01-19T14:26:18.039Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2025 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 02 Jun 2025 15:43:52 GMT","end":"Sat, 04 Jul 2026 15:43:51 GMT"},"fingerprint":{"sha1":"21:17:81:78:41:C6:8F:86:D6:CF:8D:98:CC:74:A8:F1:03:F8:C9:D4","sha256":"D0:E6:8D:08:11:05:7E:0C:2A:0D:C7:E0:ED:AE:9E:18:C8:74:32:12:3D:56:43:98:62:CD:A2:08:6F:64:5B:B0"}}},"request":{"raw":"GET /npm/@fingerprintjs/fingerprintjs@3/dist/fp.min.js HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://promohero.vip/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=604800, s-maxage=43200\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: application/javascript; charset=utf-8\r\nx-jsd-version: 3.4.2\r\nx-jsd-version-type: version\r\netag: W/\"83f4-k1lBXMQZh0ZUAAhwylRSOHXBLBY\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\ndate: Mon, 19 Jan 2026 14:26:18 GMT\r\nage: 40262\r\nx-served-by: cache-fra-eddf8230038-FRA, cache-hel1410029-HEL\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 14485\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":33780,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (33446)","md5":"375436f436cc1022d7b4569a817c1a6b","sha1":"9359415cc419874654000870ca54523875c12c16","sha256":"99dc3803d1f19c8103f79f834044b2afd4c8af5b7927efbd36b1052d528b40ae","sha512":"077cb9e67a028f8ffc6c9f19793c15e20379840da1a927e711a0ac4dcf15fe6e1a15cee75436df340c707b9e77118f3cd38ede493e060c592069f39bc6001a92","ssdeep":"384:chQYSwHRBcifEJzXhGUa4LdsF7wRuCfLVg5+pCqNFaiE8E0QIQfJW7us6RfGDUPX:cSMHRU7Lic9NwlJW5iffPREA75","tlshash":"c5e207d8b2c3b029227378b6497f6007b63abd15242d4843d57be4c17ca5e5a813bfb9","first_seen":"2023-07-07T04:22:54Z","last_seen":"2026-08-12T05:15:49.073831Z","times_seen":8828,"resource_available":true,"data":null}},"time_used":83,"timings":{"blocked":27,"dns":1,"connect":14,"send":0,"wait":17,"receive":1,"ssl":20},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://promohero.vip/","date":"2026-01-19T14:26:18.043Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Tue, 09 Dec 2025 17:10:07 GMT","end":"Tue, 03 Mar 2026 17:10:06 GMT"},"fingerprint":{"sha1":"82:59:95:33:5E:76:7F:3E:5B:45:F4:CA:83:29:7C:B2:19:B0:A5:C0","sha256":"A1:28:19:D2:C4:EA:69:3E:6D:8D:7A:20:FC:3E:A6:13:BA:59:C5:9C:DE:7D:D1:25:3D:35:68:98:FC:47:82:9D"}}},"request":{"raw":"GET /css2?family=Inter:wght@300;400;500;600;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://promohero.vip/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Mon, 19 Jan 2026 14:26:18 GMT\r\ndate: Mon, 19 Jan 2026 14:26:18 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12635,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"f04de8ad1ef740d940ec0f534a8f6474","sha1":"3b31756e84c8887867417c7d6cc64501c9d9193c","sha256":"2f1ac0c31bc3ede8317cf72e9d28051ec727c9a0014aa69cff495abd6256bb4e","sha512":"69afede137c125294044274e463f30c02594f379ec879285e0b3ee41097f503dfb8272487759870f547e4dc4cf8828a2c1efaa806deb2f3124b7f6d67c638783","ssdeep":"192:wNA1cO3lnxirNNIxO34OxDENOPCO3/Nx8NNryfO3iExlONEhYO3RrxGx:8KYXuM0p2+4","tlshash":"28427892002ba400ab971dc233cf7f3aaece50896085d1b95ffd0dc59cead66436876d","first_seen":"2025-09-10T18:44:19.218006Z","last_seen":"2026-08-12T22:27:09.994306Z","times_seen":28725,"resource_available":false,"data":null}},"time_used":386,"timings":{"blocked":172,"dns":1,"connect":23,"send":0,"wait":32,"receive":0,"ssl":155},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"promohero.vip/assets/index-DLgUzMRo.js","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://promohero.vip/","date":"2026-01-19T14:26:18.046Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"promohero.vip","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 17 Jan 2026 10:47:25 GMT","end":"Fri, 17 Apr 2026 10:47:24 GMT"},"fingerprint":{"sha1":"01:1D:4B:6F:14:B4:6C:1E:CB:CB:33:BC:6E:07:D8:CC:46:F4:75:33","sha256":"40:05:1D:39:DC:B7:C5:70:49:C4:B6:43:09:21:AB:00:61:7D:43:4B:28:83:CC:33:E1:5C:E1:1D:1B:06:69:2D"}}},"request":{"raw":"GET /assets/index-DLgUzMRo.js HTTP/1.1\r\nHost: promohero.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://promohero.vip/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.20.1\r\nDate: Mon, 19 Jan 2026 14:26:18 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 399136\r\nLast-Modified: Sun, 18 Jan 2026 12:04:05 GMT\r\nConnection: keep-alive\r\nETag: \"696ccc35-61720\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":399136,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (63005)","md5":"049668222db4642100d4ff1529d0ec6a","sha1":"60d9352ca62168e95e1a01b601efb3ff712239db","sha256":"44b4bd5aea19a1046f65432fb167f994c3f13df219ec7074a3f5c62da9989dda","sha512":"42c99d2730f0ce887d367f015d43fa4e1b84e5f60b8d8f15a56ebba10280c9b35f5ebf3917e48cc2e3a14a369d0646012b9f0efb70a74e4866e6d73cbeba188c","ssdeep":"12288:38lX/qx7zvIczg7/v8dpnVPTUD9iwug151ilcOZWENJqKI5:38lX/qx7zvIczg7HMpnVPAD9iwug151D","tlshash":"cf844bd4b685b46903b639f6403f1101f33e1d16b80d8498f66ce9db3d2a99962b7f38","first_seen":"2026-01-19T13:29:22.555536Z","last_seen":"2026-01-19T14:26:42.201041Z","times_seen":3,"resource_available":true,"data":null}},"time_used":1507,"timings":{"blocked":327,"dns":1,"connect":162,"send":0,"wait":323,"receive":521,"ssl":167},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-19","alert":"Phishing Block","trigger":"promohero.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"promohero.vip/assets/login-B_EJHJEu.css","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://promohero.vip/","date":"2026-01-19T14:26:19.368Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"promohero.vip","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 17 Jan 2026 10:47:25 GMT","end":"Fri, 17 Apr 2026 10:47:24 GMT"},"fingerprint":{"sha1":"01:1D:4B:6F:14:B4:6C:1E:CB:CB:33:BC:6E:07:D8:CC:46:F4:75:33","sha256":"40:05:1D:39:DC:B7:C5:70:49:C4:B6:43:09:21:AB:00:61:7D:43:4B:28:83:CC:33:E1:5C:E1:1D:1B:06:69:2D"}}},"request":{"raw":"GET /assets/login-B_EJHJEu.css HTTP/1.1\r\nHost: promohero.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://promohero.vip/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.20.1\r\nDate: Mon, 19 Jan 2026 14:26:19 GMT\r\nContent-Type: text/css\r\nContent-Length: 8507\r\nLast-Modified: Sun, 18 Jan 2026 12:04:20 GMT\r\nConnection: keep-alive\r\nETag: \"696ccc44-213b\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8507,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (8506)","md5":"fa4d978f2df47dcc0eb2b841ae425829","sha1":"2733c37a904db134792e78269d1c3492cef34f07","sha256":"80d595eb2376be280201a584268e9f30db54b917fb20cd7727d78bc7da3ef6ab","sha512":"8982fbdd30e14da053ae9ea7eeb963298d4fdcd2c254d52d64a38831411f43a811ab2fe975b09d38109719c279bd88f1f3e9476fe2cdbec5032c28f375d8441d","ssdeep":"96:2hG7YvMfzXnE8VqPR9p7ApVHCwpMT0mLypXcm2Eaz:208ZK00mLyRcm2Eq","tlshash":"bd0213f4ba085006d7f7c791aea5bd890119f212d7126edd9da635248ccbac738b128d","first_seen":"2026-01-19T13:29:22.549654Z","last_seen":"2026-02-26T01:00:45.925277Z","times_seen":52,"resource_available":false,"data":null}},"time_used":166,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":165,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-19","alert":"Phishing Block","trigger":"promohero.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"promohero.vip/assets/_plugin-vue_export-helper.BCo6x5W8.js","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://promohero.vip/","date":"2026-01-19T14:26:19.390Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"promohero.vip","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 17 Jan 2026 10:47:25 GMT","end":"Fri, 17 Apr 2026 10:47:24 GMT"},"fingerprint":{"sha1":"01:1D:4B:6F:14:B4:6C:1E:CB:CB:33:BC:6E:07:D8:CC:46:F4:75:33","sha256":"40:05:1D:39:DC:B7:C5:70:49:C4:B6:43:09:21:AB:00:61:7D:43:4B:28:83:CC:33:E1:5C:E1:1D:1B:06:69:2D"}}},"request":{"raw":"GET /assets/_plugin-vue_export-helper.BCo6x5W8.js HTTP/1.1\r\nHost: promohero.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://promohero.vip/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.20.1\r\nDate: Mon, 19 Jan 2026 14:26:19 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 91\r\nLast-Modified: Sun, 18 Jan 2026 12:04:52 GMT\r\nConnection: keep-alive\r\nETag: \"696ccc64-5b\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":91,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"41bf66d156aac38dbf7a45b53cb4db18","sha1":"4aa693a2afcc34b6a577e1bfc4be3ef5a458dce0","sha256":"a7dbb0eaed9de79041d555c4563be4bb0514099b8d169a2b548ab2d07102cb55","sha512":"64e1a5c2939052c93692338bf78b66723ae6673121d2915a9fb0848449e4b2657c1a31c8940bc7c9ec77554fd4c04ffae1b787297f0fba23983a987e85caee15","ssdeep":"","tlshash":"40b012e500824138432175c796f444649e08005c394756d144480d52c143080541bc3c","first_seen":"2023-03-26T04:51:44Z","last_seen":"2026-08-12T12:12:38.217345Z","times_seen":1804,"resource_available":true,"data":null}},"time_used":841,"timings":{"blocked":321,"dns":0,"connect":166,"send":0,"wait":163,"receive":1,"ssl":182},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-19","alert":"Phishing Block","trigger":"promohero.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"promohero.vip/assets/uni-app.es.BjJyHCkd.js","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://promohero.vip/","date":"2026-01-19T14:26:19.391Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"promohero.vip","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 17 Jan 2026 10:47:25 GMT","end":"Fri, 17 Apr 2026 10:47:24 GMT"},"fingerprint":{"sha1":"01:1D:4B:6F:14:B4:6C:1E:CB:CB:33:BC:6E:07:D8:CC:46:F4:75:33","sha256":"40:05:1D:39:DC:B7:C5:70:49:C4:B6:43:09:21:AB:00:61:7D:43:4B:28:83:CC:33:E1:5C:E1:1D:1B:06:69:2D"}}},"request":{"raw":"GET /assets/uni-app.es.BjJyHCkd.js HTTP/1.1\r\nHost: promohero.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://promohero.vip/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.20.1\r\nDate: Mon, 19 Jan 2026 14:26:19 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 84\r\nLast-Modified: Sun, 18 Jan 2026 12:04:40 GMT\r\nConnection: keep-alive\r\nETag: \"696ccc58-54\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":84,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text","md5":"f54dbbb7ec6ce71a8e0c2c23fa3fc2a8","sha1":"3632390b05a14f4dd7e6548f1df79176c232b4f1","sha256":"2d936cc1fe9ed89d81e7c282adfb4260183819e74cb51bf115ba10c3d421b5fb","sha512":"c59ecd177b5515938b43b99013c1e512c1c7aee1539d279fdd38a087793cc95c6eef68036e104934989480c2c786fdf0733c97ed8cb88e219bda6a196903b2ef","ssdeep":"","tlshash":"9aa0120b784120632802048001755406117614d289c98720c5c083244af44b5c128e0a","first_seen":"2026-01-19T13:29:22.54556Z","last_seen":"2026-01-19T14:26:42.20297Z","times_seen":3,"resource_available":true,"data":null}},"time_used":839,"timings":{"blocked":322,"dns":0,"connect":169,"send":0,"wait":163,"receive":0,"ssl":182},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-19","alert":"Phishing Block","trigger":"promohero.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"promohero.vip/assets/page_header.7sZiNXYm.js","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://promohero.vip/","date":"2026-01-19T14:26:19.393Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"promohero.vip","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 17 Jan 2026 10:47:25 GMT","end":"Fri, 17 Apr 2026 10:47:24 GMT"},"fingerprint":{"sha1":"01:1D:4B:6F:14:B4:6C:1E:CB:CB:33:BC:6E:07:D8:CC:46:F4:75:33","sha256":"40:05:1D:39:DC:B7:C5:70:49:C4:B6:43:09:21:AB:00:61:7D:43:4B:28:83:CC:33:E1:5C:E1:1D:1B:06:69:2D"}}},"request":{"raw":"GET /assets/page_header.7sZiNXYm.js HTTP/1.1\r\nHost: promohero.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://promohero.vip/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.20.1\r\nDate: Mon, 19 Jan 2026 14:26:19 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 756\r\nLast-Modified: Sun, 18 Jan 2026 12:04:35 GMT\r\nConnection: keep-alive\r\nETag: \"696ccc53-2f4\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":756,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (755)","md5":"9bf3d36fac6c5033f107ecbb46524da2","sha1":"c79081ab444f6bf547c6bee94c2b9c350d104f85","sha256":"96e1385f0b9c47bcd46616a5013c427520f3a37da51a1e6dc9f3e54e6c08ee16","sha512":"f31fa232adeeda48c10dfebba771ee67f1cdf8d23ba4febb4f9a1bd119abfc96429edd89e90366f63d2d80d880318093262a2562547433c3a5694442eb366f77","ssdeep":"","tlshash":"2401c04d6c0fc17a622254ded43258382144077e93249cd1c0fccc396bd5dacb65bf29","first_seen":"2026-01-19T13:29:22.550512Z","last_seen":"2026-01-19T14:26:42.180848Z","times_seen":3,"resource_available":true,"data":null}},"time_used":844,"timings":{"blocked":323,"dns":1,"connect":167,"send":0,"wait":165,"receive":1,"ssl":181},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-19","alert":"Phishing Block","trigger":"promohero.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"promohero.vip/assets/page_footer.DeUJ_Joh.js","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://promohero.vip/","date":"2026-01-19T14:26:19.758Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"promohero.vip","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 17 Jan 2026 10:47:25 GMT","end":"Fri, 17 Apr 2026 10:47:24 GMT"},"fingerprint":{"sha1":"01:1D:4B:6F:14:B4:6C:1E:CB:CB:33:BC:6E:07:D8:CC:46:F4:75:33","sha256":"40:05:1D:39:DC:B7:C5:70:49:C4:B6:43:09:21:AB:00:61:7D:43:4B:28:83:CC:33:E1:5C:E1:1D:1B:06:69:2D"}}},"request":{"raw":"GET /assets/page_footer.DeUJ_Joh.js HTTP/1.1\r\nHost: promohero.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://promohero.vip/assets/pages-ap-login.AJhI2k2s.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.20.1\r\nDate: Mon, 19 Jan 2026 14:26:19 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 2290\r\nLast-Modified: Sun, 18 Jan 2026 12:04:34 GMT\r\nConnection: keep-alive\r\nETag: \"696ccc52-8f2\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2290,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (2289)","md5":"62c1050cf8319b6c8d3614caa6a77617","sha1":"88e16dce038882242cac06a9dc37391a6fc93b08","sha256":"4d966afae13d6c965d6ed83cb7f6937419e9b89850f50140a762c771979628c4","sha512":"1df54792942e4ff93bbde67c8f7fa684bac314df0f8840f328c03f3e8921ae82cf0621596f89d21a4c4edaa18696c3f2aaf7d61375a2a23cf97e3bc3ba67db9f","ssdeep":"","tlshash":"ff41b0581c4b823f259b91bad522a430b68a1ff0cb74cc92d8f98e55669ddfc3c16d2c","first_seen":"2026-01-19T13:29:22.546668Z","last_seen":"2026-01-19T14:26:42.17858Z","times_seen":3,"resource_available":true,"data":null}},"time_used":312,"timings":{"blocked":149,"dns":0,"connect":0,"send":0,"wait":162,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-19","alert":"Phishing Block","trigger":"promohero.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"promohero.vip/assets/uni.cb5fb309.css","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://promohero.vip/","date":"2026-01-19T14:26:18.037Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"promohero.vip","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 17 Jan 2026 10:47:25 GMT","end":"Fri, 17 Apr 2026 10:47:24 GMT"},"fingerprint":{"sha1":"01:1D:4B:6F:14:B4:6C:1E:CB:CB:33:BC:6E:07:D8:CC:46:F4:75:33","sha256":"40:05:1D:39:DC:B7:C5:70:49:C4:B6:43:09:21:AB:00:61:7D:43:4B:28:83:CC:33:E1:5C:E1:1D:1B:06:69:2D"}}},"request":{"raw":"GET /assets/uni.cb5fb309.css HTTP/1.1\r\nHost: promohero.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://promohero.vip/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.20.1\r\nDate: Mon, 19 Jan 2026 14:26:18 GMT\r\nContent-Type: text/css\r\nContent-Length: 8989\r\nLast-Modified: Sun, 18 Jan 2026 12:04:41 GMT\r\nConnection: keep-alive\r\nETag: \"696ccc59-231d\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8989,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (8988)","md5":"bdeccd0ec3cd386e6159326361db8be7","sha1":"70931ddf88c5bdd20c0a911e50b9ec1f9c7dc42d","sha256":"cb5fb309851d767f1f221cd06a7e2c274a6567160d80d0908b98e057a709c0c1","sha512":"b897e7fc5309c888392a058e9a6201b9d47240af40bbc2be5bec81066384384bc13761884015913c9bd236c1888443605944d0c63cdd8c93836d443d208d1ef5","ssdeep":"192:Ujj8LGJ0CQLnWL9MNXVA87eizyHEDyPhd:UXpmLWLL87ei+ywd","tlshash":"17027571d900123eb51bcf2d52e1e74f322285b3d9133b19ab3535744f9eac62a36789","first_seen":"2025-09-27T19:31:00.036679Z","last_seen":"2026-05-31T15:28:13.956851Z","times_seen":176,"resource_available":false,"data":null}},"time_used":178,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":177,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-19","alert":"Phishing Block","trigger":"promohero.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"promohero.vip/assets/index-BJ6U4fM6.css","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://promohero.vip/","date":"2026-01-19T14:26:18.048Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"promohero.vip","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 17 Jan 2026 10:47:25 GMT","end":"Fri, 17 Apr 2026 10:47:24 GMT"},"fingerprint":{"sha1":"01:1D:4B:6F:14:B4:6C:1E:CB:CB:33:BC:6E:07:D8:CC:46:F4:75:33","sha256":"40:05:1D:39:DC:B7:C5:70:49:C4:B6:43:09:21:AB:00:61:7D:43:4B:28:83:CC:33:E1:5C:E1:1D:1B:06:69:2D"}}},"request":{"raw":"GET /assets/index-BJ6U4fM6.css HTTP/1.1\r\nHost: promohero.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://promohero.vip/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.20.1\r\nDate: Mon, 19 Jan 2026 14:26:18 GMT\r\nContent-Type: text/css\r\nContent-Length: 75612\r\nLast-Modified: Sun, 18 Jan 2026 12:04:04 GMT\r\nConnection: keep-alive\r\nETag: \"696ccc34-1275c\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":75612,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"dda96fe3e14699edd8325f13a09c3a07","sha1":"2c11932bbb9a18a972ae61498c6f1a96019c609e","sha256":"f49eb271e44229e6afa121e071ed19d51be17d214a1e9e86f349fdae01952c3b","sha512":"1300bda65975991388814103c406723a7a8e501c298cf3660005393a7a9935c235608683a15e4621a45ba7f43a306e7bc9d12bb5acd806ce533f6e370f53f70c","ssdeep":"1536:80KR1AKeEfqe2T7XnC171+aWn9he/4Sycpo:HT7XC15bWze/hY","tlshash":"2373fa340036a458e5f3dc1330cd3d523c4da027aa8a9527e62f8aac5ee787787a5f75","first_seen":"2025-09-27T19:31:00.071648Z","last_seen":"2026-03-08T23:08:16.631002Z","times_seen":73,"resource_available":false,"data":null}},"time_used":651,"timings":{"blocked":159,"dns":0,"connect":0,"send":0,"wait":167,"receive":325,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-19","alert":"Phishing Block","trigger":"promohero.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"promohero.vip/assets/uni-app.es.BjJyHCkd.js","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://promohero.vip/","date":"2026-01-19T14:26:19.753Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"promohero.vip","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 17 Jan 2026 10:47:25 GMT","end":"Fri, 17 Apr 2026 10:47:24 GMT"},"fingerprint":{"sha1":"01:1D:4B:6F:14:B4:6C:1E:CB:CB:33:BC:6E:07:D8:CC:46:F4:75:33","sha256":"40:05:1D:39:DC:B7:C5:70:49:C4:B6:43:09:21:AB:00:61:7D:43:4B:28:83:CC:33:E1:5C:E1:1D:1B:06:69:2D"}}},"request":{"raw":"GET /assets/uni-app.es.BjJyHCkd.js HTTP/1.1\r\nHost: promohero.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://promohero.vip/assets/pages-ap-login.AJhI2k2s.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.20.1\r\nDate: Mon, 19 Jan 2026 14:26:19 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 84\r\nLast-Modified: Sun, 18 Jan 2026 12:04:40 GMT\r\nConnection: keep-alive\r\nETag: \"696ccc58-54\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":84,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text","md5":"f54dbbb7ec6ce71a8e0c2c23fa3fc2a8","sha1":"3632390b05a14f4dd7e6548f1df79176c232b4f1","sha256":"2d936cc1fe9ed89d81e7c282adfb4260183819e74cb51bf115ba10c3d421b5fb","sha512":"c59ecd177b5515938b43b99013c1e512c1c7aee1539d279fdd38a087793cc95c6eef68036e104934989480c2c786fdf0733c97ed8cb88e219bda6a196903b2ef","ssdeep":"","tlshash":"9aa0120b784120632802048001755406117614d289c98720c5c083244af44b5c128e0a","first_seen":"2026-01-19T13:29:22.54556Z","last_seen":"2026-01-19T14:26:42.20297Z","times_seen":3,"resource_available":true,"data":null}},"time_used":164,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":164,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-19","alert":"Phishing Block","trigger":"promohero.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"promohero.vip/assets/RegionNotSupported-xBHiNTV_.css","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://promohero.vip/","date":"2026-01-19T14:26:20.223Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"promohero.vip","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 17 Jan 2026 10:47:25 GMT","end":"Fri, 17 Apr 2026 10:47:24 GMT"},"fingerprint":{"sha1":"01:1D:4B:6F:14:B4:6C:1E:CB:CB:33:BC:6E:07:D8:CC:46:F4:75:33","sha256":"40:05:1D:39:DC:B7:C5:70:49:C4:B6:43:09:21:AB:00:61:7D:43:4B:28:83:CC:33:E1:5C:E1:1D:1B:06:69:2D"}}},"request":{"raw":"GET /assets/RegionNotSupported-xBHiNTV_.css HTTP/1.1\r\nHost: promohero.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://promohero.vip/pages/ap/RegionNotSupported\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.20.1\r\nDate: Mon, 19 Jan 2026 14:26:20 GMT\r\nContent-Type: text/css\r\nContent-Length: 972\r\nLast-Modified: Sun, 18 Jan 2026 12:04:38 GMT\r\nConnection: keep-alive\r\nETag: \"696ccc56-3cc\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":972,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (971)","md5":"f84cd840ed86e8077c186393869dcdd4","sha1":"e12084354ce2a76400c1ff9883e352086a1eca38","sha256":"e18b026fd9c234f757a980d345e77f5252843f13d4ca79ea2f3bc790a5e1b623","sha512":"dbf6e3afd854ffd51e96d3834848631e2ec2085c0827463d02cb0bb674e3aabf78b2a3b8402a540114978a708e33091a67c5475cfc2d5aff9f47417bb0ab25b6","ssdeep":"","tlshash":"2b115c113e1c7017b0bbe43498e4174a2418e2429327e6abbe945134c7de1e22d73e49","first_seen":"2026-01-19T13:29:22.552037Z","last_seen":"2026-01-19T14:26:42.205808Z","times_seen":3,"resource_available":false,"data":null}},"time_used":163,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":163,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-19","alert":"Phishing Block","trigger":"promohero.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"promohero.vip/assets/pages-ap-RegionNotSupported.CeWBxXXf.js","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://promohero.vip/","date":"2026-01-19T14:26:20.227Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"promohero.vip","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 17 Jan 2026 10:47:25 GMT","end":"Fri, 17 Apr 2026 10:47:24 GMT"},"fingerprint":{"sha1":"01:1D:4B:6F:14:B4:6C:1E:CB:CB:33:BC:6E:07:D8:CC:46:F4:75:33","sha256":"40:05:1D:39:DC:B7:C5:70:49:C4:B6:43:09:21:AB:00:61:7D:43:4B:28:83:CC:33:E1:5C:E1:1D:1B:06:69:2D"}}},"request":{"raw":"GET /assets/pages-ap-RegionNotSupported.CeWBxXXf.js HTTP/1.1\r\nHost: promohero.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://promohero.vip/pages/ap/RegionNotSupported\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.20.1\r\nDate: Mon, 19 Jan 2026 14:26:20 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 1277\r\nLast-Modified: Sun, 18 Jan 2026 12:04:32 GMT\r\nConnection: keep-alive\r\nETag: \"696ccc50-4fd\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1277,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1276)","md5":"4f425d2bfa816a21fdb92f1825da43ba","sha1":"7d5a1a0ffd36c02555eea5cdd4d164df808444e6","sha256":"1b676fda439e9f1acdc9f4deb158feafc743cbbf4f364fdb49cbf45d0e371d57","sha512":"e1af211c44f21e63265a0fea99210136fb6e50afbbd7544e0d0059c303f2fc64da02aa8811c97e01b8b57e1621b5f241aa7fd026901ba57205d43bc1de22a481","ssdeep":"","tlshash":"da21cd8d7f5c817a3213a5c9651870147d6d266d6394b0c2aaf8443c92b5a882cbf7aa","first_seen":"2026-01-19T13:29:22.554078Z","last_seen":"2026-01-19T14:26:42.206736Z","times_seen":3,"resource_available":true,"data":null}},"time_used":324,"timings":{"blocked":160,"dns":0,"connect":0,"send":0,"wait":164,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-19","alert":"Phishing Block","trigger":"promohero.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"promohero.vip/assets/pages-ap-RegionNotSupported.CeWBxXXf.js","fqdn":"promohero.vip","domain":"promohero.vip","tld":"vip"},"ip":{"addr":"47.77.216.153","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://promohero.vip/","date":"2026-01-19T14:26:20.392Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"promohero.vip","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 17 Jan 2026 10:47:25 GMT","end":"Fri, 17 Apr 2026 10:47:24 GMT"},"fingerprint":{"sha1":"01:1D:4B:6F:14:B4:6C:1E:CB:CB:33:BC:6E:07:D8:CC:46:F4:75:33","sha256":"40:05:1D:39:DC:B7:C5:70:49:C4:B6:43:09:21:AB:00:61:7D:43:4B:28:83:CC:33:E1:5C:E1:1D:1B:06:69:2D"}}},"request":{"raw":"GET /assets/pages-ap-RegionNotSupported.CeWBxXXf.js HTTP/1.1\r\nHost: promohero.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://promohero.vip/assets/index-DLgUzMRo.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.20.1\r\nDate: Mon, 19 Jan 2026 14:26:20 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 1277\r\nLast-Modified: Sun, 18 Jan 2026 12:04:32 GMT\r\nConnection: keep-alive\r\nETag: \"696ccc50-4fd\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.20.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1277,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1276)","md5":"4f425d2bfa816a21fdb92f1825da43ba","sha1":"7d5a1a0ffd36c02555eea5cdd4d164df808444e6","sha256":"1b676fda439e9f1acdc9f4deb158feafc743cbbf4f364fdb49cbf45d0e371d57","sha512":"e1af211c44f21e63265a0fea99210136fb6e50afbbd7544e0d0059c303f2fc64da02aa8811c97e01b8b57e1621b5f241aa7fd026901ba57205d43bc1de22a481","ssdeep":"","tlshash":"da21cd8d7f5c817a3213a5c9651870147d6d266d6394b0c2aaf8443c92b5a882cbf7aa","first_seen":"2026-01-19T13:29:22.554078Z","last_seen":"2026-01-19T14:26:42.206736Z","times_seen":3,"resource_available":true,"data":null}},"time_used":161,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":161,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-19","alert":"Phishing Block","trigger":"promohero.vip","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-01-19","alert":"Sinkholed","trigger":"promohero.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}}]}