{"report_id":"ffc09e4c-a5b4-4546-b56e-77f1fe17cb5e","version":6,"status":"done","tags":[],"date":"2026-01-09T01:59:39Z","url":{"schema":"http","addr":"qirex.top/","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"172.67.171.123","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"qirex.top/#/","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"title":"qirex.top/#/","dom":{"size":65259,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (31796), with CRLF, LF line terminators","md5":"f5e2036383b37b2e330d27ee2c0761f3","sha1":"47d721605291cd203f71d0205f9953c182787ddf","sha256":"ef5675f65b764b3e8c4b7420a6d9f941fa5b8ee9113ffd8b0ed46ef173a6ecef","sha512":"24459252b45ea62b98cf2851b23a0c8638079cb54400250b5ff427ce5f3eac37e4575e857245f68679a0071fe29575ff70780b1cbffd2e18f4185b8a56abf64f","ssdeep":"1536:S97IAbomAcK0FwXPJGgd2p8DSqmfV/8DSqmfjSJBQSJGLpI5O1a+ioBjikjoXe1G:k7IAbomAcK0FwXPsgd+8S87xnp","tlshash":"42532e3876433463057b98d0b0e45f09b2a39b3ac2258254f7f9236a77dacf16e563e4","dom_hash":"domhashcfe3586d660dafb0b88478a0a749145e","first_seen":"2026-01-09T01:59:50.350723Z","last_seen":"2026-01-09T01:59:50.350723Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"qirex.top/","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"172.67.171.123","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-13T01:59:39Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null},"summary":[{"fqdn":"huobicfg.s3.amazonaws.com","ip":{"addr":"3.5.157.31","port":443,"asn":16509,"as":"AMAZON-02","country":"Japan","country_code":"JP"},"domain_registered":"2005-08-18","domain_rank":5277579,"first_seen":"2021-11-22T07:40:25Z","last_seen":"2026-01-05T17:50:11.995743Z","alert_count":0,"request_count":14,"received_data":307365,"sent_data":6301,"comment":"","tags":null,"fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}]},{"fqdn":"qirex.top","ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":38,"request_count":38,"received_data":2624325,"sent_data":16965,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-01-04T22:17:15.216142Z","alert_count":0,"request_count":5,"received_data":16053,"sent_data":2314,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cdn.dcloud.net.cn","ip":{"addr":"124.222.174.117","port":443,"asn":45090,"as":"Shenzhen Tencent Computer Systems Company Limited","country":"China","country_code":"CN"},"domain_registered":"2013-07-17","domain_rank":296858,"first_seen":"2018-09-15T09:18:08Z","last_seen":"2026-01-05T13:13:41.270215Z","alert_count":0,"request_count":1,"received_data":579,"sent_data":440,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"qirex.top/#/","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"7e98f35f23795ecb1a944bbefa9e40a7","sha1":"9f6826623e1d677abe50f4755523c8986d229bc3","sha256":"2f34fa8f7eea8ee00070214da3db09639f6d9b89111c8ca090fcf04954be6ed3","sha512":"7cf3f08fbd52f6a4f645721a24b3d1cabfe28d13473087fb0a98eb47438edcfe9fec95d4b4ee73b2f4199e8f896e8f161d1a10175c400ee88e1d2d030dfd17da","ssdeep":"","tlshash":"8ec08cc4b0c26e002602691415af28e4a024402671481b038ce4d8582e220b08233e9c","size":138,"data":"","first_seen":"2023-05-05T08:00:34Z","last_seen":"2026-08-10T05:13:29.73613Z","times_seen":502,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/#/","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"a15c447f08875de3100ed8997d5994ea","sha1":"b77d1c8bbbbcc5d0ac532e1362d796508029192f","sha256":"edd33609ab9f781e02fcf2c8e5ecd9f1e9b7bfdcbb576f01e9b2e78747b47e47","sha512":"55050de7b026795f86b16a8f6a67428555e9d05c394d87abf47b1bde43968be03e16569d97d1f38f6d37a1cc8b9bb5349cabe354e3def7dcbd5187640e3ac7ce","ssdeep":"","tlshash":"b8c02bc8b0c33d002602645010bf39e490344027718c1b43ccd4ec883e230f09233edc","size":139,"data":"","first_seen":"2023-05-08T20:49:32Z","last_seen":"2026-08-12T02:21:43.774218Z","times_seen":924,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/#/","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"6db6ac15339e58de97d8d22aec944a2b","sha1":"3b0ba47693be14f9a46402a4beb1c28940c20156","sha256":"53168f253d02b1350bf6325f97d206ed8a5ba3f13eb4deec32d0055bbbaaf629","sha512":"bdbd0f0317bafa782eaf1e3debc4ebc60248d3784840c1c12cda5b3ce7b9cec50be3a487fb81e1486e1dba36243e9a33a44d0f5a9ed10bb267e7f61349c0e5a2","ssdeep":"","tlshash":"16c08cc4a0c26d002606691010af34e49024402670485b028cd4e8592e330b08233ea8","size":138,"data":"","first_seen":"2023-05-08T20:49:32Z","last_seen":"2026-08-10T05:13:29.737123Z","times_seen":302,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/index.ac3db0d1.js","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"eb83ea3ef996274fdfe885db29e3eed3","sha1":"04f0e07b48d5746a3b57540fddf28ecaa54b35a5","sha256":"d8fb5a0af6700fa29dc51d02b6fc6c2bc775d9195c99f7c9a17e700e4f1827fe","sha512":"1c42a3e0b88122f3ef352efc0992ad691ff83f007059b7e814a2186a1dc4fde0cf330a0ad56a098ebdb8275d9d53d73ece2c3482e93c1e2397c063e3d7a8e6c3","ssdeep":"49152:XTcyhtxArNC25gDA2oXSJRJMPAdqlhITsYslNbbIQ24PrxG4hIt6uAUrbm+N2lZP:X4uO","tlshash":"3c75c6c6dafa580e8be4f055f9783d8e1c4059c0e818c3baac7d59f7e7ca144969236c","size":1682363,"data":"","first_seen":"2025-12-27T19:51:21.463611Z","last_seen":"2026-04-05T23:41:16.067096Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/tm-button.8ba014a2.js","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"fab9e100434eb072d5d3c5bf44ddb4ce","sha1":"45351ea7c2cfae03b2a0cede9967a981a3ba80dd","sha256":"2fb1ad4950849500c0fc1c4fe5a8805260ade7edb04125f831ebf7b8d5a26267","sha512":"6d9d4287ea623faa7d4f052126020cb8411f33f96f989da01cc66eb7b6ff413e6cd9cd86fd4df44c045bff6d731e6be178142c35bc095489d1faaaf0ae0fdd77","ssdeep":"96:RgmHUD//UusxzD9831y6MX6eA6l5+Vhc8/YFs2GXUx8TCZ8NAwNGgEknZ1Q3:umm74Iq6ClEApYUSTCUAwNGonZ1Q3","tlshash":"cba1f824317dcdbb6ecbefdc3054291225259b6ee53476d1fea4603a138b8e590ccb28","size":4763,"data":"","first_seen":"2025-12-27T19:51:21.439307Z","last_seen":"2026-04-05T23:41:16.027804Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/tm-app.48459f1e.js","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"a98ffaf80a4a3ebb9e62f361252a3e18","sha1":"facd824440dcc102fd5fa3030ca521a613ef91d5","sha256":"321cc0803f4a5bb7e577bacac01ae34d321d48f5ec5c8f774ae47826faeb6c66","sha512":"b08400503e7190bf3ef884fd2135734e2b034949daeb98a66013ceaf33ea7fa81fc2aa4fa80d094e340441100a77b5fb8a475b78abc820c5db088035a2d2ce69","ssdeep":"","tlshash":"dc51753d32e9b27c62374ace5476574c184b776d4a326bf6d27a78703080c68725fb68","size":2643,"data":"","first_seen":"2025-12-27T19:51:21.41327Z","last_seen":"2026-04-05T23:41:16.045239Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/#/pages/index/init","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"1d0663d39d873f0eb6f219b0801c983c","sha1":"2da20244f55d5a15a7a0695b8fd3dcedad9f3cd3","sha256":"67602cc36eb6e60ad520d10b21efd241ce5e573e9935a6901302dcca11f36ac5","sha512":"77e9b49e9a35d6d792ce3cb1b552b1c44ab4ae81a5ad37b9149421dfee57450e0346d0cfed0b1c131f2d050e3f69153fe1bc1da2848fd0351dfba6f15fd1e8c2","ssdeep":"","tlshash":"02c08cc8a0cb6e001a02665015bf25e4a034402a70489b038c94d8482e230b0a233ea8","size":143,"data":"","first_seen":"2023-05-08T20:49:32Z","last_seen":"2026-08-12T18:15:13.620979Z","times_seen":348,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/pages-index-init.cf8da835.js","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"3b6bbe292d9f04050b7deb70c2d0b3db","sha1":"f3641610ea760d6e934b5cf888c62f94c4e97d90","sha256":"6cf49b76830c6a9d6e9b5608e4b8945aa4fb2a83f3e700f1ace2450554efb083","sha512":"4bcc8aafd8289320d0a9dd4de19c81f18454731df884d6873dbc94ecb1a7d20a1e6a47fcd18348cf2a82e5fc9c65c8c1f0aae0c100c328b6278fa386dcbffc90","ssdeep":"","tlshash":"d031774b32afaa766f721847b5fc2c88477217841c32f4cd7e6a5c1968f2d45188d321","size":1495,"data":"","first_seen":"2025-12-27T19:51:21.458827Z","last_seen":"2026-04-05T23:41:16.018882Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/activity.6457c612.js","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"d66a34c6d3382f4b49c959a26989962a","sha1":"0948b3a425f7f019e091d216d37c2ac8c294ea3d","sha256":"3399b44949d7639e5016ebd11daaae11b20ed39db9fbca0ed341de7731e176e7","sha512":"52d4389370f97fa9a83fa333e91a409d4b502abf59e94d26f9b2c5853b7ce7ac437aa70c37ca9cd93046ef3f0b6bb5b7e829d8119c038eb08cd2842cca4d3c67","ssdeep":"","tlshash":"cce0262e3215bbb38a0204d7805a6a43a327edd00e0a86a09e09130c3ab219997bd47b","size":319,"data":"","first_seen":"2025-12-27T19:51:21.398226Z","last_seen":"2026-04-05T23:41:16.029294Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/pages-index-index.d4920e26.js","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"080994d7db4b9bb5204e85ea9d8508cd","sha1":"f3bc059bf54900dcfc246224e7866683399454f1","sha256":"8fa71025aa8d62eb3198dddbf62fd364df90ac211a158b60f307f5915caa62d2","sha512":"2ef11ec5a3b78a6caee744b95722fa2f05107a6cf0558e80f3beb8577d05c070957d987b7a50f198bceb6742f4a47f94a69517d827db65697fb098142fd22c8d","ssdeep":"768:wciccc/+hx9++oqCQFRJOz5OAv5eq8DSqmfYTmJOfUXzC2jOiGcuH6ckrTdbqnIW:ww+o10e57B8DSqmfYSJxzC3ne9unkPf2","tlshash":"e6137cb1f56d8a7e6313e98dc8604406259d5e8ea228f480b7fc9d353393940aefd778","size":44480,"data":"","first_seen":"2025-12-27T19:51:21.402242Z","last_seen":"2026-04-05T23:41:16.026167Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/#/","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"0f40806f855fc503ec7fe0e2cdc6da5f","sha1":"ad59d99993690064ee6565eea713ee4c5260f572","sha256":"954bc1931a5584c910a5391a0e2c05ba7190f3c672433a85c162ac948a74a44f","sha512":"7ea9c1cffaf640bc7083f2306a134368aa54ae775230a1f1990c43817594d950ecbf94412ea7ab6262bb8add4715ab6fffe7579f85b0a1c07f6acc4f8207cd9e","ssdeep":"","tlshash":"1fc08cc4a0c2ad001a12649010af24e49034402770481b029c94e8492e220b08237e98","size":137,"data":"","first_seen":"2023-04-13T00:16:19Z","last_seen":"2026-08-12T20:51:31.815282Z","times_seen":7226,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"437794e6e5838d19ff9019b684a23912","sha1":"015679bcf286fccdfdcc59157de255c052e75a69","sha256":"f7e92672b8004e2f40d7a0fb2d6ff907deeffacd4bf8bca53190d570a5ab35a5","sha512":"e6fa5cfdfd535613371d955b9b03b9a14c37e33a4b171c3d17f90adf917d0664961fb6ea9344bc27777eb9500083acab12a130551aa4277f55f219bdb17f0d8d","ssdeep":"","tlshash":"6be061c250a7295c0520816a355ec5131f6505739e818d513c8c6765cff9e4bc06d858","size":421,"data":"","first_seen":"2025-03-11T08:52:08.619783Z","last_seen":"2026-06-02T07:26:04.061512Z","times_seen":225,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/tm-drawer.3e3aa7b9.js","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"b3299d1c70bf03266966dfddf8a909bb","sha1":"85e62161e3b77eec4271f898ad924748fbdf3e4f","sha256":"ce8f90116904308dd8adcba3e80b10dd2c90254e41ad5b70bfe9939379e7f281","sha512":"1359350a8c617a609725358db8963228a6382723fd571dbf7d29778697c42c5180a8468cdc9b70dce4d6bda30065ad797868f7131d844f543bd39f3022d5bbe3","ssdeep":"96:3Ovlw3F5RUtxr6SDZbCzQrcQw2D5IWW6iQ/IDu/PXmVWaNmz1Xl5o+H+g:SlemBNoQwoP3aNmz9g8+g","tlshash":"06c1c898746e2373a6b709a5c072480d133e1f5dd97876c1f2e2193a36f6d484dd8bb8","size":5674,"data":"","first_seen":"2025-12-27T19:51:21.422707Z","last_seen":"2026-04-05T23:41:16.014384Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/tm-image.99203c1c.js","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"da346ba1840bf11250575dd2d702b83c","sha1":"557a28a26064e8b64351c1631387c4c3da3c3a68","sha256":"22e3f801e46750172047001b101510acabffb35a8d027611278afc684d75eb92","sha512":"848a5ad418562d42b1531adfb8adecd5812e0e9005e36d8a89ae68e56fab8eeab74c4ebbeee3218aa21857f3660a09ae38ec65b1b768c14ce12bd1d73f7cdab2","ssdeep":"96:gcDkON2VYyRTzmxmMRSfzHmt4apODtUwfUNBAlAIgby1N:gokXmxmMROzMpOu6UNBAlAsN","tlshash":"9f91a63c31bdd93f69fb49eda055994a54055f2ceb30b7d0bae1406ad1aec844129f3c","size":4227,"data":"","first_seen":"2025-12-27T19:51:21.440773Z","last_seen":"2026-04-05T23:41:16.022105Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/tm-tag.d8d94e2f.js","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"a187e3a42209c04c57a8b5ec0193d0dd","sha1":"fdf4d681c90d65d443d887c7ab59c7aee441e234","sha256":"a9d8b256c3cd71c6b43abbdce6a9084caf5a836ceac1d2dcf5bc1597842833d5","sha512":"c5b5d8415ae8d28abe6bbee97793daf49cb7c0a8433e57f0020f9c56307981b023922fb1218de4c3b51ef52ee661162800f53a5fb5799fd90405764f5c92cd40","ssdeep":"","tlshash":"0c8175b43d1948f696ff4acca172ae0d492a256eac357ff2f4a121245cf1925b04e73c","size":4006,"data":"","first_seen":"2025-12-27T19:51:21.417847Z","last_seen":"2026-04-05T23:41:16.048619Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/#/pages/index/init","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"a75ab93c4db9073c13fb419ef7c2c46a","sha1":"856072c405dfaa708e23622cad35d78372e23f07","sha256":"da656c2f3889dfb9eaeecb26f30c2b5ff695b991d6c5fbdd8f8978fc0ed2907e","sha512":"0dd74743f8822d86d634c325d0f3f6148960d7c9ba0cc668fde3cfe6475b7a0ffa5ab23cc7f229fd0313dcf0d1d427c60df140423c158354408f96f86faba2bb","ssdeep":"","tlshash":"cec08cc4a0e62e601a02692418af28e8a0248026b45cab02add4d8482ee34f48233e98","size":149,"data":"","first_seen":"2023-05-08T20:49:32Z","last_seen":"2026-08-12T18:15:13.622394Z","times_seen":1140,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/#/","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"7c2bd803183c9eb6ccac9978d49fa819","sha1":"224d7d7beedd5b01f1cb107495ab1f2e5bf078d2","sha256":"7117536f358653602a49d94190c1371644f9cbfe936b0ad9dcedf867aec56daf","sha512":"718f3f630dd7beed360640387b56117d94ab54b03104530983d343c4ab6b02f51a4e1b399cd9532870bd4923c3f3247da65edb90185a7ee926e4b38e89f090f8","ssdeep":"","tlshash":"cec02bc5b0c33d002602a81021bf39e490344027704c1b43ccd4ec483e230f08233edc","size":135,"data":"","first_seen":"2023-05-08T20:49:31Z","last_seen":"2026-08-10T05:13:29.738251Z","times_seen":399,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/tm-segtab.73a26c8e.js","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"importedModule","is_inline":false,"md5":"6f0de5f710e46b398917529b32001f62","sha1":"4fbe18421e469aa5472d7c112375f91a12ef8c69","sha256":"dc9158dbc77c619c09f3d18305af01d42c101a9981313fa6ba572154df145f9d","sha512":"3ca563dfdfa45b2394c0e98bd2da11cd0d5e393658068706e06af27f230af1a9d1e5038ba453e6df03248f14180fbf89cffac3c04fdd7b18327dca364e1a0b45","ssdeep":"96:OvHXeZgoBReFcJdnGW00LggbMiY4FCx/PLt+pixOwCCdcbILzJ3Cuq9:UXeZVwFc3HzcG4/PL2OyIJyuq9","tlshash":"72a1d778723ca83e37bb49a9b07251825209c79fd739a0d2b6e8047552a2d805addf2d","size":4742,"data":"","first_seen":"2025-12-27T19:51:21.452351Z","last_seen":"2026-04-05T23:41:16.034943Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/#/pages/index/init","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"1ca49f0e439cf34669924908e59b2897","sha1":"efea6ef6bd12f3ded99d07b429c6af21c23ed826","sha256":"9f9ee6011e8f88513c2761906180f430478c9d9835d4e74a211cafd3c79b955e","sha512":"f5dfd73abfc4c47819a1c10e68b974d2253a67fd9fb113e510809ee5ea650d5dd1f003dedcd6f88235e4e5b696f28c5e2f18526e794579f3b9f5a1d7db17bb21","ssdeep":"","tlshash":"fec08cc4b0c22d102602a91010af24e49024406770481b168c94dc882e224b09237e98","size":141,"data":"","first_seen":"2023-04-13T00:16:19Z","last_seen":"2026-08-12T18:15:13.600866Z","times_seen":604,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":[{"md5":"3d5272693eb411e5b8b13a243f76c720","sha1":"6a586ab8e0a4bf12bbc60eea6ca9f2418625a22c","sha256":"9582f31f9eb892b8823a780e579d464d54e26d97d65dc327d2b2bdd92d47c4b8","sha512":"03fc5614f48fc9a2e3c4a30626fdbacde74c1fda09ffa9d1cde0393d31cd5fe1588e270c241f4cedb473c6e5cc224ff16c141468a29519ea6159accf3e3a18f1","ssdeep":"","tlshash":"a4c08c8350e2080c8210861b848880050b8808b04f9308a22cd85b7ecc9ae88c8f804c","size":148,"data":"","first_seen":"2023-03-07T01:10:06Z","last_seen":"2026-06-07T08:18:02.151537Z","times_seen":15899,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"console":null},"http":[{"url":{"schema":"https","addr":"huobicfg.s3.amazonaws.com/currency_icon/btc.png","fqdn":"huobicfg.s3.amazonaws.com","domain":"huobicfg.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.157.31","port":443,"asn":16509,"as":"AMAZON-02","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:21.018Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3-ap-northeast-1.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 14 Nov 2025 00:00:00 GMT","end":"Fri, 30 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"46:67:AE:AC:E3:C2:0D:C4:55:CA:3F:CB:B1:64:48:00:87:D7:E6:91","sha256":"18:7F:98:1B:96:0A:EE:5D:A8:54:AC:EE:61:CD:E2:1A:42:79:57:6C:BB:97:D4:54:5F:AD:91:87:86:84:69:D8"}}},"request":{"raw":"GET /currency_icon/btc.png HTTP/1.1\r\nHost: huobicfg.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: eShUvX2Ygl4ujhl3AT8VHpBxZquG5iKP4WUEFBIpP81mEPbPNiTvOzfYUrIv8fPT/GmjrFow2cKMJ6LFoY+Zwil+MYSXpN6t\r\nx-amz-request-id: CE35T6VRCMSX8GM0\r\nDate: Fri, 09 Jan 2026 01:59:22 GMT\r\nLast-Modified: Tue, 27 Jul 2021 08:37:53 GMT\r\nETag: \"03c74454bc971a3437d588396a5e610e\"\r\nAccept-Ranges: bytes\r\nContent-Type: image/svg+xml\r\nContent-Length: 1947\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":1947,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"03c74454bc971a3437d588396a5e610e","sha1":"1a359cf1c14e757eaee1c5c807cf6c7732646b15","sha256":"733d0c0a99a79f263e8b548b8b1988ccfe80e156d36120371495955b4e51e382","sha512":"dede5e3cd5e0f080f4662e4e2df58482d19df970a2cc3f505eda82fb180a736a4c82523fe35b7a613293f572197e44c3bf963bcbaa32174c00d80b0b1e08bb2a","ssdeep":"","tlshash":"24419620d7bec18cf00196fcda29c87479971cc53e28d089d6e9485ab66405d1d72cff","first_seen":"2023-05-08T20:49:32Z","last_seen":"2026-08-10T05:13:29.722239Z","times_seen":523,"resource_available":false,"data":null}},"time_used":1727,"timings":{"blocked":713,"dns":48,"connect":278,"send":0,"wait":302,"receive":0,"ssl":384},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"huobicfg.s3.amazonaws.com/currency_icon/chz.png","fqdn":"huobicfg.s3.amazonaws.com","domain":"huobicfg.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.157.31","port":443,"asn":16509,"as":"AMAZON-02","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:21.048Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3-ap-northeast-1.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 14 Nov 2025 00:00:00 GMT","end":"Fri, 30 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"46:67:AE:AC:E3:C2:0D:C4:55:CA:3F:CB:B1:64:48:00:87:D7:E6:91","sha256":"18:7F:98:1B:96:0A:EE:5D:A8:54:AC:EE:61:CD:E2:1A:42:79:57:6C:BB:97:D4:54:5F:AD:91:87:86:84:69:D8"}}},"request":{"raw":"GET /currency_icon/chz.png HTTP/1.1\r\nHost: huobicfg.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: 0P4a3v3ICg3sFio9mH1r94Ni6hmLfuTrf3xAN5x0DyAlVSaayK4Vn4yMqmizjb5c8RBmD/u07QDazr4r/2FKT6P9/5x3HxW7\r\nx-amz-request-id: CE3AXFKGWS15YJ2T\r\nDate: Fri, 09 Jan 2026 01:59:22 GMT\r\nLast-Modified: Tue, 27 Jul 2021 08:43:18 GMT\r\nETag: \"c07cc55bfc92d6bc8a1004e4dcf9185f\"\r\nAccept-Ranges: bytes\r\nContent-Type: image/svg+xml\r\nContent-Length: 3619\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":3619,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c07cc55bfc92d6bc8a1004e4dcf9185f","sha1":"3a4265522a63bd41a2f494ceb1e3ec917d902761","sha256":"eb1f403bd3476588a1226280f4265767e987e010dd1b57edb1953abe09bcaac3","sha512":"7d03d560f133425709aa2eefec5279cfe24d6cd6ba49a39449f0b1ed61ca4839aab47f2fc9a4990c235ec311d8f93d06b5a5aa1f99f8d920ab8e22bf432c5990","ssdeep":"","tlshash":"a87161aab37892e8a504fbfd960748f46a6b2ce57612c55997e41d82f28000d05b98d3","first_seen":"2023-05-08T20:49:32Z","last_seen":"2026-08-10T05:13:29.729082Z","times_seen":259,"resource_available":false,"data":null}},"time_used":1671,"timings":{"blocked":678,"dns":29,"connect":280,"send":0,"wait":303,"receive":1,"ssl":373},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/tm-button.8ba014a2.js","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:19.973Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /assets/tm-button.8ba014a2.js HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://qirex.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 25 Nov 2025 20:10:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69260d35-129b\"\r\nexpires: Fri, 09 Jan 2026 13:59:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\npriority: u=4,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DhnS6ypsCrKE08RVyrl2WoonCaGVAThDSUhp%2Buwk95rqPDBLakw8D11zo6E3o11PnH%2FHzO%2FTrp5x0ZH37%2FWArMwELmrLf1s%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9bb055adcf2456a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4763,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (4762)","md5":"fab9e100434eb072d5d3c5bf44ddb4ce","sha1":"45351ea7c2cfae03b2a0cede9967a981a3ba80dd","sha256":"2fb1ad4950849500c0fc1c4fe5a8805260ade7edb04125f831ebf7b8d5a26267","sha512":"6d9d4287ea623faa7d4f052126020cb8411f33f96f989da01cc66eb7b6ff413e6cd9cd86fd4df44c045bff6d731e6be178142c35bc095489d1faaaf0ae0fdd77","ssdeep":"96:RgmHUD//UusxzD9831y6MX6eA6l5+Vhc8/YFs2GXUx8TCZ8NAwNGgEknZ1Q3:umm74Iq6ClEApYUSTCUAwNGonZ1Q3","tlshash":"cba1f824317dcdbb6ecbefdc3054291225259b6ee53476d1fea4603a138b8e590ccb28","first_seen":"2025-12-27T19:51:21.439307Z","last_seen":"2026-04-05T23:41:16.027804Z","times_seen":10,"resource_available":true,"data":null}},"time_used":474,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":474,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-09T01:59:17.520Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 09 Jan 2026 01:59:18 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\nlast-modified: Tue, 25 Nov 2025 20:10:29 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=irHPrtoZ5jcwomtGp9DASyFraooUWlByv36haSGE4c7XWXyePd0KdCkGnwbp0JE%2BGzIdA6GiRp%2BIBiJvwQII6GYOsFFlWlA%3D\"}]}\r\nstrict-transport-security: max-age=31536000\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9bb055a06ad656c6-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":870,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"622e4a7be2d48dca508a8edab31bf9ed","sha1":"b14d4324b7fe94875d58c9420285ebd0ac0b1c43","sha256":"f78a7ad95db217674614024dcfd6af8278303beadece5be2559d0dfe5a2db9d7","sha512":"f54d041c7f73869be11da4c19127f86c636ade514a3cb2bdb1c3a38797782563275d46ee9dbcf78fc223fba37ae92ed512fcc1ea54e9a4ea401c396e43c87da1","ssdeep":"","tlshash":"2011468150f35d081220055929e4f8673fa38b634d4acd643c9d12648fdc7cdc89fc78","first_seen":"2025-12-27T19:51:21.409581Z","last_seen":"2026-04-05T23:41:16.011588Z","times_seen":10,"resource_available":false,"data":null}},"time_used":1129,"timings":{"blocked":310,"dns":293,"connect":1,"send":0,"wait":509,"receive":0,"ssl":14},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/index.5092425b.css","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:19.955Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /assets/index.5092425b.css HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:20 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 25 Nov 2025 20:10:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69260d35-52c9\"\r\nexpires: Fri, 09 Jan 2026 13:59:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NAWSeeoDCyls9N88zn%2FAC84NDUUDBz7EWsBjnkOQniGZy52q3ShEDeHGYIdVa%2BMXtSbY9o8ay%2FxrIBNEnr2vxnLYNENVlg8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9bb055adbf1d56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21193,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (21192)","md5":"79aca5b87b637c393bbd44f6245b17d2","sha1":"765defaf7df15730eb8329050bf2957209390755","sha256":"d5d82bfd271d1c972961436d4b46ff567aa46a5381991cbf07b7a50184dc827a","sha512":"036e2d0e2a4387350329bb1bd2a7465a7623d5d5f7c7c330a89461885722a5e779ee1472b7a413ae36e0f99b6704280b1580cd92ac4f8984203d5e68e780b209","ssdeep":"192:4T7JNRIFu4puj8sR0sn830P7RNFo717jNf8Ggc7wNIytLQh27CNu+Jf7JNdsO7md:4WuPdjcMcP72Z5","tlshash":"bc922e38b80d6a16b137eb15a4c6176d6070b7bbb203472ca761a93d9e4b4c63f339d4","first_seen":"2025-11-22T16:52:18.238204Z","last_seen":"2026-07-24T05:21:13.354317Z","times_seen":40,"resource_available":false,"data":null}},"time_used":483,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":483,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/tm-drawer.3e3aa7b9.js","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:19.972Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /assets/tm-drawer.3e3aa7b9.js HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://qirex.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 25 Nov 2025 20:10:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69260d35-162a\"\r\nexpires: Fri, 09 Jan 2026 13:59:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\npriority: u=4,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GV5gic5%2BmgCl%2Bt2MLqtVEU%2FSC%2FQzSWondrLlvQ97gI719mWx6BPDv1Fq%2Fw36JQkjJ8paqHciL7DAXDyMnt4zbToayw6OrgA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9bb055adcf2356a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5674,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (5673)","md5":"b3299d1c70bf03266966dfddf8a909bb","sha1":"85e62161e3b77eec4271f898ad924748fbdf3e4f","sha256":"ce8f90116904308dd8adcba3e80b10dd2c90254e41ad5b70bfe9939379e7f281","sha512":"1359350a8c617a609725358db8963228a6382723fd571dbf7d29778697c42c5180a8468cdc9b70dce4d6bda30065ad797868f7131d844f543bd39f3022d5bbe3","ssdeep":"96:3Ovlw3F5RUtxr6SDZbCzQrcQw2D5IWW6iQ/IDu/PXmVWaNmz1Xl5o+H+g:SlemBNoQwoP3aNmz9g8+g","tlshash":"06c1c898746e2373a6b709a5c072480d133e1f5dd97876c1f2e2193a36f6d484dd8bb8","first_seen":"2025-12-27T19:51:21.422707Z","last_seen":"2026-04-05T23:41:16.014384Z","times_seen":10,"resource_available":true,"data":null}},"time_used":481,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":481,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/tm-tag.d8d94e2f.js","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:19.975Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /assets/tm-tag.d8d94e2f.js HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://qirex.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 25 Nov 2025 20:10:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69260d35-fa6\"\r\nexpires: Fri, 09 Jan 2026 13:59:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\npriority: u=4,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nKgACV0sQjzgtQqOWFXxm9VK7rpmm0wGjr7xkq%2BLAUagEl2s1aAy83N2zzKFe1001blauohwZ4je%2FyD%2BHa3A1JC2xPALzS0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9bb055adcf2756a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4006,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (4005)","md5":"a187e3a42209c04c57a8b5ec0193d0dd","sha1":"fdf4d681c90d65d443d887c7ab59c7aee441e234","sha256":"a9d8b256c3cd71c6b43abbdce6a9084caf5a836ceac1d2dcf5bc1597842833d5","sha512":"c5b5d8415ae8d28abe6bbee97793daf49cb7c0a8433e57f0020f9c56307981b023922fb1218de4c3b51ef52ee661162800f53a5fb5799fd90405764f5c92cd40","ssdeep":"","tlshash":"0c8175b43d1948f696ff4acca172ae0d492a256eac357ff2f4a121245cf1925b04e73c","first_seen":"2025-12-27T19:51:21.417847Z","last_seen":"2026-04-05T23:41:16.048619Z","times_seen":10,"resource_available":true,"data":null}},"time_used":483,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":483,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/v1/api/exchange/getSymbolConfig","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:20.659Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /v1/api/exchange/getSymbolConfig HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/json;charset=UTF-8;\r\nlanguage: en-US\r\nauthorize: \r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:20 GMT\r\ncontent-type: application/json;charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5%2BZFyrNaCQz1TQzZodNbrhiwZlfY6D49l0OlsXP5avqVJlWdXkS8iQQzNBV%2BZtc32IEI2qCbwAr5cNP0K2CcG1%2FvQpLljaQ%3D\"}]}\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate, no-cache\r\npragma: no-cache\r\nexpires: 0\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: 9bb055b21f4e56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6778,"size_decoded":0,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"388170fd82a0de4ec3034d0fb8691766","sha1":"35fc2785449ebc1bf633fcab9b37f268f0cbea6e","sha256":"0c4aa2863b6176a6711f9248c6c187c56ba0f0215ee8f54e3fb61d62b3b10162","sha512":"8349b0287637fdfcaadb79563adb86c1eafda564b5ba3956446a41604f02670b1af018b23912ca699e96e0bf005fc3af99ca58f3fb6fd8a293e58ac504a55c73","ssdeep":"96:7lxZ8jWbU7/ZaECjev/RZ7gjRZVv7LJBLHP6oWv4wp70TUyox7j1VIvN7enxvjtg:7tti1v7ORZJt95s0i/nIvoxvjyvQxva","tlshash":"3ae1d965236017afc161a1c21ce23fcc192e2aa71cc71b45a2eede5e8310def7527726","first_seen":"2026-01-09T01:59:50.370301Z","last_seen":"2026-01-09T01:59:50.370301Z","times_seen":1,"resource_available":false,"data":null}},"time_used":211,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":211,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/v1/api/config/getLanguage","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:20.807Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /v1/api/config/getLanguage HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/json;charset=UTF-8;\r\nlanguage: en\r\nauthorize: \r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:21 GMT\r\ncontent-type: application/json;charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jALJBIBa3k%2B8cJllf2J9kH5SYTCxT6xnwG7VmHF5GBy7DyIYM2tnz%2BqhGR3LsRuvdGQYdYFT7H10zGNXbjspcPKFM792mQI%3D\"}]}\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate, no-cache\r\npragma: no-cache\r\nexpires: 0\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: 9bb055b30f5256a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18408,"size_decoded":0,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"841ba98cf374ee37583e7e42818e3281","sha1":"571a746d1b4a12e2e9000a0f912cee721ad9b3e1","sha256":"02fdd3931603dd0c280660f32bdd459fa9813999cec31f438b9f72f0763a105a","sha512":"3d69f98c06570ebf9ec4747f214e0fa839fc095b3ba910e6a3839519ca1e9145c81f5e4c16d32474600f8b89fa5d257ede94c699f000d36ddd48367cef44d43e","ssdeep":"384:2qaDztN2mQPf+Vi/bt5Y4QyS6GDg5x/L+vdiPaqHtKRN:29DPrQnTt5YC9GDgL+vX","tlshash":"7482954fa20a1cb64bc717d539df1e0936fc21c3529588598cdea91c03eeaacf26b51d","first_seen":"2026-01-09T01:59:50.374327Z","last_seen":"2026-01-09T01:59:50.374327Z","times_seen":1,"resource_available":false,"data":null}},"time_used":229,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":228,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"huobicfg.s3.amazonaws.com/currency_icon/bts.png","fqdn":"huobicfg.s3.amazonaws.com","domain":"huobicfg.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.157.31","port":443,"asn":16509,"as":"AMAZON-02","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:21.072Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3-ap-northeast-1.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 14 Nov 2025 00:00:00 GMT","end":"Fri, 30 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"46:67:AE:AC:E3:C2:0D:C4:55:CA:3F:CB:B1:64:48:00:87:D7:E6:91","sha256":"18:7F:98:1B:96:0A:EE:5D:A8:54:AC:EE:61:CD:E2:1A:42:79:57:6C:BB:97:D4:54:5F:AD:91:87:86:84:69:D8"}}},"request":{"raw":"GET /currency_icon/bts.png HTTP/1.1\r\nHost: huobicfg.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: a4p7nNIZVJaGsH3WKD5PrMLfAsIY7V01P6dquwWowZXj3RzKnoOYs+k1VMngo+xeAVPi6aZY5nRcVqSNLN3oTHK3qm6C8tgK\r\nx-amz-request-id: 0VJ6ERMQEVDKHS2Z\r\nDate: Fri, 09 Jan 2026 01:59:23 GMT\r\nLast-Modified: Tue, 27 Jul 2021 08:40:04 GMT\r\nETag: \"a12001eba3f8b40d252d09e0d21f6884\"\r\nAccept-Ranges: bytes\r\nContent-Type: image/svg+xml\r\nContent-Length: 1433\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":1433,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"a12001eba3f8b40d252d09e0d21f6884","sha1":"874702fd7e69b788e419bd5258c9a80a9edc486c","sha256":"c9c78d7bb49415d4816f380f883baff55ce5f88997875c36d8ea98846a191c5e","sha512":"891a2a6a3f995e8070e6a6f2c6b9922be3539cbc22347e05fd867ee4a49495a5a6d2f4a7db5bc641daa3c981d143d14d7526d018af2252ba3f7477f7e6afb931","ssdeep":"","tlshash":"0c217411b324a23c30087afc527ae473fe605ef2951150d4dbd90d80f95266dada2dd3","first_seen":"2023-09-10T20:06:11Z","last_seen":"2026-08-10T05:13:29.734513Z","times_seen":281,"resource_available":false,"data":null}},"time_used":1849,"timings":{"blocked":1545,"dns":0,"connect":0,"send":0,"wait":304,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/uni.bde5c185.css","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:18.475Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /assets/uni.bde5c185.css HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:18 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 25 Nov 2025 20:10:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69260d35-546d\"\r\nexpires: Fri, 09 Jan 2026 13:59:18 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jqTMhoB5RlRYCdT6p0%2BKIosliM05PQU%2Bl7n6lOTD%2FWdrsKd725kRl5SSWXQx51O1Bcu5%2FRguBzL%2Bk%2BDyFDE0fPTDXf1WZzA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9bb055a47edb56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21613,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (21612)","md5":"c4fe83f9639d531e5bc85676b4dc658f","sha1":"2b52db17b3a96f8bc88f1c3c6350c4f934c0997e","sha256":"bde5c1853ec2c7a4c57f64df03b3a515a66d9007b3876190abf1f0f7aa224c95","sha512":"338ff3b0a64bbd837266dfa2a41d2b4f008eeed0ef120738fd7fa24ccd633612531775520594d42347b8ef4eeb41773b15dc5a589af4bc1de4606dc16ddd0629","ssdeep":"384:GRvx8IXpmL+LEH1Zmv1GVM70PfDcwp57fh+:CdaH1ZmTYnDcwpe","tlshash":"52a2a6316a012a3df867ca2969d1db8f2231c4b3d9a31f1deb7575248b9e4c9193e3c4","first_seen":"2025-12-27T19:51:21.415755Z","last_seen":"2026-04-05T23:41:16.052042Z","times_seen":10,"resource_available":false,"data":null}},"time_used":510,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":509,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/static/images/tabBar/jy.png","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:19.943Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /static/images/tabBar/jy.png HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:20 GMT\r\ncontent-type: image/png\r\ncontent-length: 1057\r\nlast-modified: Tue, 25 Nov 2025 20:10:30 GMT\r\netag: \"69260d36-421\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UVtsSfkDuHG1ItKPUJoRWeuOirfv3PhOE7t8kIJ8sERB%2FEODCTZ2wvvY4X21QveZLClgtxPA%2FQjBe41jrfS6TESy5a7BgD4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\ncf-ray: 9bb055ad9f1a56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1057,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"0eccebc7bf864ab6f6432b3940225365","sha1":"e5a941399606443f76e8ed05f26dca79c8888d52","sha256":"0dfc4fb9eaa75a6985df6fae71271d38bd8b267c5eff4db97238b5323dcd94bd","sha512":"b8398d20cb25a47d5790dde5eefb4dcf0f634d15bb6e6a4fe6655e8032d81e55a17b981e6b0ce74173a9c1f3a6e75d9844c76d04e376e10835a7dfc2c7b5646d","ssdeep":"","tlshash":"4b11bc911f6742e4cd1f551a28241760cca21df83c259f89d5b87e46b36f5f50f115f1","first_seen":"2023-05-08T20:49:32Z","last_seen":"2026-08-10T05:13:29.732355Z","times_seen":296,"resource_available":false,"data":null}},"time_used":465,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":465,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Inter:wght@600;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:19.435Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:53:13 GMT","end":"Wed, 25 Feb 2026 15:53:12 GMT"},"fingerprint":{"sha1":"A8:BA:6B:80:7C:EC:B1:6F:C1:C2:03:D7:C9:27:6E:75:DE:4B:AA:47","sha256":"4E:2C:B9:C5:81:56:5E:97:93:07:22:12:66:E2:52:C6:0A:2E:17:72:FF:9B:5F:2A:B9:E1:21:80:05:6D:8B:3D"}}},"request":{"raw":"GET /css2?family=Inter:wght@600;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Fri, 09 Jan 2026 01:59:19 GMT\r\ndate: Fri, 09 Jan 2026 01:59:19 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5054,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"bfe3611cfd6eaa33321d7ef2e6040981","sha1":"ec890d6e69feaa28080a1fb0a205dc7b5a87714f","sha256":"f7a1adf3e107544e85325e212b9f2b7f9af3dc8f8077667fc4d0e5a4687e151b","sha512":"c3631473a78e91288b63c69703695ac8b6ffc17641e652fb18ba0d05da397888d9cf55e846aa5c90ba041c56dc89b492ae3900c9fb9b9a79bfd4869895f7ba72","ssdeep":"96:aOxMaNqOxMaXFZHOxMamOxMaO3vOxMaBOxMaBJc+uTOxMaNcNDOpaNqOpaXFZHOd:bNryfO3iExlONEhYO3RrxGx","tlshash":"eca18992002ba400ab971dc273cf7f3aaece50896085d1b95ffd0dc59cead66436876d","first_seen":"2025-09-19T20:01:38.048041Z","last_seen":"2026-08-10T05:13:29.726762Z","times_seen":192,"resource_available":false,"data":null}},"time_used":216,"timings":{"blocked":86,"dns":1,"connect":21,"send":0,"wait":34,"receive":0,"ssl":72},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/pages-index-index.d4920e26.js","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:19.969Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /assets/pages-index-index.d4920e26.js HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://qirex.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 25 Nov 2025 20:10:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69260d35-adc0\"\r\nexpires: Fri, 09 Jan 2026 13:59:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\npriority: u=4,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VDpg9C3wEs%2BtVnKBGEA4hr2qvqFViZ%2BKnpXRNNJcqQn3RkbxZae8CFAZD%2BUKUGQSttlgpBpMf9wtHziREVd1VHmdScC5alc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9bb055adcf2156a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":44480,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (23566)","md5":"080994d7db4b9bb5204e85ea9d8508cd","sha1":"f3bc059bf54900dcfc246224e7866683399454f1","sha256":"8fa71025aa8d62eb3198dddbf62fd364df90ac211a158b60f307f5915caa62d2","sha512":"2ef11ec5a3b78a6caee744b95722fa2f05107a6cf0558e80f3beb8577d05c070957d987b7a50f198bceb6742f4a47f94a69517d827db65697fb098142fd22c8d","ssdeep":"768:wciccc/+hx9++oqCQFRJOz5OAv5eq8DSqmfYTmJOfUXzC2jOiGcuH6ckrTdbqnIW:ww+o10e57B8DSqmfYSJxzC3ne9unkPf2","tlshash":"e6137cb1f56d8a7e6313e98dc8604406259d5e8ea228f480b7fc9d353393940aefd778","first_seen":"2025-12-27T19:51:21.402242Z","last_seen":"2026-04-05T23:41:16.026167Z","times_seen":10,"resource_available":true,"data":null}},"time_used":626,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":626,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/tm-app.48459f1e.js","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:19.974Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /assets/tm-app.48459f1e.js HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://qirex.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 25 Nov 2025 20:10:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69260d35-a53\"\r\nexpires: Fri, 09 Jan 2026 13:59:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\npriority: u=4,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cf3q1FEhlCxXIDucsdYzMEN2LSeRhaniT4j1Mv%2FMk2%2Fd6nuu81hhGL1aDuYHroPkh3DSMGU8ntuCTvHUAFMr8glbt%2BpklPk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9bb055adcf2556a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2643,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (1999)","md5":"a98ffaf80a4a3ebb9e62f361252a3e18","sha1":"facd824440dcc102fd5fa3030ca521a613ef91d5","sha256":"321cc0803f4a5bb7e577bacac01ae34d321d48f5ec5c8f774ae47826faeb6c66","sha512":"b08400503e7190bf3ef884fd2135734e2b034949daeb98a66013ceaf33ea7fa81fc2aa4fa80d094e340441100a77b5fb8a475b78abc820c5db088035a2d2ce69","ssdeep":"","tlshash":"dc51753d32e9b27c62374ace5476574c184b776d4a326bf6d27a78703080c68725fb68","first_seen":"2025-12-27T19:51:21.41327Z","last_seen":"2026-04-05T23:41:16.045239Z","times_seen":10,"resource_available":true,"data":null}},"time_used":499,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":499,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/pages-index-init.cf8da835.js","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:20.486Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /assets/pages-index-init.cf8da835.js HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/assets/index.ac3db0d1.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 25 Nov 2025 20:10:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69260d35-5d7\"\r\nexpires: Fri, 09 Jan 2026 13:59:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 0\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NHlemohi4gM9GFaclFqi%2BNYr2%2FA3x%2FWDMSXn%2Fj7b%2BaFp1FCM4fls5gFGbS%2B8jn9M%2B4c9JpPObNmqXRU3BJIicg2PyNLRUpc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9bb055b10f4556a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1495,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (1494)","md5":"3b6bbe292d9f04050b7deb70c2d0b3db","sha1":"f3641610ea760d6e934b5cf888c62f94c4e97d90","sha256":"6cf49b76830c6a9d6e9b5608e4b8945aa4fb2a83f3e700f1ace2450554efb083","sha512":"4bcc8aafd8289320d0a9dd4de19c81f18454731df884d6873dbc94ecb1a7d20a1e6a47fcd18348cf2a82e5fc9c65c8c1f0aae0c100c328b6278fa386dcbffc90","ssdeep":"","tlshash":"d031774b32afaa766f721847b5fc2c88477217841c32f4cd7e6a5c1968f2d45188d321","first_seen":"2025-12-27T19:51:21.458827Z","last_seen":"2026-04-05T23:41:16.018882Z","times_seen":10,"resource_available":true,"data":null}},"time_used":5,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=SF+Pro+Text:wght@400\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:19.431Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:53:13 GMT","end":"Wed, 25 Feb 2026 15:53:12 GMT"},"fingerprint":{"sha1":"A8:BA:6B:80:7C:EC:B1:6F:C1:C2:03:D7:C9:27:6E:75:DE:4B:AA:47","sha256":"4E:2C:B9:C5:81:56:5E:97:93:07:22:12:66:E2:52:C6:0A:2E:17:72:FF:9B:5F:2A:B9:E1:21:80:05:6D:8B:3D"}}},"request":{"raw":"GET /css2?family=SF+Pro+Text:wght@400\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 400 Bad Request\r\ncontent-type: text/html; charset=utf-8\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: Mon, 01 Jan 1990 00:00:00 GMT\r\ndate: Fri, 09 Jan 2026 01:59:19 GMT\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"400","status_text":"Bad Request","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T03:54:04.418886Z","times_seen":17865591,"resource_available":true,"data":null}},"time_used":455,"timings":{"blocked":209,"dns":0,"connect":9,"send":0,"wait":32,"receive":0,"ssl":202},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/tm-button.8ba014a2.js","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:20.613Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /assets/tm-button.8ba014a2.js HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/assets/pages-index-index.d4920e26.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 25 Nov 2025 20:10:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69260d35-129b\"\r\nexpires: Fri, 09 Jan 2026 13:59:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 0\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XjTmY5LlX7j5hH0lKeCLhzMOOvVyibIR3VTLnS1ZI5Tr1TvUlTEVhiVGMpxnVPwB%2BpfKE0OQKuO%2BqciVSQwzgpinGfMBwfs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9bb055b1df4c56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4763,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (4762)","md5":"fab9e100434eb072d5d3c5bf44ddb4ce","sha1":"45351ea7c2cfae03b2a0cede9967a981a3ba80dd","sha256":"2fb1ad4950849500c0fc1c4fe5a8805260ade7edb04125f831ebf7b8d5a26267","sha512":"6d9d4287ea623faa7d4f052126020cb8411f33f96f989da01cc66eb7b6ff413e6cd9cd86fd4df44c045bff6d731e6be178142c35bc095489d1faaaf0ae0fdd77","ssdeep":"96:RgmHUD//UusxzD9831y6MX6eA6l5+Vhc8/YFs2GXUx8TCZ8NAwNGgEknZ1Q3:umm74Iq6ClEApYUSTCUAwNGonZ1Q3","tlshash":"cba1f824317dcdbb6ecbefdc3054291225259b6ee53476d1fea4603a138b8e590ccb28","first_seen":"2025-12-27T19:51:21.439307Z","last_seen":"2026-04-05T23:41:16.027804Z","times_seen":10,"resource_available":true,"data":null}},"time_used":5,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/tm-tag.d8d94e2f.js","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:20.619Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /assets/tm-tag.d8d94e2f.js HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/assets/pages-index-index.d4920e26.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 25 Nov 2025 20:10:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69260d35-fa6\"\r\nexpires: Fri, 09 Jan 2026 13:59:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 0\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ywIok7Kaw3DouJ0KfdGuMtXbdxcga6ginMv3cvRgWNiR0V2E6npjDC3LWj6arTu%2BHFbWZP%2FeOU7PgALKXlnnOS%2FkT5WydYU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9bb055b1df4b56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4006,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (4005)","md5":"a187e3a42209c04c57a8b5ec0193d0dd","sha1":"fdf4d681c90d65d443d887c7ab59c7aee441e234","sha256":"a9d8b256c3cd71c6b43abbdce6a9084caf5a836ceac1d2dcf5bc1597842833d5","sha512":"c5b5d8415ae8d28abe6bbee97793daf49cb7c0a8433e57f0020f9c56307981b023922fb1218de4c3b51ef52ee661162800f53a5fb5799fd90405764f5c92cd40","ssdeep":"","tlshash":"0c8175b43d1948f696ff4acca172ae0d492a256eac357ff2f4a121245cf1925b04e73c","first_seen":"2025-12-27T19:51:21.417847Z","last_seen":"2026-04-05T23:41:16.048619Z","times_seen":10,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/file/images/001-20250921121559192.png","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:20.793Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /file/images/001-20250921121559192.png HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:21 GMT\r\ncontent-type: image/png\r\ncontent-length: 200786\r\nvary: Origin, accept-encoding\r\nlast-modified: Sat, 20 Sep 2025 18:45:59 GMT\r\ncache-control: max-age=14400\r\naccept-ranges: bytes\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nexpires: Fri, 09 Jan 2026 02:00:21 GMT\r\nx-cache: MISS\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=INu6xhq2B3X1r2d2MrhTQCcEdMSmTPkOL54S%2BKA9s1rJLsloKWywKOqhMO4bn1%2B0A81fqD793tjOAY4dVdI38IcKZ8VWjQE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncf-ray: 9bb055b2ff5156a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":200786,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 7631 x 1661, 8-bit/color RGBA, non-interlaced","md5":"6b5fdbe37d11a16fbdd17bec5c698e0d","sha1":"fc0c94d1dfb835f5f355c6e4abfccfd8c3e1688e","sha256":"cc782f9dca0fa7207e1178954940947a75d85d91490c5b42c06d58a93a1b92d1","sha512":"4acf411a544c8b6a65c3ae39c970b923d3ef9a03b3dfe108bfa244b71f3a972ac3b9d996c41109e2fa634c7ab8352e7d729f2b286da344b772d28fdb5f8c93a0","ssdeep":"6144:Y+M9gH+q3dIR7W68ZCr28wWTorzkcZ7Ba7S5mkVK:XZ68Mr2NWcEU7Ba7S5mWK","tlshash":"e614f14e6e4f8de0e9a115b9ac6d0f89377845ed8058bf2b437dc4ba5fcb7a02407486","first_seen":"2025-10-13T00:19:12.583768Z","last_seen":"2026-01-09T02:03:41.384004Z","times_seen":8,"resource_available":false,"data":null}},"time_used":975,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":621,"receive":354,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"huobicfg.s3.amazonaws.com/currency_icon/psg.png","fqdn":"huobicfg.s3.amazonaws.com","domain":"huobicfg.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.157.31","port":443,"asn":16509,"as":"AMAZON-02","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:21.055Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3-ap-northeast-1.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 14 Nov 2025 00:00:00 GMT","end":"Fri, 30 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"46:67:AE:AC:E3:C2:0D:C4:55:CA:3F:CB:B1:64:48:00:87:D7:E6:91","sha256":"18:7F:98:1B:96:0A:EE:5D:A8:54:AC:EE:61:CD:E2:1A:42:79:57:6C:BB:97:D4:54:5F:AD:91:87:86:84:69:D8"}}},"request":{"raw":"GET /currency_icon/psg.png HTTP/1.1\r\nHost: huobicfg.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: Up/mpqwlWbWtI8w97JTvyxBEb9RLhSURql68NLMoPRzzW3wMeoHbbw82cNhA8VDu6BZHm5uSEH7riNXNqmDgrKkt3cTtrxXB\r\nx-amz-request-id: CE3EZZEP1HF4BHDG\r\nDate: Fri, 09 Jan 2026 01:59:22 GMT\r\nLast-Modified: Tue, 11 Mar 2025 07:25:29 GMT\r\nETag: \"71d001dc16f522a80b0d27c28e947fc9\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/svg+xml\r\nContent-Length: 71831\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":71831,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"71d001dc16f522a80b0d27c28e947fc9","sha1":"8cb23ccb55c480a1c15df8b696d40bdb45b777bd","sha256":"c203f6e5b6457611be12973824aa99cc88659ef455d8a04a6902a0b21b2a9e4c","sha512":"eeb0b27e2651b05b0418ffc64df6be22e8e405127b9dda87451d1eed40cde4a672f5eb52498068add547f57a82b7183f075246eff6fe61483e058f79265c5ef4","ssdeep":"1536:EO81xrez0YhxU0vdAhTgZlIw4iaP/MEyyejB/CI3Ly5BBYXn:hixC0Yhx7vWhTG05/MEF8h3LgE3","tlshash":"4363026d71807b584740498870bb274c4f9ba9e14f11f66ad44d9e9f8ba0caf2c236b3","first_seen":"2025-03-11T08:52:08.6073Z","last_seen":"2026-07-28T06:18:25.094456Z","times_seen":180,"resource_available":false,"data":null}},"time_used":2401,"timings":{"blocked":774,"dns":0,"connect":281,"send":0,"wait":302,"receive":562,"ssl":473},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"huobicfg.s3.amazonaws.com/currency_icon/ltc.png","fqdn":"huobicfg.s3.amazonaws.com","domain":"huobicfg.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.157.31","port":443,"asn":16509,"as":"AMAZON-02","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:21.066Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3-ap-northeast-1.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 14 Nov 2025 00:00:00 GMT","end":"Fri, 30 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"46:67:AE:AC:E3:C2:0D:C4:55:CA:3F:CB:B1:64:48:00:87:D7:E6:91","sha256":"18:7F:98:1B:96:0A:EE:5D:A8:54:AC:EE:61:CD:E2:1A:42:79:57:6C:BB:97:D4:54:5F:AD:91:87:86:84:69:D8"}}},"request":{"raw":"GET /currency_icon/ltc.png HTTP/1.1\r\nHost: huobicfg.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: bV7yf0DRPcqIRXZrc0mE8TsmUMVM8Y/ftpYtNDwFf15bp8xO+yw+Wr9Nq49+2+IWnWZe7XoWQEmozgqIbl1PfWjTZ2BamJcz\r\nx-amz-request-id: 0VJEQZX5JN7HVZK9\r\nDate: Fri, 09 Jan 2026 01:59:23 GMT\r\nLast-Modified: Tue, 27 Jul 2021 09:04:10 GMT\r\nETag: \"b772bf1738628de70f1b9304c3d669ff\"\r\nAccept-Ranges: bytes\r\nContent-Type: image/svg+xml\r\nContent-Length: 479\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":479,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b772bf1738628de70f1b9304c3d669ff","sha1":"db4b8dbd617a80bc2b7efcafc1b93064eb9a08bf","sha256":"9afa8bc92c0b1ed443e1b75a05bbac5399cc3a6c95863765b0d68959faf089ed","sha512":"2c54b078c370b434455c91a7a61454bc4cbc3ab611793db68dc733087aa507a280108d53977a1a47983a7161b52cea75d097c6f6bee8c529774fde42ad2c7516","ssdeep":"","tlshash":"f8f02e7df6441b35980ed634663e2cb430352fa2f245805a21dd1a547a574ea5945363","first_seen":"2023-05-25T08:09:47Z","last_seen":"2026-08-10T05:13:29.722789Z","times_seen":525,"resource_available":false,"data":null}},"time_used":1263,"timings":{"blocked":967,"dns":0,"connect":0,"send":0,"wait":295,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"huobicfg.s3.amazonaws.com/currency_icon/ht.png","fqdn":"huobicfg.s3.amazonaws.com","domain":"huobicfg.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.157.31","port":443,"asn":16509,"as":"AMAZON-02","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:21.070Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3-ap-northeast-1.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 14 Nov 2025 00:00:00 GMT","end":"Fri, 30 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"46:67:AE:AC:E3:C2:0D:C4:55:CA:3F:CB:B1:64:48:00:87:D7:E6:91","sha256":"18:7F:98:1B:96:0A:EE:5D:A8:54:AC:EE:61:CD:E2:1A:42:79:57:6C:BB:97:D4:54:5F:AD:91:87:86:84:69:D8"}}},"request":{"raw":"GET /currency_icon/ht.png HTTP/1.1\r\nHost: huobicfg.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: L3h1fkVv/nV7bZh5j1cIHC2zgSCkAgF8M6VZZiVWYqLOcQHqynqAt2OiKky7xuihlD5pIttqFpjt+LaxGetMSH+umStWjgbW\r\nx-amz-request-id: 0VJ7WHGXWH0AVCDH\r\nDate: Fri, 09 Jan 2026 01:59:23 GMT\r\nLast-Modified: Mon, 25 Oct 2021 03:09:57 GMT\r\nETag: \"80e500afa84f18399d56e65b94005aac\"\r\nAccept-Ranges: bytes\r\nContent-Type: image/svg+xml\r\nContent-Length: 1991\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":1991,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"80e500afa84f18399d56e65b94005aac","sha1":"374e04f26b691c0652197ad6f32d108b6a47e291","sha256":"4da8fea2e80ffa1543e86524a0127c052a3746d5d49b2ec9a613df58f78246f4","sha512":"d1f46b2989d02ff4fa201553b2aba323499c7b68bd11c306c02cb899182ae1ab350eb0bfc25f48bf1502b131a7e2625e10f76f72a6ccb8a12dbeefd3f3c3acf2","ssdeep":"","tlshash":"9c41ee1fb3153668f510b2e026769c313a492f92b922f07313fc1e01a96b45c1b3ac5b","first_seen":"2023-05-25T08:09:48Z","last_seen":"2026-06-27T23:42:53.281393Z","times_seen":60,"resource_available":false,"data":null}},"time_used":1615,"timings":{"blocked":1312,"dns":0,"connect":0,"send":0,"wait":303,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/v1/api/config/platformConfig","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:20.516Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /v1/api/config/platformConfig HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/json;charset=UTF-8;\r\nlanguage: en-US\r\nauthorize: \r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:20 GMT\r\ncontent-type: application/json;charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ymp9ogB4iVOSk%2FNz6klsQU2gM3kSnFssfnBAQMQeQ%2BmoJG8BH841GKnEDULezlAhr8W%2BrvDqZMtYAKyhZIxPWfitcaFHOgI%3D\"}]}\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate, no-cache\r\npragma: no-cache\r\nexpires: 0\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: 9bb055b13f4656a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3280,"size_decoded":0,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"bb10d2590df813a887d34304ccb6922c","sha1":"2cdc156c6b2593dd0ad374800c5450d36b71a66e","sha256":"acdad1469d4158205fb3936b66dc7780240e0c9c5e60a67d1746464496e892b5","sha512":"4118d1139d472e3fa953112b552f683f64e957b58c1eb5427821ecdee7e0c45b659f179873f5316e56f8e91a8c968d533b6570de41949517530b317fa55e0c76","ssdeep":"","tlshash":"33610d8d2236a9f8cae415cbd8e714180f78a9d6a944f50fc3a6ec607ee74c07638207","first_seen":"2026-01-09T01:59:50.391723Z","last_seen":"2026-01-09T01:59:50.391723Z","times_seen":1,"resource_available":false,"data":null}},"time_used":226,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":226,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/v1/api/exchange/getSymbolConfig","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:34.668Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /v1/api/exchange/getSymbolConfig HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/json;charset=UTF-8;\r\nlanguage: en\r\nauthorize: \r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:34 GMT\r\ncontent-type: application/json;charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IpESvo%2FX3E50ScB6vU1%2BC8znI5VMngDewjc4Flj1PUXhQpZRWrP%2Fp97Oi65EdKwIa28lzAzH8EsrqG659t3SX1%2FlHX9ZH%2Fo%3D\"}]}\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate, no-cache\r\npragma: no-cache\r\nexpires: 0\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: 9bb05609a9d856a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6769,"size_decoded":0,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"127a7bfe1d2eaedeb83d06ccfc898893","sha1":"5f948139a9108cd45828703c9e949b0a6d6bfdc7","sha256":"0601b0f15d7acd9f04ba0b0ee1ffec20462f64d8414385cf3ea4da107c15447a","sha512":"033e616884246f91891f60a92b676d510b9d0371d8a7de7bf1dc0ac0cb4ed6f3dd29a7a24ce5a8bfee1322e3c0591884a4dec98fb061b98edb50d9c81eecad36","ssdeep":"96:7lxWjjIUGdZbVaECTeGgVRbR7CgZV3+LaaHP6eNWuww60TX97j1VIvN7/NvjtmA8:7LJdjN7R1ZsFnu05/nIvfvjyv3bMAZ","tlshash":"69d1ca55236117afc561a2c21ce23fdc182e2aa71cc71b45a2fede5e83109ef7527722","first_seen":"2026-01-09T01:59:50.393331Z","last_seen":"2026-01-09T01:59:50.393331Z","times_seen":1,"resource_available":false,"data":null}},"time_used":182,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":181,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/init.46f70d82.css","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:19.979Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /assets/init.46f70d82.css HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:20 GMT\r\ncontent-type: text/css\r\nvary: accept-encoding\r\nlast-modified: Tue, 25 Nov 2025 20:10:29 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Fri, 09 Jan 2026 13:59:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"69260d35-9c\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qt34DZM4Mp1mKxPjnVBaooHjgFywKaUIR5Z%2BVkDkB7Gp%2F765MeLB1dxKi6llnLZ1STgjU0aoMBvyJ63heXqXsPUQmI2NjwY%3D\"}]}\r\npriority: u=2,i=?0\r\ncf-ray: 9bb055addf2956a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":156,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"f5bc673696be89f7cec571c977e64018","sha1":"d58e256201b6638c9c3d565c1f44350343cd8f66","sha256":"794ffb7f52558d182033ae2459239a72747e4d5c197557f80dc53d965873bcf2","sha512":"99fd2ef30705972bfae8f10808707afc008b58fe0d43c0dd5700e0e3724bb0c9e5692c2c3fa5b32d431ff6ed46f00ca2a1f282fbbd6d1f17e273b9aa7d87a9f7","ssdeep":"","tlshash":"a8c08c70291fa2508832e243f4cccd95b3fde506cb72650f1a88e88a81899dab8c8243","first_seen":"2023-10-21T14:22:53Z","last_seen":"2026-07-12T23:28:19.765067Z","times_seen":186,"resource_available":false,"data":null}},"time_used":502,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":502,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"huobicfg.s3.amazonaws.com/currency_icon/ksm.png","fqdn":"huobicfg.s3.amazonaws.com","domain":"huobicfg.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.157.31","port":443,"asn":16509,"as":"AMAZON-02","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:21.067Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3-ap-northeast-1.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 14 Nov 2025 00:00:00 GMT","end":"Fri, 30 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"46:67:AE:AC:E3:C2:0D:C4:55:CA:3F:CB:B1:64:48:00:87:D7:E6:91","sha256":"18:7F:98:1B:96:0A:EE:5D:A8:54:AC:EE:61:CD:E2:1A:42:79:57:6C:BB:97:D4:54:5F:AD:91:87:86:84:69:D8"}}},"request":{"raw":"GET /currency_icon/ksm.png HTTP/1.1\r\nHost: huobicfg.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: B/Fy9U5R4s0w8L4fxT4hJlC7FV4gTgoUhPRMqnjC42lW5ttvA8KBqKlKq+rcHldeOpzhvkd7E+MT9brGIk/3Zu2gWU9xrEmg\r\nx-amz-request-id: 0VJDKTKJ3AG95FXJ\r\nDate: Fri, 09 Jan 2026 01:59:23 GMT\r\nLast-Modified: Tue, 27 Jul 2021 08:56:32 GMT\r\nETag: \"87de3ee0fdebb621dabd4796598f6888\"\r\nAccept-Ranges: bytes\r\nContent-Type: image/svg+xml\r\nContent-Length: 4490\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":4490,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"87de3ee0fdebb621dabd4796598f6888","sha1":"f8dd822f8f7b75fdb2b18ff10266deab9c397dcd","sha256":"64613bc4f18ed4f69a72222af826cb68733ad5ffd5990a2223ab689da62f1f56","sha512":"601584512d6d26a0488c0430ce4461fd9516fbffd408b04beaed4cdbfa123fdddb741f28b2a32694a1bc65d99013208e71b6b0a3e364a7f671f8a6b0b0b23bbf","ssdeep":"96:QRazcf7/YySPnq0HGo0GJc5pr/LEDwjc0RfEtcy/lB4X+:QYzI/Yfnqi8zEkjciMcy0X+","tlshash":"ee918818a32ecb7cf509f6dd4717c874e68bbe917812c48e5bab0847d2a142d48b78c3","first_seen":"2023-05-25T08:09:47Z","last_seen":"2026-08-10T05:13:29.711615Z","times_seen":228,"resource_available":false,"data":null}},"time_used":1315,"timings":{"blocked":1014,"dns":0,"connect":0,"send":0,"wait":301,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"huobicfg.s3.amazonaws.com/currency_icon/uni.png","fqdn":"huobicfg.s3.amazonaws.com","domain":"huobicfg.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.157.31","port":443,"asn":16509,"as":"AMAZON-02","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:21.071Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3-ap-northeast-1.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 14 Nov 2025 00:00:00 GMT","end":"Fri, 30 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"46:67:AE:AC:E3:C2:0D:C4:55:CA:3F:CB:B1:64:48:00:87:D7:E6:91","sha256":"18:7F:98:1B:96:0A:EE:5D:A8:54:AC:EE:61:CD:E2:1A:42:79:57:6C:BB:97:D4:54:5F:AD:91:87:86:84:69:D8"}}},"request":{"raw":"GET /currency_icon/uni.png HTTP/1.1\r\nHost: huobicfg.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: Q8V1sERqZvrNweqYcj16kHv+Mzmko4uQI7MUTG2BA3xlBqhj/Gebi1uShdJrRQRWjjNzOJPVGPc08Co8EG8IEXcTB86O7lxv\r\nx-amz-request-id: 0VJ6E39EY8ER0MS7\r\nDate: Fri, 09 Jan 2026 01:59:23 GMT\r\nLast-Modified: Tue, 14 Dec 2021 01:19:26 GMT\r\nETag: \"ca0493ee4bcd7c0c7801ec1f0f915f3c\"\r\nAccept-Ranges: bytes\r\nContent-Type: image/svg+xml\r\nContent-Length: 7922\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":7922,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ca0493ee4bcd7c0c7801ec1f0f915f3c","sha1":"f210cabb3d69c47b8702fe98edd167077536ed4d","sha256":"36e52e07f68877eceeee2b2ac16ac4100269e3664309d0d660df7d83f817ab6c","sha512":"8938631143e6af6175436ea9c88217978fc4d5455313dc73cb60569fb3526bdca9c91d18c24a0b17bfec511c2c2b04c27a4e4e346af1e941ff19914c8daf6724","ssdeep":"192:LeMeH9bKXWe3oJJP85GbEEyrp2EG0kkpsFUHinY2kTm7:Lkx85iyrpxG0vpOvka7","tlshash":"0bf1b4c4b3ad62f8f501ebfc475a34b66e122cfa3922c19a87e21d45dd4485d4ca8cdb","first_seen":"2023-05-08T20:49:32Z","last_seen":"2026-07-28T06:18:25.097937Z","times_seen":99,"resource_available":false,"data":null}},"time_used":1840,"timings":{"blocked":1539,"dns":0,"connect":0,"send":0,"wait":300,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Readex+Pro:wght@400;500;600\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:19.428Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:53:13 GMT","end":"Wed, 25 Feb 2026 15:53:12 GMT"},"fingerprint":{"sha1":"A8:BA:6B:80:7C:EC:B1:6F:C1:C2:03:D7:C9:27:6E:75:DE:4B:AA:47","sha256":"4E:2C:B9:C5:81:56:5E:97:93:07:22:12:66:E2:52:C6:0A:2E:17:72:FF:9B:5F:2A:B9:E1:21:80:05:6D:8B:3D"}}},"request":{"raw":"GET /css2?family=Readex+Pro:wght@400;500;600\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Fri, 09 Jan 2026 01:59:19 GMT\r\ndate: Fri, 09 Jan 2026 01:59:19 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6714,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (649)","md5":"b58a2b65d23adae432d6aede5f3a6bab","sha1":"194dfc8b1d63db1339585ff5c3a14cc6d8aa7d6d","sha256":"f47b4165cc9585373f8c546eefedc2df4e0ad1541865992c8dab1c2f7af09eff","sha512":"ff040a0aa6695698ce24e62c97f3905df671c9438646d083504cd94441c2e705e3ca213ddcb10cba401d79e7422c3a53b5bdcc869b1d26218bd05df5809e3cb6","ssdeep":"96:HOEawZA0Zl8DCK9cH0fOEa6dOEa0KJc+uDOEayMNsOXawZA0Zl8DCK9cH0fOXa6M:AfCl0obbdGfCl0v0beDfCl0S9b7i","tlshash":"86d1add5481f55487b471dc262cd7e23ad4da1642080d4689ffe278bacdfd22376839c","first_seen":"2025-09-19T20:01:38.034194Z","last_seen":"2026-08-10T05:13:29.710052Z","times_seen":140,"resource_available":false,"data":null}},"time_used":226,"timings":{"blocked":94,"dns":1,"connect":7,"send":0,"wait":33,"receive":0,"ssl":87},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"huobicfg.s3.amazonaws.com/currency_icon/eth.png","fqdn":"huobicfg.s3.amazonaws.com","domain":"huobicfg.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.157.31","port":443,"asn":16509,"as":"AMAZON-02","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:21.028Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3-ap-northeast-1.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 14 Nov 2025 00:00:00 GMT","end":"Fri, 30 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"46:67:AE:AC:E3:C2:0D:C4:55:CA:3F:CB:B1:64:48:00:87:D7:E6:91","sha256":"18:7F:98:1B:96:0A:EE:5D:A8:54:AC:EE:61:CD:E2:1A:42:79:57:6C:BB:97:D4:54:5F:AD:91:87:86:84:69:D8"}}},"request":{"raw":"GET /currency_icon/eth.png HTTP/1.1\r\nHost: huobicfg.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: Fp7sNT7qcGKxvJL94ZOQIl84Rh0DGrSsgu8/cXVtXJbDYtR0zhQDvtHHObjeK4zRUpiRcZ/4sgIK1k05Xt+/VLwtD3x+p6Ys\r\nx-amz-request-id: CE3ERYWZ775PPBXR\r\nDate: Fri, 09 Jan 2026 01:59:22 GMT\r\nLast-Modified: Wed, 23 Nov 2022 07:24:47 GMT\r\nETag: \"d8a57c2396575a058eb68a6c0e32caef\"\r\nAccept-Ranges: bytes\r\nContent-Type: image/svg+xml\r\nContent-Length: 616\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":616,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d8a57c2396575a058eb68a6c0e32caef","sha1":"6495d31828866f3dbabc4aad7c77e02ff457cfb8","sha256":"b05bb6169930a076c463a15280a165560bd30972e2599f71ca62f44c023d666c","sha512":"7bf60d4e2903aa9f5be3e9268a3379da63feb8a312534d17c48686419a4fb52993c0c75b3686ca004145502266f58d9fa39cf59f19b7ab9dee6b503b877c3f58","ssdeep":"","tlshash":"f1f0a498354a14204804c77b1adead3a625329ecb7a6c0c5bfd91b0b79c48eb3cb55cd","first_seen":"2023-05-08T20:49:32Z","last_seen":"2026-08-10T05:13:29.721169Z","times_seen":546,"resource_available":false,"data":null}},"time_used":1778,"timings":{"blocked":747,"dns":18,"connect":280,"send":0,"wait":306,"receive":0,"ssl":425},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"huobicfg.s3.amazonaws.com/currency_icon/link.png","fqdn":"huobicfg.s3.amazonaws.com","domain":"huobicfg.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.157.31","port":443,"asn":16509,"as":"AMAZON-02","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:21.070Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3-ap-northeast-1.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 14 Nov 2025 00:00:00 GMT","end":"Fri, 30 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"46:67:AE:AC:E3:C2:0D:C4:55:CA:3F:CB:B1:64:48:00:87:D7:E6:91","sha256":"18:7F:98:1B:96:0A:EE:5D:A8:54:AC:EE:61:CD:E2:1A:42:79:57:6C:BB:97:D4:54:5F:AD:91:87:86:84:69:D8"}}},"request":{"raw":"GET /currency_icon/link.png HTTP/1.1\r\nHost: huobicfg.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: Kn1CfIdLdFKa5OOOBHqd79X0PhOJxGufQwREHGddZS2AEaJohvvarso9AdMN5G9PUyI/I/feuVakzpfLu9OjJXCQDTfJolas\r\nx-amz-request-id: 0VJ3TECVQDM2NQZK\r\nDate: Fri, 09 Jan 2026 01:59:23 GMT\r\nLast-Modified: Tue, 27 Jul 2021 09:01:11 GMT\r\nETag: \"3cfdbc8f3e987bcf7862cba68cb369cc\"\r\nAccept-Ranges: bytes\r\nContent-Type: image/svg+xml\r\nContent-Length: 681\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":681,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3cfdbc8f3e987bcf7862cba68cb369cc","sha1":"56d54bea22c25a2d43176ca784f3b0e8561e9be0","sha256":"d1abda5be2eca6511387d52e50be65c444b1e39cd5451d9fb601ad28424e3761","sha512":"23e769c4ea1911a0f0d77a0932d769c2a9e3ddfc4f71451b904338962b3310be4f3a36964fa4c31ffc98aa19f06e3e8a82226a640a1f4f222cecd5080ab0e4c7","ssdeep":"","tlshash":"fe01f47b75886af1fc0ee335621808773eb13f9af567c00109d12e40720b811871d29a","first_seen":"2023-06-07T09:48:40Z","last_seen":"2026-08-10T05:13:29.71787Z","times_seen":421,"resource_available":false,"data":null}},"time_used":1557,"timings":{"blocked":1259,"dns":0,"connect":0,"send":0,"wait":298,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/activity.6457c612.js","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:19.976Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /assets/activity.6457c612.js HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://qirex.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:20 GMT\r\ncontent-type: application/javascript\r\nvary: accept-encoding\r\nlast-modified: Tue, 25 Nov 2025 20:10:29 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Fri, 09 Jan 2026 13:59:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"69260d35-13f\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0kHOE9uwQ6GTKMBKNdwLIE3OyQuD9xulTvCcqU0F9LSzO0dmXHzYkLOJp8CoPCxV0WJ3kMls4xpaxrhWO8SwBCBueMdJl4o%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9bb055adcf2856a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":319,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (318)","md5":"d66a34c6d3382f4b49c959a26989962a","sha1":"0948b3a425f7f019e091d216d37c2ac8c294ea3d","sha256":"3399b44949d7639e5016ebd11daaae11b20ed39db9fbca0ed341de7731e176e7","sha512":"52d4389370f97fa9a83fa333e91a409d4b502abf59e94d26f9b2c5853b7ce7ac437aa70c37ca9cd93046ef3f0b6bb5b7e829d8119c038eb08cd2842cca4d3c67","ssdeep":"","tlshash":"cce0262e3215bbb38a0204d7805a6a43a327edd00e0a86a09e09130c3ab219997bd47b","first_seen":"2025-12-27T19:51:21.398226Z","last_seen":"2026-04-05T23:41:16.029294Z","times_seen":10,"resource_available":true,"data":null}},"time_used":477,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":477,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/tm-segtab.73a26c8e.js","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:20.606Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /assets/tm-segtab.73a26c8e.js HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/assets/pages-index-index.d4920e26.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 25 Nov 2025 20:10:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69260d35-1286\"\r\nexpires: Fri, 09 Jan 2026 13:59:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 0\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NGqfClKzFheqcM8XlrMCzgWJdk6ZFSV30IYfoOKo7sJFONaCdHjjzR5%2Foj7uIH1WH%2FSPlhd2I9sKUiHOHkO%2BxEVkoqdJT%2BM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9bb055b1cf4756a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4742,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (4741)","md5":"6f0de5f710e46b398917529b32001f62","sha1":"4fbe18421e469aa5472d7c112375f91a12ef8c69","sha256":"dc9158dbc77c619c09f3d18305af01d42c101a9981313fa6ba572154df145f9d","sha512":"3ca563dfdfa45b2394c0e98bd2da11cd0d5e393658068706e06af27f230af1a9d1e5038ba453e6df03248f14180fbf89cffac3c04fdd7b18327dca364e1a0b45","ssdeep":"96:OvHXeZgoBReFcJdnGW00LggbMiY4FCx/PLt+pixOwCCdcbILzJ3Cuq9:UXeZVwFc3HzcG4/PL2OyIJyuq9","tlshash":"72a1d778723ca83e37bb49a9b07251825209c79fd739a0d2b6e8047552a2d805addf2d","first_seen":"2025-12-27T19:51:21.452351Z","last_seen":"2026-04-05T23:41:16.034943Z","times_seen":10,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/tm-image.99203c1c.js","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:20.617Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /assets/tm-image.99203c1c.js HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/assets/pages-index-index.d4920e26.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 25 Nov 2025 20:10:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69260d35-1083\"\r\nexpires: Fri, 09 Jan 2026 13:59:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 0\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ATZJVopM1xpH7N1Ozt1He5pGbzuL3swHtrvV%2BfKx2uGOnlzaDcJkem5pMrAWkDLi6OVz79ZMq2Qy1aZtdbOXkg0GIiJOBG4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9bb055b1df4956a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4227,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (4226)","md5":"da346ba1840bf11250575dd2d702b83c","sha1":"557a28a26064e8b64351c1631387c4c3da3c3a68","sha256":"22e3f801e46750172047001b101510acabffb35a8d027611278afc684d75eb92","sha512":"848a5ad418562d42b1531adfb8adecd5812e0e9005e36d8a89ae68e56fab8eeab74c4ebbeee3218aa21857f3660a09ae38ec65b1b768c14ce12bd1d73f7cdab2","ssdeep":"96:gcDkON2VYyRTzmxmMRSfzHmt4apODtUwfUNBAlAIgby1N:gokXmxmMROzMpOu6UNBAlAsN","tlshash":"9f91a63c31bdd93f69fb49eda055994a54055f2ceb30b7d0bae1406ad1aec844129f3c","first_seen":"2025-12-27T19:51:21.440773Z","last_seen":"2026-04-05T23:41:16.022105Z","times_seen":10,"resource_available":true,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/static/images/tabBar/home-on.png","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:19.931Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /static/images/tabBar/home-on.png HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:20 GMT\r\ncontent-type: image/png\r\ncontent-length: 605\r\nlast-modified: Tue, 25 Nov 2025 20:10:30 GMT\r\netag: \"69260d36-25d\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=So0tuArx5XywDrZaX%2FEdFUb8h3ZF4TCZpyqWAnPCL5bLAMxEilP9Y7RtQEDhAr8DMHL0qqByQ8YxwR%2B5E34SutBQg0ckVMc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\ncf-ray: 9bb055ad8f1756a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":605,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"def19a0db24fe00a493b990c113b892e","sha1":"d61ec86b8f6d09170f76746cd9412b432d40fed5","sha256":"d279492339d20af5561086bafb7acf11427bf1b4a3a755a599bbb71192085056","sha512":"c7a7db8906c507fce94504fdfb2b14d4a470d62de1106e2ee0c4cdf1a78705d02177dd068e59ae354e92c1cc3a7779b9de3201a3107e8652cdb4547b5dac73aa","ssdeep":"","tlshash":"a1f047e668c1ff5eeff478a366a171f348b42537f3014f6750058111525c734697954b","first_seen":"2023-05-08T20:49:32Z","last_seen":"2026-08-10T05:13:29.727258Z","times_seen":297,"resource_available":false,"data":null}},"time_used":173,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":172,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/static/images/tabBar/order.png","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:19.939Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /static/images/tabBar/order.png HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:20 GMT\r\ncontent-type: image/png\r\ncontent-length: 623\r\nlast-modified: Tue, 25 Nov 2025 20:10:30 GMT\r\netag: \"69260d36-26f\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NzJ%2Fi6XcJ%2BE1REFBWUjPZQlLGmvYshvHHm6smHiNoVU%2Fz%2BJXGya9%2BTmM2E1cK1L1A5d4mLNQrEZmv%2BJGEA2aT6OzyGrBd18%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\ncf-ray: 9bb055ad9f1956a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":623,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"0897c7b0cb2bfbf9634a00807a6de57d","sha1":"29ba0909b568033163559a19b9d7f7325730622f","sha256":"3e8fee8f371d7d34ea9eb22d7597d2610ae85e333bd6231a625c2e72e7c9c349","sha512":"f1f720b73c149444d49e959cb95c650458a881f5670f52b59c8a34c2a069c0b706efe863b7ec1cce7f29364a234fc95766966b0545b373c7421cee186c0bb0a7","ssdeep":"","tlshash":"0bf0b7ea76a858a8ce3104fd15068c34890c15b03b8899ff2e793a144242a242c5011b","first_seen":"2023-05-08T20:49:32Z","last_seen":"2026-08-10T05:13:29.730223Z","times_seen":295,"resource_available":false,"data":null}},"time_used":466,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":462,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/tm-segtab.206f8890.css","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:19.956Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /assets/tm-segtab.206f8890.css HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:20 GMT\r\ncontent-type: text/css\r\nvary: accept-encoding\r\nlast-modified: Tue, 25 Nov 2025 20:10:29 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Fri, 09 Jan 2026 13:59:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"69260d35-92\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ry8wdp5ybm4qJIBrrIyoYufY3pfegOrMMJTEIZ6mtY3z4W9U8dC%2FW4Ysu6GYcKNjSYZbSozRzy49F%2FkjZ5ebqBw0j4UmoG8%3D\"}]}\r\npriority: u=2,i=?0\r\ncf-ray: 9bb055adbf1e56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":146,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"75ccb9822a43118d8c5e0206ff76969d","sha1":"a5ef88a98bc655e6a5ece65730b095a43ee36990","sha256":"b394ba56d52aa7ceeb7ba3fb6e93456d813751a536c69622f8c143e16e0a1bc1","sha512":"73ca6de779b6324af6b6b5043b58671da8947bdc578883bef3b5fe7ab9319dfaf053311bb001a85b4ab844944d2689db6a9f2bc17dd18ecd684deac1e2c93697","ssdeep":"","tlshash":"0cc08c54e31821100263871390c25c24c338ebc2ffa2a82db3404107080312d2263f92","first_seen":"2023-09-10T20:06:10Z","last_seen":"2026-07-24T05:21:13.424086Z","times_seen":206,"resource_available":false,"data":null}},"time_used":466,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":466,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=SF+Pro+Display:wght@300\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:19.433Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:53:13 GMT","end":"Wed, 25 Feb 2026 15:53:12 GMT"},"fingerprint":{"sha1":"A8:BA:6B:80:7C:EC:B1:6F:C1:C2:03:D7:C9:27:6E:75:DE:4B:AA:47","sha256":"4E:2C:B9:C5:81:56:5E:97:93:07:22:12:66:E2:52:C6:0A:2E:17:72:FF:9B:5F:2A:B9:E1:21:80:05:6D:8B:3D"}}},"request":{"raw":"GET /css2?family=SF+Pro+Display:wght@300\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 400 Bad Request\r\ncontent-type: text/html; charset=utf-8\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: Mon, 01 Jan 1990 00:00:00 GMT\r\ndate: Fri, 09 Jan 2026 01:59:19 GMT\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"400","status_text":"Bad Request","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T03:54:04.418886Z","times_seen":17865591,"resource_available":true,"data":null}},"time_used":263,"timings":{"blocked":112,"dns":0,"connect":9,"send":0,"wait":34,"receive":0,"ssl":105},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/activity.6457c612.js","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:20.626Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /assets/activity.6457c612.js HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/assets/pages-index-index.d4920e26.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:20 GMT\r\ncontent-type: application/javascript\r\nvary: accept-encoding\r\nlast-modified: Tue, 25 Nov 2025 20:10:29 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Fri, 09 Jan 2026 13:59:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: br\r\nage: 0\r\ncf-cache-status: HIT\r\netag: W/\"69260d35-13f\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LmVFW2aU5gYG38uMFS5lRaaqoRgnvZKM9OgzcJGMjUToLXu6Z4d4GrYHvLq0rf%2BboLrKniroV8PpWbzrsQjy%2F8srHnpB2jU%3D\"}]}\r\npriority: u=3,i=?0\r\ncf-ray: 9bb055b1df4d56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":319,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (318)","md5":"d66a34c6d3382f4b49c959a26989962a","sha1":"0948b3a425f7f019e091d216d37c2ac8c294ea3d","sha256":"3399b44949d7639e5016ebd11daaae11b20ed39db9fbca0ed341de7731e176e7","sha512":"52d4389370f97fa9a83fa333e91a409d4b502abf59e94d26f9b2c5853b7ce7ac437aa70c37ca9cd93046ef3f0b6bb5b7e829d8119c038eb08cd2842cca4d3c67","ssdeep":"","tlshash":"cce0262e3215bbb38a0204d7805a6a43a327edd00e0a86a09e09130c3ab219997bd47b","first_seen":"2025-12-27T19:51:21.398226Z","last_seen":"2026-04-05T23:41:16.029294Z","times_seen":10,"resource_available":true,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"huobicfg.s3.amazonaws.com/currency_icon/doge.png","fqdn":"huobicfg.s3.amazonaws.com","domain":"huobicfg.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.157.31","port":443,"asn":16509,"as":"AMAZON-02","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:21.032Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3-ap-northeast-1.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 14 Nov 2025 00:00:00 GMT","end":"Fri, 30 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"46:67:AE:AC:E3:C2:0D:C4:55:CA:3F:CB:B1:64:48:00:87:D7:E6:91","sha256":"18:7F:98:1B:96:0A:EE:5D:A8:54:AC:EE:61:CD:E2:1A:42:79:57:6C:BB:97:D4:54:5F:AD:91:87:86:84:69:D8"}}},"request":{"raw":"GET /currency_icon/doge.png HTTP/1.1\r\nHost: huobicfg.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: Qji61xZzwO20NPRNIoQxnzEWBVebdQmakHhUM6hbPsjRE7uwyv4+Z8sxOZEZLm58r838eyt+Tkuh7maWR/AglZGE2ily842n\r\nx-amz-request-id: CE35TJ1P766NBVPQ\r\nDate: Fri, 09 Jan 2026 01:59:22 GMT\r\nLast-Modified: Thu, 14 Nov 2024 02:02:53 GMT\r\nETag: \"85a9905c5ded19678ea5c2a0e3eb5b92\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/svg+xml\r\nContent-Length: 95699\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":95699,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"85a9905c5ded19678ea5c2a0e3eb5b92","sha1":"758fd685e61ce28ddab9bcebfc60f62f1f2c150f","sha256":"83785fe3ab9c29b35a4884d93864038593ac03e6f605a5cb6bf9f7567e338abb","sha512":"a88cb74309d3fca02ce1fc32c81f0d78c387a4936c0f2924c603037201d14b26a5fa715723f40d01868d2a41361e26e2a2abb315e32332970ce15a186d8043dd","ssdeep":"1536:LEpYE8EXjfWGPQcIhSWQnGQBMDPla2zoW1:f","tlshash":"da9394d5b7e5e2e8f005e3fc872a98f53a632cfa3922c95893e52c15e95102d489dcd3","first_seen":"2024-12-15T14:02:10.456974Z","last_seen":"2026-08-10T05:13:29.735125Z","times_seen":335,"resource_available":false,"data":null}},"time_used":2324,"timings":{"blocked":739,"dns":18,"connect":280,"send":0,"wait":301,"receive":562,"ssl":419},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"huobicfg.s3.amazonaws.com/currency_icon/atm.png","fqdn":"huobicfg.s3.amazonaws.com","domain":"huobicfg.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.157.31","port":443,"asn":16509,"as":"AMAZON-02","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:21.060Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3-ap-northeast-1.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 14 Nov 2025 00:00:00 GMT","end":"Fri, 30 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"46:67:AE:AC:E3:C2:0D:C4:55:CA:3F:CB:B1:64:48:00:87:D7:E6:91","sha256":"18:7F:98:1B:96:0A:EE:5D:A8:54:AC:EE:61:CD:E2:1A:42:79:57:6C:BB:97:D4:54:5F:AD:91:87:86:84:69:D8"}}},"request":{"raw":"GET /currency_icon/atm.png HTTP/1.1\r\nHost: huobicfg.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: MAI8xRSdDtmxnq9G6TXu5a2aFD4/B6gKvRfxVgkk3SAhjlWn8CuRWLixgYLYSTLkSa3J4AYuWYiZG9SXy/oCO9RmSqiSx+2o\r\nx-amz-request-id: 0VJDEVPY0R30ZF3B\r\nDate: Fri, 09 Jan 2026 01:59:23 GMT\r\nLast-Modified: Tue, 11 Mar 2025 07:26:30 GMT\r\nETag: \"0b936890c4705172570095a38a532012\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/svg+xml\r\nContent-Length: 57878\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":57878,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"0b936890c4705172570095a38a532012","sha1":"f4daecdba818f6d7187901b7accd73d188057f15","sha256":"95038af84cf03b7daf573dbb74b594844a428d986aafaa2293b271cf4ffc7363","sha512":"03922b324bcd0a7a2a59b62cd834a9c4cee456065dcc0e1852243ea1574935e6bb31ada1b6611ccb97a562b8e3814f2d512f28ccea8a89117abf869f1960e45c","ssdeep":"1536:kAYRg7ma+y/kpJZ55TNGApnIPhb3t0TJqg+zYa9Li9NdKvg:BSa+y/IT5TNGAA2TggCY39Nr","tlshash":"5843f1f74dac9c5e083595c08aeceaa5ca80ec06135dd920adca9f5c0d50dcaf43a5bf","first_seen":"2025-03-11T08:52:08.557956Z","last_seen":"2026-07-28T06:18:25.069958Z","times_seen":183,"resource_available":false,"data":null}},"time_used":1550,"timings":{"blocked":970,"dns":0,"connect":0,"send":0,"wait":299,"receive":281,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"huobicfg.s3.amazonaws.com/currency_icon/eos.png","fqdn":"huobicfg.s3.amazonaws.com","domain":"huobicfg.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.157.31","port":443,"asn":16509,"as":"AMAZON-02","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:21.069Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3-ap-northeast-1.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 14 Nov 2025 00:00:00 GMT","end":"Fri, 30 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"46:67:AE:AC:E3:C2:0D:C4:55:CA:3F:CB:B1:64:48:00:87:D7:E6:91","sha256":"18:7F:98:1B:96:0A:EE:5D:A8:54:AC:EE:61:CD:E2:1A:42:79:57:6C:BB:97:D4:54:5F:AD:91:87:86:84:69:D8"}}},"request":{"raw":"GET /currency_icon/eos.png HTTP/1.1\r\nHost: huobicfg.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: 3Qk2MB3LursBkkZLHCYMB3gNeis4xp4uaeXNL4CLYLz+NdUXqof2L6qf0aIgOpveu4MVQyeZQrX/Yrq1dUVQmLb1WK5b6GC8\r\nx-amz-request-id: 0VJ25F1PRB1Q11SF\r\nDate: Fri, 09 Jan 2026 01:59:23 GMT\r\nLast-Modified: Tue, 27 Jul 2021 09:11:38 GMT\r\nETag: \"96364067a53dec3a858b9a41163133eb\"\r\nAccept-Ranges: bytes\r\nContent-Type: image/svg+xml\r\nContent-Length: 2061\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":2061,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"96364067a53dec3a858b9a41163133eb","sha1":"84fda0fcaa9604e7ab19b7d53cac1b05304876c9","sha256":"efb1d77085cfde506d7d144e7caeb706841c2f8224a4f09420ce64a7be0f9b36","sha512":"593547b9c282eac2dc54027c9c0ca2f1ca060f6e063ceedb49ec289113b615fa1a881f1337be2562081c593ef5be6d1ad424c8c85e1acf7a4cbdb2e769fee114","ssdeep":"","tlshash":"774155ccb280fa10fd0ca3f9125198f235361e67b2d3c27683e61d15e92446c96794e6","first_seen":"2023-05-08T20:49:32Z","last_seen":"2026-08-10T05:13:29.720089Z","times_seen":276,"resource_available":false,"data":null}},"time_used":1548,"timings":{"blocked":1241,"dns":0,"connect":0,"send":0,"wait":307,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/tm-drawer.83de1656.css","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:19.957Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /assets/tm-drawer.83de1656.css HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:20 GMT\r\ncontent-type: text/css\r\nvary: accept-encoding\r\nlast-modified: Tue, 25 Nov 2025 20:10:29 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Fri, 09 Jan 2026 13:59:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"69260d35-1f1\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7TKL0d8V3RlwBdnxFOC%2BfM0YmAKQ%2FMex19Rb9nxdNNP0tO01fJOAC4A99ZuSjyTWD3BUZ%2FjNetYZEbVEOQ%2BLkV2SKWaC9yg%3D\"}]}\r\npriority: u=2,i=?0\r\ncf-ray: 9bb055adbf1f56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":497,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (496)","md5":"21760436a7a71a0a2257f1f0aeb3bcab","sha1":"88dc7eebea231f3ffeae69bee7dc7cc872ac69f2","sha256":"ed33f15247424f05f2338f5a2e9dd2199c8405afa9b3007b650ea9178c16dbc6","sha512":"631cfb7e0c813f298381f9c75372aa2a5fc4965294c54af7a36a97cf84a71c1cdb0d1038166e84c276e2134c5f08d7ad45ef4da11b0c5ed36b2a7c154b6ec941","ssdeep":"","tlshash":"f5f05445123e1f34dadbf9495c75270b8ca3e150cb1ba01c52a70a2e58efa855e609ec","first_seen":"2023-04-30T07:16:13Z","last_seen":"2026-07-24T05:21:13.389899Z","times_seen":242,"resource_available":false,"data":null}},"time_used":464,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":464,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/file/images/002-20250921121547952.png","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:23.023Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /file/images/002-20250921121547952.png HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:23 GMT\r\ncontent-type: image/png\r\ncontent-length: 104732\r\nvary: Origin, accept-encoding\r\nlast-modified: Sat, 20 Sep 2025 18:45:47 GMT\r\ncache-control: max-age=14400\r\naccept-ranges: bytes\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nexpires: Fri, 09 Jan 2026 02:00:23 GMT\r\nx-cache: MISS\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=d5ggWMdiqvmCVHdj22GAki7NePN3Oi%2BiWc8c0qbR4yUonQbqrkskhzmspHnafb%2BLSzPWLV3oO%2FeSUA5g5tIrtcf8ymwkzf8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\ncf-ray: 9bb055c0efb756a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":104732,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1781 x 1373, 8-bit/color RGBA, non-interlaced","md5":"a4d8ce1c39ff20d8f5134179a85708a4","sha1":"3226617fc6dcc250e36ebcaff9a4e9a6d75a7b4e","sha256":"f4b573692dc2014f63581d26927254eb8bb62ecb64cfecfbebdd4c9af6cacabf","sha512":"06a10b9677b3939986feb8a379ed55f1798da08cd1b9e442d7f6eb5b2c7a6df750fb23323956b4922f15b1c830447b02e80304f61fb63c213197ed2ac914122f","ssdeep":"3072:sVVJu9ESh9o71juxQDtY0/Ijm7Es0bVGcwjHz:sVm9jK7duxj0/IC7EH5yz","tlshash":"12a3029fad070c89f0be98b5c58527c5733a481f24d11bd2ae3a4db9c4d6b68a3c67c1","first_seen":"2025-10-13T00:19:12.544308Z","last_seen":"2026-01-09T02:03:41.400979Z","times_seen":8,"resource_available":false,"data":null}},"time_used":1023,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":684,"receive":339,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/index.3f4f1a61.css","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:18.479Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /assets/index.3f4f1a61.css HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:19 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 25 Nov 2025 20:10:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69260d35-5c9e7\"\r\nexpires: Fri, 09 Jan 2026 13:59:18 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yEec2qt%2BJAF7oisaMyrYY6Yaq8fousCX6HqIz6zEWXkGULOKrn1LNKYtjHiM6Q6p0RETFRUM%2FVNU14Yz8kdntiR%2B1Ea4kCw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9bb055a47edd56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":379367,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"bddf258f97b33b8b1ef1b9dde33d5140","sha1":"0889713fac40b5d90b6bae176b82a07073972288","sha256":"672205cfffeee945d0d0579e49312142a2e7b1be088bcb83530df0d8e950005e","sha512":"9f13389fcd0b4e02195910b786b0f779cb71e21aaf5bd115f8f723341f22db0cd18c7ae9d26f88ca37913267efa4e26bed55f996f3e632d479f020a0bd190a94","ssdeep":"3072:PDnvQTikh+GyK1ZDTasX+5w9szMZ9JVFr26L:7n3lGDd+WxZ9JP","tlshash":"db84b49e6e8411bcbf37d222d7a6a7ecb13cf560ee41c59af14325288ec37f60512598","first_seen":"2024-12-26T21:19:03.904115Z","last_seen":"2026-07-24T05:21:13.353202Z","times_seen":212,"resource_available":false,"data":null}},"time_used":931,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":624,"receive":307,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"huobicfg.s3.amazonaws.com/currency_icon/juv.png","fqdn":"huobicfg.s3.amazonaws.com","domain":"huobicfg.s3.amazonaws.com","tld":"s3.amazonaws.com"},"ip":{"addr":"3.5.157.31","port":443,"asn":16509,"as":"AMAZON-02","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:21.059Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3-ap-northeast-1.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Fri, 14 Nov 2025 00:00:00 GMT","end":"Fri, 30 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"46:67:AE:AC:E3:C2:0D:C4:55:CA:3F:CB:B1:64:48:00:87:D7:E6:91","sha256":"18:7F:98:1B:96:0A:EE:5D:A8:54:AC:EE:61:CD:E2:1A:42:79:57:6C:BB:97:D4:54:5F:AD:91:87:86:84:69:D8"}}},"request":{"raw":"GET /currency_icon/juv.png HTTP/1.1\r\nHost: huobicfg.s3.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: 37IP9AmNNR4KaFPIb/wiBltVtanfJQCYzq280aeSKn2dL7cJnP29KBjnTqZXMKMMS9XgBMvicmpRpJsCArVFI2gKiNPBakgp\r\nx-amz-request-id: CE3D9XZY93NTZXMS\r\nDate: Fri, 09 Jan 2026 01:59:22 GMT\r\nLast-Modified: Tue, 11 Mar 2025 07:26:15 GMT\r\nETag: \"fe957680ef81f353455d3aad7dac0fd4\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: image/svg+xml\r\nContent-Length: 51231\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":51231,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"fe957680ef81f353455d3aad7dac0fd4","sha1":"8d4feb503bc45a3bc2ed2f7dc8f0be3ede52ade8","sha256":"fc4cacb9287e561349c5ec9bd89d977c1eb5877ac251589164dd20a300aa9ef1","sha512":"6c3098256b8dcc6d9d374db969a0253ab782d6fbb465a98e7ba4644ccd64059ce072e04ecbd3172bc44df17dc99cba6f4f0f1931e301d7b7b1028b3385d9d01c","ssdeep":"768:rqSpyH2cUwSzH3C3xqNPNvvV2Y8tH4dce1gWNUgIUxG8Mva6sP1wP37YZmRaKliL:rpJPNl25Hje6hUeaTPOP37wkAV3Y/W","tlshash":"9533023c3e697c1f4b688328f839ae0c38c044fa9f4641297696ac65241eb45ff95b57","first_seen":"2025-03-11T08:52:08.587629Z","last_seen":"2026-07-28T06:18:25.104102Z","times_seen":172,"resource_available":false,"data":null}},"time_used":1912,"timings":{"blocked":670,"dns":0,"connect":281,"send":0,"wait":299,"receive":281,"ssl":371},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/index.ac3db0d1.js","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:18.477Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /assets/index.ac3db0d1.js HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:19 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 25 Nov 2025 20:10:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69260d35-19abbb\"\r\nexpires: Fri, 09 Jan 2026 13:59:18 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FNq0OxdCPk77ey96lQeoRhNYnwJKx%2FFPkUPK6kxb%2FuEEu6vH775EadQ3fylnMxBGM7Vfq9JwZXOkmsGdQ9vsio9uIa4hJHg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9bb055a47edc56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1682363,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (60832)","md5":"d7e2903d8092378738428bda561ccafa","sha1":"7815c6cfc9cceac2c397182f275285fa63c70208","sha256":"ff1e4fa2d6a5fcd07a1d9f1ff9cd111cb4d6e9a2437d2697da9ee42c923c34da","sha512":"fa8520631ad84515bad8768df5e20d1dfb1efc36085a287a3283bf98abecedceb4cf74d9badd32fe385c9fdd44066a30f5ae0de7ab4c6b54db518d36f44840a0","ssdeep":"24576:XTcyhtxArNC25gDA2oXSJRJMPAdqlhITsYsLg52Nh0A6YIQ24PrxG4hIt6uAUrb0:XTcyhtxArNC25gDA2oXSJRJMPAdqlhIk","tlshash":"d12593c5d9fa640e8be4f046e8b82e9e1c445ac0ed14c376ac7d59f3d7cb184aa6136c","first_seen":"2025-11-22T16:52:18.241381Z","last_seen":"2026-04-05T23:41:16.017272Z","times_seen":20,"resource_available":false,"data":null}},"time_used":1290,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":652,"receive":638,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/tm-segtab.73a26c8e.js","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:19.970Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /assets/tm-segtab.73a26c8e.js HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://qirex.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 25 Nov 2025 20:10:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69260d35-1286\"\r\nexpires: Fri, 09 Jan 2026 13:59:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\npriority: u=4,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1OlsU5126iCiUE%2Bj%2Bi3rWII7FEB8TnXv8BDWcKqpp2n6y8EJDwJYtDpou59FIiFJ0NC%2Bl%2BqgqIPYKbk3ufGrZZJFq1PWFtg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9bb055adcf2256a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4742,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (4741)","md5":"6f0de5f710e46b398917529b32001f62","sha1":"4fbe18421e469aa5472d7c112375f91a12ef8c69","sha256":"dc9158dbc77c619c09f3d18305af01d42c101a9981313fa6ba572154df145f9d","sha512":"3ca563dfdfa45b2394c0e98bd2da11cd0d5e393658068706e06af27f230af1a9d1e5038ba453e6df03248f14180fbf89cffac3c04fdd7b18327dca364e1a0b45","ssdeep":"96:OvHXeZgoBReFcJdnGW00LggbMiY4FCx/PLt+pixOwCCdcbILzJ3Cuq9:UXeZVwFc3HzcG4/PL2OyIJyuq9","tlshash":"72a1d778723ca83e37bb49a9b07251825209c79fd739a0d2b6e8047552a2d805addf2d","first_seen":"2025-12-27T19:51:21.452351Z","last_seen":"2026-04-05T23:41:16.034943Z","times_seen":10,"resource_available":true,"data":null}},"time_used":485,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":485,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/tm-image.99203c1c.js","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:19.975Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /assets/tm-image.99203c1c.js HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://qirex.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 25 Nov 2025 20:10:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69260d35-1083\"\r\nexpires: Fri, 09 Jan 2026 13:59:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\npriority: u=4,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oW%2BbAqNPRkUSB8UtZS%2BcR7DW%2FKZoI51t5IzTqEJ8g6T57%2FaM6OSW%2FzSflahuETaXtOGvoRhMd6k7Cmq3YIqwlPQB3eNqeas%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9bb055adcf2656a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4227,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (4226)","md5":"da346ba1840bf11250575dd2d702b83c","sha1":"557a28a26064e8b64351c1631387c4c3da3c3a68","sha256":"22e3f801e46750172047001b101510acabffb35a8d027611278afc684d75eb92","sha512":"848a5ad418562d42b1531adfb8adecd5812e0e9005e36d8a89ae68e56fab8eeab74c4ebbeee3218aa21857f3660a09ae38ec65b1b768c14ce12bd1d73f7cdab2","ssdeep":"96:gcDkON2VYyRTzmxmMRSfzHmt4apODtUwfUNBAlAIgby1N:gokXmxmMROzMpOu6UNBAlAsN","tlshash":"9f91a63c31bdd93f69fb49eda055994a54055f2ceb30b7d0bae1406ad1aec844129f3c","first_seen":"2025-12-27T19:51:21.440773Z","last_seen":"2026-04-05T23:41:16.022105Z","times_seen":10,"resource_available":true,"data":null}},"time_used":499,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":499,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/tm-app.48459f1e.js","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:20.615Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /assets/tm-app.48459f1e.js HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/assets/pages-index-index.d4920e26.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 25 Nov 2025 20:10:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69260d35-a53\"\r\nexpires: Fri, 09 Jan 2026 13:59:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 0\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vjpyMhkFUmmrZkDH2fqMNfSYQsszHul6A5j1iA4ykPiTOdZMzMWEFyF0LFgJC3yZYgTfx1RhkTSIpQouvxLFTqjlyx4odk0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9bb055b1df4a56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2643,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (1999)","md5":"a98ffaf80a4a3ebb9e62f361252a3e18","sha1":"facd824440dcc102fd5fa3030ca521a613ef91d5","sha256":"321cc0803f4a5bb7e577bacac01ae34d321d48f5ec5c8f774ae47826faeb6c66","sha512":"b08400503e7190bf3ef884fd2135734e2b034949daeb98a66013ceaf33ea7fa81fc2aa4fa80d094e340441100a77b5fb8a475b78abc820c5db088035a2d2ce69","ssdeep":"","tlshash":"dc51753d32e9b27c62374ace5476574c184b776d4a326bf6d27a78703080c68725fb68","first_seen":"2025-12-27T19:51:21.41327Z","last_seen":"2026-04-05T23:41:16.045239Z","times_seen":10,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/static/images/tabBar/my.png","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:19.948Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /static/images/tabBar/my.png HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:20 GMT\r\ncontent-type: image/png\r\ncontent-length: 664\r\nlast-modified: Tue, 25 Nov 2025 20:10:30 GMT\r\netag: \"69260d36-298\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MHLl33EDLSelhvIwt8eJ5nezUSMl0MPGTzH%2FzYx%2Fs8wjMnXgU1KJQ7NtWm1eY2XO833YR8sLSBzk%2Fr6k97NjwFCjFSRMoQs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\ncf-ray: 9bb055adaf1c56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":664,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"5fa0e8c8be776e0ad69b41eb29387ab1","sha1":"6a7dee6c2139d15e5fbe2f7a6ebabee07354710d","sha256":"eebdc7fce5c2de4f58a49db1cd4bce63341b14bcae199d396eb1ab5a2bea3807","sha512":"3e5432b58d865b134fe84a068a9ba7e01ba3dd19240f60e45d46bf5f3d727ece1a6e05350e467b63efebf0236304366bc4980d3dff4287354f03828c86fb18d9","ssdeep":"","tlshash":"3e0183e7bb204566c20c9a881801a8a9863790154ecbad49c564c1b82c2240656ff7d2","first_seen":"2023-05-08T20:49:32Z","last_seen":"2026-08-10T18:41:47.413868Z","times_seen":298,"resource_available":false,"data":null}},"time_used":467,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":467,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/static/images/tabBar/asset.png","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:19.947Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /static/images/tabBar/asset.png HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:20 GMT\r\ncontent-type: image/png\r\ncontent-length: 694\r\nlast-modified: Tue, 25 Nov 2025 20:10:30 GMT\r\netag: \"69260d36-2b6\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3iF1ELKdX5%2Bj6WeQisf6wCVBLBgM0%2B14pjJi9A%2F4r14s3oSIRYS%2FscNON6MDohgHabMnidMPzm17xJDyMxzPsPqptEcVsHA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\ncf-ray: 9bb055ad9f1b56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":694,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"c060f809b640e3037ff4b3acb5a80907","sha1":"f568594ca7b19224a846bd594f1c5e9e1002ba44","sha256":"9da1253a1c8a7153cb6568e7d3082dbb432e5a7662de8ee47507b0d7be9e32c6","sha512":"5ef880d1a924ce1474e6c1f68e7723ef4472fae08dbb4ed25561568f0af03cf89753648664315ecda8da9a173dcfe5dacf027f6f77b1ce810eae2b390f9bfa31","ssdeep":"","tlshash":"a90144dabcc2a0708aba3ca9595f7875ca92805811229f854b4998263a40b9cdd461c9","first_seen":"2023-05-08T20:49:32Z","last_seen":"2026-08-10T05:13:29.721702Z","times_seen":268,"resource_available":false,"data":null}},"time_used":441,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":441,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/pages-index-init.cf8da835.js","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:19.980Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /assets/pages-index-init.cf8da835.js HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://qirex.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 25 Nov 2025 20:10:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69260d35-5d7\"\r\nexpires: Fri, 09 Jan 2026 13:59:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\npriority: u=4,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Evx3YpAK2Xa87pC1OV5R0S0SSVJNbFqT5Epewl8IBlE0sQWz1zPAay6dszgaOzbicT3otHfvo2eQoU7ozEatU2AOxBi3%2FGI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9bb055addf2a56a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1495,"size_decoded":0,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (1494)","md5":"3b6bbe292d9f04050b7deb70c2d0b3db","sha1":"f3641610ea760d6e934b5cf888c62f94c4e97d90","sha256":"6cf49b76830c6a9d6e9b5608e4b8945aa4fb2a83f3e700f1ace2450554efb083","sha512":"4bcc8aafd8289320d0a9dd4de19c81f18454731df884d6873dbc94ecb1a7d20a1e6a47fcd18348cf2a82e5fc9c65c8c1f0aae0c100c328b6278fa386dcbffc90","ssdeep":"","tlshash":"d031774b32afaa766f721847b5fc2c88477217841c32f4cd7e6a5c1968f2d45188d321","first_seen":"2025-12-27T19:51:21.458827Z","last_seen":"2026-04-05T23:41:16.018882Z","times_seen":10,"resource_available":true,"data":null}},"time_used":474,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":474,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/tm-drawer.3e3aa7b9.js","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:20.609Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /assets/tm-drawer.3e3aa7b9.js HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/assets/pages-index-index.d4920e26.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 25 Nov 2025 20:10:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69260d35-162a\"\r\nexpires: Fri, 09 Jan 2026 13:59:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 0\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9DM3DVsAMZh9g2qf%2BHavgI7NwUcZPL8khYKl5dP324snjSHgVRFToEDYAZoDCq3zeCOLKKk78ZMpptUCn62%2FrKQnoGKXXxo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9bb055b1cf4856a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5674,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (5673)","md5":"b3299d1c70bf03266966dfddf8a909bb","sha1":"85e62161e3b77eec4271f898ad924748fbdf3e4f","sha256":"ce8f90116904308dd8adcba3e80b10dd2c90254e41ad5b70bfe9939379e7f281","sha512":"1359350a8c617a609725358db8963228a6382723fd571dbf7d29778697c42c5180a8468cdc9b70dce4d6bda30065ad797868f7131d844f543bd39f3022d5bbe3","ssdeep":"96:3Ovlw3F5RUtxr6SDZbCzQrcQw2D5IWW6iQ/IDu/PXmVWaNmz1Xl5o+H+g:SlemBNoQwoP3aNmz9g8+g","tlshash":"06c1c898746e2373a6b709a5c072480d133e1f5dd97876c1f2e2193a36f6d484dd8bb8","first_seen":"2025-12-27T19:51:21.422707Z","last_seen":"2026-04-05T23:41:16.014384Z","times_seen":10,"resource_available":true,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.dcloud.net.cn/img/shadow-grey.png","fqdn":"cdn.dcloud.net.cn","domain":"dcloud.net.cn","tld":"net.cn"},"ip":{"addr":"124.222.174.117","port":443,"asn":45090,"as":"Shenzhen Tencent Computer Systems Company Limited","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:22.790Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.dcloud.net.cn","organization":""},"issuer":{"commonName":"Certum Domain Validation CA SHA2","organization":"Unizeto Technologies S.A."},"validity":{"start":"Tue, 26 Aug 2025 11:47:17 GMT","end":"Fri, 25 Sep 2026 11:47:16 GMT"},"fingerprint":{"sha1":"47:A7:6C:09:6B:1D:CA:2D:7D:39:2E:C1:7F:15:DE:5D:F2:C4:0F:77","sha256":"EA:73:37:83:D0:38:44:D9:3C:0B:26:F0:DD:D1:22:2F:36:F7:F2:86:A1:B0:58:52:DE:4E:0A:21:D6:89:E7:3E"}}},"request":{"raw":"GET /img/shadow-grey.png HTTP/1.1\r\nHost: cdn.dcloud.net.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 09 Jan 2026 01:59:23 GMT\r\ncontent-type: image/png\r\ncontent-length: 136\r\nlast-modified: Thu, 06 Jun 2019 06:42:07 GMT\r\netag: \"5cf8b5bf-88\"\r\nexpires: Fri, 09 Jan 2026 15:59:23 GMT\r\ncache-control: max-age=50400\r\nset-cookie: __uni__uid=rBEQa2lgYPteVp2sA+OQAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=dcloud.net.cn; path=/; secure; httponly; samesite=none\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":136,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1 x 6, 4-bit colormap, non-interlaced","md5":"5a962adf74d92ae702467b3f47976547","sha1":"36f74049375584e3fa69b5ef87e9572336ff9e7a","sha256":"ad4ebea1c3496dd2924789ee009174a2c6289d1200e9811f458fd46f172d1d6f","sha512":"4ace23fe7ec6c7271710030fd423aace13eafac68ac3e76366ce4ce9bdc702caf71c9bdc2fb6a32c8e9791546098617cc0259decd8bb8489afdbce43e1b53a73","ssdeep":"","tlshash":"47c09bf3a615dc754a0d153b42e98271f429511e07046d0e5a13c216741e3448d56793","first_seen":"2023-04-15T10:50:30Z","last_seen":"2026-08-13T02:56:59.425052Z","times_seen":20218,"resource_available":false,"data":null}},"time_used":1412,"timings":{"blocked":579,"dns":1,"connect":253,"send":0,"wait":253,"receive":0,"ssl":323},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Poppins:wght@400\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:19.436Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:53:13 GMT","end":"Wed, 25 Feb 2026 15:53:12 GMT"},"fingerprint":{"sha1":"A8:BA:6B:80:7C:EC:B1:6F:C1:C2:03:D7:C9:27:6E:75:DE:4B:AA:47","sha256":"4E:2C:B9:C5:81:56:5E:97:93:07:22:12:66:E2:52:C6:0A:2E:17:72:FF:9B:5F:2A:B9:E1:21:80:05:6D:8B:3D"}}},"request":{"raw":"GET /css2?family=Poppins:wght@400\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Fri, 09 Jan 2026 01:59:19 GMT\r\ndate: Fri, 09 Jan 2026 01:59:19 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1189,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"70f6f56be7ff7ace3e1f9979aef5db75","sha1":"3247717a7c2321db34762076775f37f8adc1e6e1","sha256":"ce53fd6ea2c59a3106afb0cf49f27a403675291622352c323c04ab5cc642a321","sha512":"b2020165c0c7b5c32c97d6b62bac6666d9b7c895ab837dca8272334ac3cdf164030e1780f80461b602690075ada4f3e836a4bea1505532b3bd6f281cc110392b","ssdeep":"","tlshash":"2d219791087bd114ab871cc523ce6d37ee0e9251b810e5786bfe0c98adabc654362b2d","first_seen":"2025-09-17T08:48:26.697017Z","last_seen":"2026-08-12T21:17:25.752597Z","times_seen":6625,"resource_available":false,"data":null}},"time_used":258,"timings":{"blocked":108,"dns":0,"connect":22,"send":0,"wait":33,"receive":0,"ssl":91},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/tm-button.ddf396b1.css","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:19.958Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /assets/tm-button.ddf396b1.css HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:20 GMT\r\ncontent-type: text/css\r\nvary: accept-encoding\r\nlast-modified: Tue, 25 Nov 2025 20:10:29 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Fri, 09 Jan 2026 13:59:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"69260d35-12d\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9w54r5aHHnnxj9oOy9WsqPeJV5wVoagbJ%2FvnwbxOFnn6AnVJsEDdQ7Vk6N0l8QGPfCQ%2BL3fgDHZmOTISCpZDtRz2RJAgArI%3D\"}]}\r\npriority: u=2,i=?0\r\ncf-ray: 9bb055adbf2056a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":301,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"0e9f614f6c6215d066c9fdcfa7645776","sha1":"2728ef74e26aa186fa6e3f87bf11cedaa46b42de","sha256":"0c7a24f6669840fcb16ab71c6c1b55d1c1f72dbc269ed86d96e21c5fabd21b55","sha512":"c0e93448c7e9834b782b41a6bdc249c9c5eb342c2111bdea2a1833fb39f3c93653442f0eed89f45a058633b1ecf2509e5bf1226ee4c21d771375eea8c8af080d","ssdeep":"","tlshash":"33e0c2f1398e408cb537e3c2e058c015aed02513b9542b291ee402c10e0209bb424f49","first_seen":"2023-04-30T07:16:13Z","last_seen":"2026-07-24T05:21:13.344602Z","times_seen":249,"resource_available":false,"data":null}},"time_used":463,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":463,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"qirex.top/assets/pages-index-index.d4920e26.js","fqdn":"qirex.top","domain":"qirex.top","tld":"top"},"ip":{"addr":"104.21.29.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://qirex.top/","date":"2026-01-09T01:59:20.445Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"qirex.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 22:33:29 GMT","end":"Sun, 05 Apr 2026 23:29:57 GMT"},"fingerprint":{"sha1":"32:E0:15:56:68:6A:72:9D:C3:C6:14:10:53:14:76:BE:95:94:A6:E3","sha256":"79:25:42:85:2D:72:4B:94:C4:E3:76:21:AB:38:20:E6:F6:9B:E2:CC:5C:6E:96:C0:3B:C0:20:C0:73:1F:D4:61"}}},"request":{"raw":"GET /assets/pages-index-index.d4920e26.js HTTP/1.1\r\nHost: qirex.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://qirex.top/assets/index.ac3db0d1.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Fri, 09 Jan 2026 01:59:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 25 Nov 2025 20:10:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69260d35-adc0\"\r\nexpires: Fri, 09 Jan 2026 13:59:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 0\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=X9UYDrLOFAjV7k4%2BFZ9SyuWiH9%2FESejSUUoF1WUB7Vs0np9jKHUTvkoMo44E9MCrJruT%2FDXY4DNmm%2FbTbtFLi%2BZKR3X0WQ4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9bb055b0cf4356a2-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":44480,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (23566)","md5":"080994d7db4b9bb5204e85ea9d8508cd","sha1":"f3bc059bf54900dcfc246224e7866683399454f1","sha256":"8fa71025aa8d62eb3198dddbf62fd364df90ac211a158b60f307f5915caa62d2","sha512":"2ef11ec5a3b78a6caee744b95722fa2f05107a6cf0558e80f3beb8577d05c070957d987b7a50f198bceb6742f4a47f94a69517d827db65697fb098142fd22c8d","ssdeep":"768:wciccc/+hx9++oqCQFRJOz5OAv5eq8DSqmfYTmJOfUXzC2jOiGcuH6ckrTdbqnIW:ww+o10e57B8DSqmfYSJxzC3ne9unkPf2","tlshash":"e6137cb1f56d8a7e6313e98dc8604406259d5e8ea228f480b7fc9d353393940aefd778","first_seen":"2025-12-27T19:51:21.402242Z","last_seen":"2026-04-05T23:41:16.026167Z","times_seen":10,"resource_available":true,"data":null}},"time_used":145,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":145,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-09","alert":"Sinkholed","trigger":"qirex.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}