www.36596666.net/
101 B IP
ASN #140227 Hong Kong Communications International Co., Limited
File type HTML document, ASCII text
Hash d93d5f7be38cc57b42799b9e6920c621
d6706dab775dc14002e4ba03ab7f617d1589dcc7
7da8343a58c4da7903bd695215bec76da2914b358aaf596ba78db136d77ccb50
Analyzer Verdict Alert OpenPhish phishing Bet365
GET / HTTP/1.1
Host: www.36596666.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:36:53 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Cache-Control: private, no-store, no-cache, must-revalidate, proxy-revalidate
Content-Encoding: gzip
ocsp.pki.goog/gts1c3
471 B IP
Hash 207ae762f0515c41bc3e73047c45e318
0151e1f912f350a273d5cd059d75917feb43c11b
5999a0241dadf6533adc8e2aa7ebd928c4f90acc48216f877d6980858a8ee5f4
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 13 Oct 2023 05:36:55 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.googletagmanager.com/gtag/js?id=G-B5HTXF8BMH
200 OK 92 kB URL GET HTTP/2 www.googletagmanager.com/gtag/js?id=G-B5HTXF8BMH
IP
Requested by https://www.36596666.net:8989/
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
Fingerprint54:FD:04:1B:2E:C7:46:95:DD:15:A3:A0:3F:CE:7F:03:02:53:36:8F
ValidityMon, 18 Sep 2023 08:19:25 GMT - Mon, 11 Dec 2023 08:19:24 GMT
File type ASCII text, with very long lines (5788)
Hash a1cd9bceec116b6ad4829dbebf93e041
e6d1717b9ae5993df4f5db7ae750576e51783c55
723ff92951cb83deb177ee4acecdfaef36753117d25a052a73f2f292e1f2b8ac
GET /gtag/js?id=G-B5HTXF8BMH HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Fri, 13 Oct 2023 05:36:55 GMT
expires: Fri, 13 Oct 2023 05:36:55 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 92089
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
200 OK 117 kB URL User Request GET HTTP/1.1 IP
ASN #140227 Hong Kong Communications International Co., Limited
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text
Size 117 kB (117339 bytes)
Hash bfb3da5d8288cbd9e4d56883317af258
2b09c5754615310417b8c1f45327c26753aa5605
06d5559e332ecb6f39d36856b0a8b9f851f0cc559e3429421d55b356567ba31e
GET / HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:36:54 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-html-cache: HIT-3600
X-Frame-Options: SAMEORIGIN
uuid: -
out-line: gb-site-097
Content-Encoding: gzip
ocsp.pki.goog/gts1c3
471 B IP
Hash 207ae762f0515c41bc3e73047c45e318
0151e1f912f350a273d5cd059d75917feb43c11b
5999a0241dadf6533adc8e2aa7ebd928c4f90acc48216f877d6980858a8ee5f4
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 13 Oct 2023 05:36:55 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.36596666.net:8989/message_zh_CN.js?v=1697017525275
200 9.9 kB URL GET HTTP/1.1 www.36596666.net:8989/message_zh_CN.js?v=1697017525275
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type Unicode text, UTF-8 text, with very long lines (18042)
Hash adcd647972140ca028f47a6dd9646934
391048d6b4a2878b9d0dac49df247c5504f06dd7
ad194b3c9e03ab63b64bccd568d8c277db23a273c5ac4f3ef670decb7417a7ed
GET /message_zh_CN.js?v=1697017525275 HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Date: Fri, 13 Oct 2023 05:36:55 GMT
Content-Type: application/javascript;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:36:55 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: 00141-02-00000000-16971754154692
out-line: gb-site-097
www.36596666.net:8989/commonPage/lan/i18n.js?t=1697175414.554
200 OK 812 B URL GET HTTP/1.1 www.36596666.net:8989/commonPage/lan/i18n.js?t=1697175414.554
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type ASCII text, with very long lines (1217)
Hash 3a7a3d239778ac96e78e6805e26c1202
0db1173992392a7a98d237bd7202f78263cb6225
72500e74ecbc1c9b972c588b6d16fc153d86154b395a8abb2a784371e21032d2
GET /commonPage/lan/i18n.js?t=1697175414.554 HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:36:55 GMT
Content-Type: application/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
uuid: 00141-02-00000000-1697175415be0b
out-line: gb-site-097
Content-Encoding: gzip
ocsp.sectigo.com/
471 B IP
Hash 046ac95cf0637cbea16f01dec4446493
43096fda3617fd8529f98f46549b84124ee18e10
574e04f3520f74be38cb4df6704a4d168bed46d73761ebf10ceee4a648ea6d9f
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:36:57 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Wed, 11 Oct 2023 17:16:18 GMT
Expires: Wed, 18 Oct 2023 17:16:17 GMT
Etag: "43096fda3617fd8529f98f46549b84124ee18e10"
Cache-Control: max-age=473359,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb2
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 81553a563f7d56bd-OSL
ocsp.sectigo.com/
471 B IP
Hash 046ac95cf0637cbea16f01dec4446493
43096fda3617fd8529f98f46549b84124ee18e10
574e04f3520f74be38cb4df6704a4d168bed46d73761ebf10ceee4a648ea6d9f
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:36:57 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Wed, 11 Oct 2023 17:16:18 GMT
Expires: Wed, 18 Oct 2023 17:16:17 GMT
Etag: "43096fda3617fd8529f98f46549b84124ee18e10"
Cache-Control: max-age=473359,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb2
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 81553a5649c1b509-OSL
ocsp.sectigo.com/
471 B IP
Hash 046ac95cf0637cbea16f01dec4446493
43096fda3617fd8529f98f46549b84124ee18e10
574e04f3520f74be38cb4df6704a4d168bed46d73761ebf10ceee4a648ea6d9f
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:36:57 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Wed, 11 Oct 2023 17:16:18 GMT
Expires: Wed, 18 Oct 2023 17:16:17 GMT
Etag: "43096fda3617fd8529f98f46549b84124ee18e10"
Cache-Control: max-age=473359,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb5
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 81553a563d14568d-OSL
ocsp.sectigo.com/
471 B IP
Hash 046ac95cf0637cbea16f01dec4446493
43096fda3617fd8529f98f46549b84124ee18e10
574e04f3520f74be38cb4df6704a4d168bed46d73761ebf10ceee4a648ea6d9f
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:36:57 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Wed, 11 Oct 2023 17:16:18 GMT
Expires: Wed, 18 Oct 2023 17:16:17 GMT
Etag: "43096fda3617fd8529f98f46549b84124ee18e10"
Cache-Control: max-age=473359,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb3
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 81553a564b71b503-OSL
ocsp.sectigo.com/
471 B IP
Hash 046ac95cf0637cbea16f01dec4446493
43096fda3617fd8529f98f46549b84124ee18e10
574e04f3520f74be38cb4df6704a4d168bed46d73761ebf10ceee4a648ea6d9f
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:36:57 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Wed, 11 Oct 2023 17:16:18 GMT
Expires: Wed, 18 Oct 2023 17:16:17 GMT
Etag: "43096fda3617fd8529f98f46549b84124ee18e10"
Cache-Control: max-age=473359,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb1
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 81553a564e5856a8-OSL
3dsa62.gaokejd.xyz/ftl/commonPage/themes/gui-base.css
200 OK 17 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/commonPage/themes/gui-base.css
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (12023)
Hash abc91330704282873c6755800f5cbf06
8677f67e781c23cadc13d0310eda118ba754339a
f481810dd316265622c2eee91fc349f6ac24367352f74c8fa849ddaf28a5c475
GET /ftl/commonPage/themes/gui-base.css HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/css
Content-Length: 16935
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-01
ETag: W/"650e8aa5-1413b"
Date: Thu, 28 Sep 2023 08:02:49 GMT
Last-Modified: Sat, 23 Sep 2023 06:50:13 GMT
Expires: Sat, 28 Oct 2023 08:02:49 GMT
Age: 1287247
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-01, HIT from KS-CLOUD-XG-FOREIGN-03-11
X-Cdn-Request-ID: 08b5cd077943d37c55aea6e8b2873265
3dsa62.gaokejd.xyz/ftl/commonPage/themes/gui-skin-default.css
200 OK 6.3 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/commonPage/themes/gui-skin-default.css
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type Unicode text, UTF-8 (with BOM) text, with very long lines (7014)
Hash 4f6eba52b6bdba2bd8154d39c61fcaab
11a91e977ab64175dc2ec233d45c6cf9d34798b0
b4ae8f84403e1e8ea7f75cac8491e461ac6e5524260a04d772d53dd912f8e53a
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/commonPage/themes/gui-skin-default.css HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/css
Content-Length: 6253
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-05
ETag: W/"64ad1569-7b6e"
Date: Thu, 28 Sep 2023 08:02:48 GMT
Last-Modified: Tue, 11 Jul 2023 08:40:09 GMT
Expires: Sat, 28 Oct 2023 08:02:48 GMT
Age: 1287248
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-05, HIT from KS-CLOUD-XG-FOREIGN-03-05
X-Cdn-Request-ID: e286024cf7f440548b4b60c74fbdee2d
3dsa62.gaokejd.xyz/ftl/bet365-141-2/themes/style/swiper-4.3.3.min.css
200 OK 3.1 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/bet365-141-2/themes/style/swiper-4.3.3.min.css
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type ASCII text, with very long lines (19512)
Hash f29b1aec530d4ecb1255894948203345
ec15a3a265c1556fae8f9553d371423df9653c50
f476606c821fd23ba0fcae1845e3e45ae39f6040921de2d96698ad7d1e922f3e
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/bet365-141-2/themes/style/swiper-4.3.3.min.css HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/css
Content-Length: 3094
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-01
ETag: W/"6153e3b6-4d3d"
Date: Thu, 28 Sep 2023 08:02:48 GMT
Last-Modified: Wed, 29 Sep 2021 03:55:34 GMT
Expires: Sat, 28 Oct 2023 08:02:48 GMT
Age: 1287248
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-01, HIT from KS-CLOUD-XG-FOREIGN-03-07
X-Cdn-Request-ID: bc98ba90a66cb614e8c390602e968cc0
3dsa62.gaokejd.xyz/ftl/bet365-141-2/themes/style/common.css
200 OK 13 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/bet365-141-2/themes/style/common.css
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type assembler source, Unicode text, UTF-8 (with BOM) text, with very long lines (532)
Hash d85714aa13b8df3bbe47562a0a5b0a82
e1dd836dc82ce5c0e8586bf837a90b2efb55916a
02f1ef82366e3bb0fb19f6e5f967e5c63ea857d53803aedcf6cb8f79ee7d4ac2
GET /ftl/bet365-141-2/themes/style/common.css HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/css
Content-Length: 12593
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-01
ETag: W/"65138f5d-d024"
Date: Thu, 28 Sep 2023 08:02:48 GMT
Last-Modified: Wed, 27 Sep 2023 02:11:41 GMT
Expires: Sat, 28 Oct 2023 08:02:48 GMT
Age: 1287248
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-01, HIT from KS-CLOUD-XG-03-03
X-Cdn-Request-ID: fd08a7d11595bb5b88dda77b2a8f40b9
3dsa62.gaokejd.xyz/ftl/bet365-141-2/themes/style/bootstrap-dialog.min.css
200 OK 630 B URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/bet365-141-2/themes/style/bootstrap-dialog.min.css
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
Hash 304eb84809c6637b7cdd0dc6225c5761
e724aff10b16dc82bf1086cd3b70d8396f630d64
cb1d0b332c0218bbb360fd25d693f88293b54389caf88c36ffcfd8adc948d0e4
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/bet365-141-2/themes/style/bootstrap-dialog.min.css HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/css
Content-Length: 630
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-05
ETag: W/"6153e3b6-adc"
Date: Thu, 28 Sep 2023 08:02:49 GMT
Last-Modified: Wed, 29 Sep 2021 03:55:34 GMT
Expires: Sat, 28 Oct 2023 08:02:49 GMT
Age: 1287247
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-05, HIT from KS-CLOUD-XG-FOREIGN-03-11
X-Cdn-Request-ID: 2da64430f8bb58a67fe8ebb5c48d777b
3dsa62.gaokejd.xyz/ftl/commonPage/js/jquery/jquery-1.11.3.min.js
200 OK 34 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/commonPage/js/jquery/jquery-1.11.3.min.js
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type ASCII text, with very long lines (32038)
Hash b091a47f6b91e26c93a848092c6f3788
52918af2d431e73464060b35d364640c8db75606
329ab92b9276ef4e3148f69be6b208969bebdf2db3121a589caa172453fd9f10
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/commonPage/js/jquery/jquery-1.11.3.min.js HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Content-Length: 33545
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-05
ETag: W/"5d848f4f-176d4"
Date: Thu, 28 Sep 2023 08:02:48 GMT
Last-Modified: Fri, 20 Sep 2019 08:35:27 GMT
Expires: Sat, 28 Oct 2023 08:02:48 GMT
Age: 1287249
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-05, HIT from KS-CLOUD-XG-03-12
X-Cdn-Request-ID: 57098d5782e07ddfc946a40957157f5f
3dsa62.gaokejd.xyz/ftl/commonPage/themes/hongbao.css
200 OK 5.7 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/commonPage/themes/hongbao.css
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (336)
Hash 499a3a64bcf22609681f5337a6360c80
fc05a8a391c8375ea4e47183eca56a18bed8fca7
5339bf22971b6400e64154decc06b84fd4be337c2758cc7ca565756c92c97894
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/commonPage/themes/hongbao.css HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://3dsa62.gaokejd.xyz/ftl/commonPage/themes/gui-base.css
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/css
Content-Length: 5666
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-06
ETag: W/"64252e4f-d530"
Date: Thu, 28 Sep 2023 08:02:49 GMT
Last-Modified: Thu, 30 Mar 2023 06:38:07 GMT
Expires: Sat, 28 Oct 2023 08:02:49 GMT
Age: 1287247
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-06, HIT from KS-CLOUD-XG-03-03
X-Cdn-Request-ID: b537a41d91fb4cfb98449cfc5a31dff5
3dsa62.gaokejd.xyz/ftl/commonPage/themes/gui-layer.css
200 OK 6.9 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/commonPage/themes/gui-layer.css
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (489)
Hash 858eefc3fa70af7d0115c901908471f5
29c181bbbc09a424f7de7cb57629bd8a9e3c679a
9f6a77c93f998e065f1ed52eb9943a3c560a50366bba2c8a34a4a1223c793caf
GET /ftl/commonPage/themes/gui-layer.css HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://3dsa62.gaokejd.xyz/ftl/commonPage/themes/gui-base.css
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/css
Content-Length: 6923
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-02
ETag: W/"64ddd5e1-c760"
Date: Thu, 28 Sep 2023 08:02:49 GMT
Last-Modified: Thu, 17 Aug 2023 08:10:09 GMT
Expires: Sat, 28 Oct 2023 08:02:49 GMT
Age: 1287247
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-02, HIT from KS-CLOUD-XG-FOREIGN-03-11
X-Cdn-Request-ID: e1239926b8ece4fc4497ceb67c6e5a1e
3dsa62.gaokejd.xyz/ftl/commonPage/js/float.js
200 OK 1.9 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/commonPage/js/float.js
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
Hash 829af863b0cdc4a603919824ae046299
1d417b1553e4ecb7125ebf2005b74255291fbf73
1dbe4afbc9ed220c08b9e95577b56f83e2e8e0f7620c5dc18266bb325e5bb271
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/commonPage/js/float.js HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Content-Length: 1929
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-01
ETag: W/"612747ba-1b2f"
Date: Thu, 28 Sep 2023 08:02:49 GMT
Last-Modified: Thu, 26 Aug 2021 07:50:18 GMT
Expires: Sat, 28 Oct 2023 08:02:49 GMT
Age: 1287247
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-01, HIT from KS-CLOUD-XG-03-03
X-Cdn-Request-ID: 8515fdd30cb90e168be204dcd7cf6f60
3dsa62.gaokejd.xyz/ftl/commonPage/js/idangerous.swiper.min.js
200 OK 12 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/commonPage/js/idangerous.swiper.min.js
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type ASCII text, with very long lines (32034)
Hash f15409fb02c527ce1f66a2fd3c4aa0e9
1e1e1bcc0f49e99e14ba34991cffe0745178d302
1a1b5d3d6fbfc28abe37a668abd59494208c63c5f0b5d040cf4bbbd137f87c27
GET /ftl/commonPage/js/idangerous.swiper.min.js HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Content-Length: 11957
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-02
ETag: W/"64d5b951-b083"
Date: Thu, 28 Sep 2023 08:02:49 GMT
Last-Modified: Fri, 11 Aug 2023 04:30:09 GMT
Expires: Sat, 28 Oct 2023 08:02:49 GMT
Age: 1287247
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-02, HIT from KS-CLOUD-XG-03-09
X-Cdn-Request-ID: 7511ef1895013022e2a7296486504729
3dsa62.gaokejd.xyz/ftl/commonPage/js/websocket/Comet.js
200 OK 4.0 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/commonPage/js/websocket/Comet.js
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
Hash 4de3e8bcf2f02d60519ca0d3584d3b8e
6323c2bf18b1bbf968e164bdf2e58d7677f67f8a
6cf6e96f51f13834e233bee9a9040f6eff70601dc0b755e60885b20550b35a9f
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/commonPage/js/websocket/Comet.js HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Content-Length: 4031
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-02
ETag: W/"60f60fb5-43bc"
Date: Thu, 28 Sep 2023 08:02:48 GMT
Last-Modified: Mon, 19 Jul 2021 23:50:13 GMT
Expires: Sat, 28 Oct 2023 08:02:48 GMT
Age: 1287249
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-02, HIT from KS-CLOUD-XG-FOREIGN-03-05
X-Cdn-Request-ID: af4513e81e9799890c19b873b3fa550c
3dsa62.gaokejd.xyz/ftl/commonPage/js/websocket/CometMarathon.js
200 OK 3.3 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/commonPage/js/websocket/CometMarathon.js
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
Hash 3b4680db1e065116488f065419ca9f58
6c646601c5656ff6cb1fdf9d5b95823f41e9bcfa
e2bfb9fc21f2a1a6e33c7c5ed20de13ef2ef4bcf266aa4b2e6f2fee06f8f4eaf
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/commonPage/js/websocket/CometMarathon.js HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Content-Length: 3316
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-02
ETag: W/"6260ddd4-2f13"
Date: Thu, 28 Sep 2023 08:02:49 GMT
Last-Modified: Thu, 21 Apr 2022 04:30:12 GMT
Expires: Sat, 28 Oct 2023 08:02:49 GMT
Age: 1287248
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-02, HIT from KS-CLOUD-XG-03-09
X-Cdn-Request-ID: 5cbd5ae2eb8625aeaaff7dea2c59b75c
3dsa62.gaokejd.xyz/ftl/commonPage/js/websocket/PopUp.js
200 OK 797 B URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/commonPage/js/websocket/PopUp.js
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
Hash 07864ad2e2759d53f8f2f14dd4295bd9
95144219e2eb702c4c4a707c3622b086876cf41c
871bf30791bb89605b61cea815c3786246274b65ede3b8a8b8c2dd9244cfa89d
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/commonPage/js/websocket/PopUp.js HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Content-Length: 797
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-05
ETag: W/"6260ddd4-828"
Date: Thu, 28 Sep 2023 08:02:49 GMT
Last-Modified: Thu, 21 Apr 2022 04:30:12 GMT
Expires: Sat, 28 Oct 2023 08:02:49 GMT
Age: 1287248
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-05, HIT from KS-CLOUD-XG-FOREIGN-03-10
X-Cdn-Request-ID: a3af61e26516d1946c1dd3ca67d0aeef
3dsa62.gaokejd.xyz/ftl/commonPage/js/lazyload.js
200 OK 2.7 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/commonPage/js/lazyload.js
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
Hash 58f1a7fa1a19b0e5ad0a5bad974b98cf
6963ce7378e6c992de06e7e77d79432a0d38f54d
fb513dceb383ebeda507b1e1cc89ab4d73de071d8aa4fc78bc22f66e7fc5a7e4
GET /ftl/commonPage/js/lazyload.js HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Content-Length: 2731
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-06
ETag: W/"64d05f66-2f79"
Date: Thu, 28 Sep 2023 08:02:49 GMT
Last-Modified: Mon, 07 Aug 2023 03:05:10 GMT
Expires: Sat, 28 Oct 2023 08:02:49 GMT
Age: 1287248
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-06, HIT from KS-CLOUD-XG-03-03
X-Cdn-Request-ID: 9752a7471f376dc728755afc12056a04
3dsa62.gaokejd.xyz/ftl/commonPage/js/gui-base.js
200 OK 16 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/commonPage/js/gui-base.js
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type HTML document, Unicode text, UTF-8 text, with very long lines (11056)
Hash 4007cfe0a95df1d6a9f4252e636f995f
b0f9a2ad5c49b9b50ac5d025c8e9ce803eb5d7a8
4370313fa317e44140f85bba141ec24c2c9ef674593779d3349d2a44001699d0
GET /ftl/commonPage/js/gui-base.js HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Content-Length: 15779
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-04
ETag: W/"64ddbaed-ee5c"
Date: Thu, 28 Sep 2023 08:02:48 GMT
Last-Modified: Thu, 17 Aug 2023 06:15:09 GMT
Expires: Sat, 28 Oct 2023 08:02:48 GMT
Age: 1287249
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-04, HIT from KS-CLOUD-XG-03-12
X-Cdn-Request-ID: e4d568dfade45d24f75c4570db1a6a09
3dsa62.gaokejd.xyz/ftl/commonPage/js/bootstrap-dialog.min.js
200 OK 5.0 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/commonPage/js/bootstrap-dialog.min.js
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type ASCII text, with very long lines (20132), with no line terminators
Hash 5ce8851dc823429a42ab6147554403cc
28f381f0e0aa4f5d56690e65723bd97fb59a38e6
dd1edf5e54071903c4c1e81e33636444899d645df6b18bad22249da07f91c811
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/commonPage/js/bootstrap-dialog.min.js HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Content-Length: 5007
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-02
ETag: W/"5d848f4f-4ea4"
Date: Thu, 28 Sep 2023 08:02:49 GMT
Last-Modified: Fri, 20 Sep 2019 08:35:27 GMT
Expires: Sat, 28 Oct 2023 08:02:49 GMT
Age: 1287248
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-02, HIT from KS-CLOUD-XG-FOREIGN-03-07
X-Cdn-Request-ID: 96a6c5eba767a81454b38918eb6aee28
3dsa62.gaokejd.xyz/ftl/commonPage/js/layer.js
200 OK 7.6 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/commonPage/js/layer.js
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (21922)
Hash c42797aecccd5494e2b747cedf1a890b
b9e06a6d245b6a3c87f2753db0c9c9aa020640b2
56feab66e10b4718de666fc63941b4f36a5e553e8887d663e137e635add8beb3
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/commonPage/js/layer.js HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Content-Length: 7599
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-03
ETag: W/"5d848f4f-55f6"
Date: Thu, 28 Sep 2023 08:02:48 GMT
Last-Modified: Fri, 20 Sep 2019 08:35:27 GMT
Expires: Sat, 28 Oct 2023 08:02:48 GMT
Age: 1287249
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-03, HIT from KS-CLOUD-XG-03-02
X-Cdn-Request-ID: 2de6d2d777114202f93467c7713ddc1e
3dsa62.gaokejd.xyz/ftl/commonPage/js/jquery/jquery.super-marquee.js
200 OK 1.4 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/commonPage/js/jquery/jquery.super-marquee.js
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type ASCII text, with very long lines (4433), with no line terminators
Hash f77d83590bc0a69298f2fbcc5d9911cd
1d6aa25d7052f53ad0181385e5efe72f224bbdb9
1d042b9441e860ddcc01b9e9e5e8d354121ee0e31b47f6e18a321e2e633d22e7
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/commonPage/js/jquery/jquery.super-marquee.js HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Content-Length: 1421
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-06
ETag: W/"5d848f4f-1151"
Date: Thu, 28 Sep 2023 08:02:49 GMT
Last-Modified: Fri, 20 Sep 2019 08:35:27 GMT
Expires: Sat, 28 Oct 2023 08:02:49 GMT
Age: 1287248
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-06, HIT from KS-CLOUD-XG-FOREIGN-03-10
X-Cdn-Request-ID: c7748f7204c2945141b94fa5407eb0b3
3dsa62.gaokejd.xyz/ftl/commonPage/js/jquery/jquery.nicescroll.min.js
200 OK 17 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/commonPage/js/jquery/jquery.nicescroll.min.js
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type ASCII text, with very long lines (64577)
Hash b5bc8cd626b389bde727a91e6ce79436
3df6c39300ac286cf596b3bda273cb39ff825429
a1eb48eeb3b3f2ba41940d3041464f0b386b7a7c4a8acb42f3017e691f4b116e
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/commonPage/js/jquery/jquery.nicescroll.min.js HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Content-Length: 17446
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-02
ETag: W/"5d848f4f-fc8b"
Date: Thu, 28 Sep 2023 08:02:49 GMT
Last-Modified: Fri, 20 Sep 2019 08:35:27 GMT
Expires: Sat, 28 Oct 2023 08:02:49 GMT
Age: 1287248
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding, Accept-Encoding
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
Content-Encoding: gzip
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-02, HIT from KS-CLOUD-XG-03-03
X-Cdn-Request-ID: b02ade07a1eddf5e90ba0239f99a7462
3dsa62.gaokejd.xyz/061410/rcenter/common/js/jquery/plugins/jquery.validate/jquery.validate.js
200 OK 7.7 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/061410/rcenter/common/js/jquery/plugins/jquery.validate/jquery.validate.js
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (27669)
Hash f8c2b37c1dc626eede6a2e3e37aa4504
d4e8419497caa64c8a850ac4808dddb89b5eeb3f
728d63b799ab3d9bee5e987ad13f71aeb9d30ff78ed552c7edc425531c9c0f2a
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /061410/rcenter/common/js/jquery/plugins/jquery.validate/jquery.validate.js HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Content-Length: 7746
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-05
ETag: W/"650aa3e4-6caf"
Date: Thu, 28 Sep 2023 08:04:56 GMT
Last-Modified: Wed, 20 Sep 2023 07:48:52 GMT
Expires: Sat, 28 Oct 2023 08:04:56 GMT
Age: 1287121
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-204
x-link-via: xg03:443;xg12:80;
X-Cache-Status: HIT from KS-CLOUD-XG-FOREIGN-12-05, HIT from KS-CLOUD-XG-03-13
X-Cdn-Request-ID: 5d2ace86496dbfda855f14d36662d1bf
3dsa62.gaokejd.xyz/061410/rcenter/common/js/gamebox/common/jquery.validate.extend.msites.js
200 OK 4.1 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/061410/rcenter/common/js/gamebox/common/jquery.validate.extend.msites.js
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (14855), with no line terminators
Hash 4fe7dadf050dad2dcfd386d21b880281
07e7feb8dc9309fe66d86d7a9e27f8efd32ab0bd
aa891aafe8e98e1e15d81b2b116e6c3808d0bbbec56cd24818e2e7ac911877c9
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /061410/rcenter/common/js/gamebox/common/jquery.validate.extend.msites.js HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Content-Length: 4126
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-05
ETag: W/"650aa3e4-3a09"
Date: Thu, 28 Sep 2023 08:04:55 GMT
Last-Modified: Wed, 20 Sep 2023 07:48:52 GMT
Expires: Sat, 28 Oct 2023 08:04:55 GMT
Age: 1287122
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: HIT from KS-CLOUD-XG-FOREIGN-12-05, HIT from KS-CLOUD-XG-FOREIGN-03-08
X-Cdn-Request-ID: a649fa45da4e0f74e090ad129fc42714
3dsa62.gaokejd.xyz/ftl/commonPage/themes/hb/css/pc.css
200 OK 911 B URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/commonPage/themes/hb/css/pc.css
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
Hash 1da71520b7a0a61526a8fa8d0feb40d1
ba1bf69dad8783563328054cae58ccabf1b00829
5eb4d895bcb33061cda238c8ff4985ede69a866819b980c732cf3802ec101e8d
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/commonPage/themes/hb/css/pc.css HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/css
Content-Length: 911
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-05
ETag: W/"5d848f4f-b5d"
Date: Thu, 28 Sep 2023 08:02:49 GMT
Last-Modified: Fri, 20 Sep 2019 08:35:27 GMT
Expires: Sat, 28 Oct 2023 08:02:49 GMT
Age: 1287248
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-05, HIT from KS-CLOUD-XG-FOREIGN-03-10
X-Cdn-Request-ID: da61bd4e3ccf96db5da4dc26d05e20a1
3dsa62.gaokejd.xyz/ftl/commonPage/js/moment.js
200 OK 27 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/commonPage/js/moment.js
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type Algol 68 source text\012- Pascal source, Unicode text, UTF-8 text
Hash 36c8f828395a9395549bd6e7307cb7e9
f30a4961558e2d3d4405e7d93aa28fdb63245e78
5d5e32fa1e06a0bc9396f349d142ad248e82086543e438c890e43f41e692db33
GET /ftl/commonPage/js/moment.js HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Content-Length: 26968
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-01
ETag: W/"64b633ca-1cab9"
Date: Thu, 28 Sep 2023 08:02:49 GMT
Last-Modified: Tue, 18 Jul 2023 06:40:10 GMT
Expires: Sat, 28 Oct 2023 08:02:49 GMT
Age: 1287248
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-01, HIT from KS-CLOUD-XG-FOREIGN-03-07
X-Cdn-Request-ID: 58a34bb50173c7ffd4c6d1242d5289dd
3dsa62.gaokejd.xyz/ftl/commonPage/js/theme/default/layer.css?v=3.1.0
200 OK 3.1 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/commonPage/js/theme/default/layer.css?v=3.1.0
IP
ASN #138915 Kaopu Cloud HK Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
Hash 5cf9259b7dd27aacd46161ec23d261cf
ba0c399616a5ae9cdd8aec5b76ba4aae4822367c
7f73a66b3a9a38576d124b6243a8984d795028e3493b8fa3f688d8dbe10cbccc
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/commonPage/js/theme/default/layer.css?v=3.1.0 HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/css
Content-Length: 3111
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-05
ETag: W/"6131d862-48e4"
Date: Thu, 28 Sep 2023 08:02:49 GMT
Last-Modified: Fri, 03 Sep 2021 08:10:10 GMT
Expires: Sat, 28 Oct 2023 08:02:49 GMT
Age: 1287248
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-204
x-link-via: xg21:443;xg12:80;
X-Cache-Status: HIT from KS-CLOUD-XG-FOREIGN-12-05, HIT from KS-CLOUD-XG-FOREIGN-21-03
X-Cdn-Request-ID: 55148d51b51e12761e5f684d39ec31a1
3dsa62.gaokejd.xyz/061410/rcenter/common/static/js/gb.validation.min.js?v=1697017525275
200 OK 5.2 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/061410/rcenter/common/static/js/gb.validation.min.js?v=1697017525275
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (801)
Hash 30be40425b37bee4158676082cef1f4d
b41ed46721936872d5d7eadf303ce22938240d2a
f5ca5f543161a6b37ca2bf26c4f3c630fe08323108c77dac1fba6ce755ce6f47
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /061410/rcenter/common/static/js/gb.validation.min.js?v=1697017525275 HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Content-Length: 5207
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-01
ETag: W/"633d510e-7fd7"
Date: Thu, 28 Sep 2023 08:04:55 GMT
Last-Modified: Wed, 05 Oct 2022 09:40:30 GMT
Expires: Sat, 28 Oct 2023 08:04:55 GMT
Age: 1287122
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-204
x-link-via: xg03:443;xg12:80;
X-Cache-Status: HIT from KS-CLOUD-XG-FOREIGN-12-01, HIT from KS-CLOUD-XG-03-03
X-Cdn-Request-ID: feff578dc507b21074f101091b64ed97
3dsa62.gaokejd.xyz/061410/rcenter/common/static/css/gb.validation.min.css
200 OK 3.8 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/061410/rcenter/common/static/css/gb.validation.min.css
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (2295)
Hash f00ce0554efc5adea6a8e02d5e501cad
388840e376568b37ac0103aa5c87a268778db67a
3043f42fdd97ec607648da79c3abfa6f364404c7594143227c2541d1f0ac6069
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /061410/rcenter/common/static/css/gb.validation.min.css HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/css
Content-Length: 3788
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-02
ETag: W/"633d510e-2d52"
Date: Thu, 28 Sep 2023 08:05:20 GMT
Last-Modified: Wed, 05 Oct 2022 09:40:30 GMT
Expires: Sat, 28 Oct 2023 08:05:20 GMT
Age: 1287097
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-204
x-link-via: xg03:443;xg12:80;
X-Cache-Status: HIT from KS-CLOUD-XG-FOREIGN-12-02, HIT from KS-CLOUD-XG-03-13
X-Cdn-Request-ID: 1c9500e3eae09a031a48b2335666999d
3dsa62.gaokejd.xyz/ftl/bet365-141-2/plugin/js/swiper-4.3.3.min.js
200 OK 32 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/bet365-141-2/plugin/js/swiper-4.3.3.min.js
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type ASCII text, with very long lines (65275)
Hash 317fd00903b68a157500b40495e8d74e
29ba73703d5c1d5390551e9fb230a3f1ace1437e
efac6fec2ba437b6a906e249fad9de3c7d3c105a48136b0155376b5989c4d76a
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/bet365-141-2/plugin/js/swiper-4.3.3.min.js HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
Content-Length: 31739
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-01
ETag: W/"614d2b23-1df6f"
Date: Thu, 28 Sep 2023 08:02:48 GMT
Last-Modified: Fri, 24 Sep 2021 01:34:27 GMT
Expires: Sat, 28 Oct 2023 08:02:48 GMT
Age: 1287250
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-01, HIT from KS-CLOUD-XG-03-02
X-Cdn-Request-ID: f4cfdd51bb30a8134793577163c62ce5
www.36596666.net:8989/ftl/bet365-141-2/themes/images/hot.gif
200 OK 1.3 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/bet365-141-2/themes/images/hot.gif
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type GIF image data, version 89a, 16 x 21\012- data
Hash 98b6e28b9ec42fb2cfeeb767adf534b0
ec30e424f3b775ad1d9b80e8947a4646ee8c5af9
06011ce85e775ecfeda87eaca9ee6ac75cb9522cefe71448d8b04adc81bd9f67
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/bet365-141-2/themes/images/hot.gif HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Cookie: sticket=l1TVRVME9tTmhNV00
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:36:58 GMT
Content-Type: image/gif
Content-Length: 1265
Connection: keep-alive
Last-Modified: Mon, 15 Jul 2019 12:48:03 GMT
ETag: "5d2c7603-4f1"
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:36:58 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/mobile-api/v5/origin/getFloat.html
200 950 B URL POST HTTP/1.1 www.36596666.net:8989/mobile-api/v5/origin/getFloat.html
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type JSON data\012- , Unicode text, UTF-8 text, with very long lines (942), with no line terminators
Hash fc43c0947406c939a204ca54fa40bb23
768a285fafa9529639410efb7ad938f7dfe5edea
8f0fe0d59bc60634968d1e9fd4a1110f960a38d4ca77c29527a3135ad40d2927
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
POST /mobile-api/v5/origin/getFloat.html HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 68
Origin: https://www.36596666.net:8989
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Cookie: sticket=l1TVRVME9tTmhNV00
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Date: Fri, 13 Oct 2023 05:36:58 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 950
Connection: keep-alive
Set-Cookie: route=21c20bedba26b78ebec8dc5df8d96c86; Path=/
Access-Control-Allow-Origin: https://www.36596666.net:8989
Access-Control-Allow-Methods: *
Access-Control-Max-Age: 3600
Access-Control-Allow-Headers: Content-Type,Access-Token,X-Requested-With
Content-Disposition: inline;filename=f.txt
sub-sys: mobile
X-Frame-Options: SAMEORIGIN
uuid: 00141-02-00000000-169717541863de
out-line: gb-site-097
3dsa62.gaokejd.xyz/ftl/commonPage/zh_CN/mobileTopic/images/special_3.jpg
200 OK 6.9 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/commonPage/zh_CN/mobileTopic/images/special_3.jpg
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 168x168, components 3\012- data
Hash 99be4bfe275809d4e436b77c991b1381
54eadee77394eb62ccf377ae68d9f49acb5b6785
4ca35131972acdf420b94f0d64a5a0f504eb5a7b0e6fb7b8b467916a12aae37d
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/commonPage/zh_CN/mobileTopic/images/special_3.jpg HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 6871
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-04
ETag: "5d848f4f-1ad7"
Date: Thu, 28 Sep 2023 08:02:48 GMT
Last-Modified: Fri, 20 Sep 2019 08:35:27 GMT
Expires: Sat, 28 Oct 2023 08:02:48 GMT
Age: 1287250
Cache-Control: max-age=86400
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-04, HIT from KS-CLOUD-XG-03-12
X-Cdn-Request-ID: e1a1c070161cdb0f46ef82ca5fc6fd45
www.36596666.net:8989/index/getAppsUrl.html?device=android
200 912 B URL GET HTTP/1.1 www.36596666.net:8989/index/getAppsUrl.html?device=android
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type JSON data\012- , ASCII text, with very long lines (1148), with no line terminators
Hash c930d783f9b05a4d54c92571e863bd41
c0bded6c75eb3b15d0a6440f63e8ebc1b66b0b2e
b18bb6ed9b7a85629d316973a7dacc6ba1d3e27a890d041a8dcb25f2e0caf9c3
GET /index/getAppsUrl.html?device=android HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Cookie: sticket=l1TVRVME9tTmhNV00
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Date: Fri, 13 Oct 2023 05:36:59 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Set-Cookie: route=4dc7dfeabaa1977335671c9d813ff1f9; Path=/
Content-Disposition: inline;filename=f.txt
sub-sys: msite
Content-Encoding: gzip
X-Frame-Options: SAMEORIGIN
uuid: 00141-02-00000000-1697175419994b
out-line: gb-site-097
ocsp.r2m03.amazontrust.com/
471 B URL ocsp.r2m03.amazontrust.com/
IP
Hash 2689c7e883e05c60d55723d37d84d26d
10dcd2c09a2827aeace4382b5608e383313c72ee
967906b84b12260ee40bf9bb6de5aaea24ea80760f1e778b0a15ab9267a522fd
POST / HTTP/1.1
Host: ocsp.r2m03.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Cache-Control: max-age=7200
Date: Fri, 13 Oct 2023 05:36:59 GMT
Server: ECAcc (amb/6AA6)
X-Cache: Miss from cloudfront
Via: 1.1 bcd5dadccb0831729969c938747ff79a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: V2SXhx4TCqQi1OBPyy7CzJzB2J14qurFDHxC9PAixegW44Vrwi2Lnw==
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_10_30593.png
200 OK 87 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_10_30593.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit/color RGBA, non-interlaced\012- data
Hash c851a15f25d8a0c556c7a56b75aebf6f
90dd4c3169383ee12aea9e93ce8fdfb6f3146f51
655efce4a9020abae7117b5e296b181b1ffbd3f9b9dece49f1e547cf6b9396b3
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_10_30593.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:36:58 GMT
Content-Type: image/png
Content-Length: 86675
Connection: keep-alive
Last-Modified: Wed, 06 Oct 2021 05:11:57 GMT
ETag: "615d301d-15293"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:36:58 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_35_1051.png
200 OK 23 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_35_1051.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash c2bad36f7d90b3d9d5077df183c0a80b
7890000fd16f911c2aa5223af3cddf3ed6c5f702
90b7d091ece32c042a2866eb7d6943d7e88148d3bb474eaff988a78942d6d3aa
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_35_1051.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:36:59 GMT
Content-Type: image/png
Content-Length: 23172
Connection: keep-alive
Last-Modified: Mon, 15 Jul 2019 12:48:11 GMT
ETag: "5d2c760b-5a84"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:36:59 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_48_GO02.png
200 OK 22 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_48_GO02.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash 12f4870c1a8e51e39a6c8bfdd11ed804
47eb5ed8af8ae69595b8743e7a61d3fe825cc048
1f6c135cc810d561e52ad5ba9ca5cfda82897c82db0863ab366e62d5970b3883
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_48_GO02.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:36:59 GMT
Content-Type: image/png
Content-Length: 21953
Connection: keep-alive
Last-Modified: Thu, 23 Dec 2021 07:42:29 GMT
ETag: "61c42865-55c1"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:36:59 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/index/getUserTimeZoneDate.html?t=lno6fb5f
200 119 B URL GET HTTP/1.1 www.36596666.net:8989/index/getUserTimeZoneDate.html?t=lno6fb5f
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type JSON data\012- , ASCII text, with no line terminators
Hash c2d0f72cbd0416fb6cc5d5a1b20121e6
30312b333280fdaa357d7f4016e507075b07e59d
ec8e89a9f6d186939b221b3694c3fc17fa44bc1c5d5a3105e8441bddc261e2e7
GET /index/getUserTimeZoneDate.html?t=lno6fb5f HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Cookie: sticket=l1TVRVME9tTmhNV00; route=4dc7dfeabaa1977335671c9d813ff1f9
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Date: Fri, 13 Oct 2023 05:36:59 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 119
Connection: keep-alive
Content-Disposition: inline;filename=f.txt
sub-sys: msite
cachettl: 3
X-Frame-Options: SAMEORIGIN
uuid: 00141-02-00000000-1697175419aa04
out-line: gb-site-097
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_10_30594.png
200 OK 25 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_10_30594.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash 7b497cfccdf85cf3a934c4d61e80d55a
2ed0898ac3b002f53b99dd5b059509098078295e
210370587be2eff0fbd4e3f29dd8114da568e50ef60f94912bd6b37eb657be72
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_10_30594.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:36:59 GMT
Content-Type: image/png
Content-Length: 24721
Connection: keep-alive
Last-Modified: Mon, 04 Jul 2022 02:26:45 GMT
ETag: "62c24fe5-6091"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:36:59 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_35_1050.png
200 OK 22 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_35_1050.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash 0445397f922bcef3252bedd6877d8668
f4d265e0774ed0dbda4d4548863cd852c48c570f
3069757649a24fe38937eebf84c12b959ec4e58edf10cf2c661cc2ae433a40c0
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_35_1050.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:36:59 GMT
Content-Type: image/png
Content-Length: 21792
Connection: keep-alive
Last-Modified: Sat, 11 Sep 2021 09:11:25 GMT
ETag: "613c72bd-5520"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:36:59 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_48_CC1001.png
200 OK 21 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_48_CC1001.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash 07db342d71e455736e0e8b5656ed7174
2d9bb7427a73a28f4bfec2a70dc227af4555968c
c1a35508763b061947ad0ea9eb9972b92b079c9510a2a746979dbffd84efde0f
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_48_CC1001.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:36:59 GMT
Content-Type: image/png
Content-Length: 20993
Connection: keep-alive
Last-Modified: Wed, 30 Mar 2022 02:50:04 GMT
ETag: "6243c55c-5201"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:36:59 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_25_F-SF01.png
200 OK 23 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_25_F-SF01.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash 2fbcb4a692fc6b41699f7e60ecf26a63
da35d134b38413040316f5cf1e5f76d75fd941c7
ccdecdf7de01b3b3513596f7c4555266473805551702685e14299770ae8bed26
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_25_F-SF01.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:36:59 GMT
Content-Type: image/png
Content-Length: 22679
Connection: keep-alive
Last-Modified: Mon, 15 Jul 2019 12:48:11 GMT
ETag: "5d2c760b-5897"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:36:59 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
3dsa62.gaokejd.xyz/fserver/files/gb/141/carousel/10315/1659084673947.png?wsSecret=88578b3f517e665502cc945e433e10ed&wsTime=1697175419
200 OK 107 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/fserver/files/gb/141/carousel/10315/1659084673947.png?wsSecret=88578b3f517e665502cc945e433e10ed&wsTime=1697175419
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type PNG image data, 850 x 214, 8-bit colormap, non-interlaced\012- data
Size 107 kB (106746 bytes)
Hash e575f7f68ace5718a733ce9a735dba27
2a2aff13696be1b051eb7c78e7153db8c1ecaea4
144dfdb1a20d96a0eeef856bcacb63396dce907b5291196a2ea89f3b96543544
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /fserver/files/gb/141/carousel/10315/1659084673947.png?wsSecret=88578b3f517e665502cc945e433e10ed&wsTime=1697175419 HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 106746
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-04
ETag: "6379d708-1a0fa"
Date: Thu, 28 Sep 2023 08:09:30 GMT
Last-Modified: Sun, 20 Nov 2022 07:28:08 GMT
Expires: Sat, 28 Oct 2023 08:09:30 GMT
Age: 1286849
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: MISS
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: HIT from KS-CLOUD-XG-FOREIGN-12-04, HIT from KS-CLOUD-XG-03-14
X-Cdn-Request-ID: 38e2aa095270f81c1d76326584449f30
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_49_14.png
200 OK 20 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_49_14.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash 86f136869bc81df2a646e873bd23b46d
c40c25bbe820c39731d1c679653b28e119cbbadc
bfebb7307f1858837e6b61be64e46352b1ccd29bf982e9975886c9feda9f637f
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_49_14.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:36:59 GMT
Content-Type: image/png
Content-Length: 20462
Connection: keep-alive
Last-Modified: Fri, 03 Feb 2023 02:46:55 GMT
ETag: "63dc759f-4fee"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:36:59 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/headerInfo.html?t=lno6fbev
200 118 B URL GET HTTP/1.1 www.36596666.net:8989/headerInfo.html?t=lno6fbev
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type JSON data\012- , ASCII text, with no line terminators
Hash 91793cdf4489d1f5082dd9bef18d37be
3f36ecf70f324e29c509ca16e897608e25529025
de31096648d100c41366728451f3b596079061e04037f48cfa33b76b7298ac66
GET /headerInfo.html?t=lno6fbev HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Cookie: sticket=l1TVRVME9tTmhNV00; route=4dc7dfeabaa1977335671c9d813ff1f9
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Date: Fri, 13 Oct 2023 05:36:59 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Disposition: inline;filename=f.txt
sub-sys: msite
Content-Encoding: gzip
X-Frame-Options: SAMEORIGIN
uuid: 00141-02-00000000-1697175419438d
out-line: gb-site-097
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_48_AB3.png
200 OK 77 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_48_AB3.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 249 x 215, 8-bit/color RGBA, non-interlaced\012- data
Hash 4efe93bd780474540b29c662acef4d68
2d588f15315c28feef52d101bff05d5a2071929d
e52983bbd04e43f83dccc17ccff1064098ae925ae651f753e59b1530a0e4d733
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_48_AB3.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:36:59 GMT
Content-Type: image/png
Content-Length: 76813
Connection: keep-alive
Last-Modified: Mon, 14 Aug 2023 10:05:04 GMT
ETag: "64d9fc50-12c0d"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:36:59 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_48_AT05.png
200 OK 23 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_48_AT05.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash 993bbfdbad1c48f514367407a17d2a77
7d3db06be9d7912432c768fa5b23335264db002c
df044589914265a7b02cca67f876c01d20e5eb0d9e50bdb2e8af8e0994daeab7
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_48_AT05.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:36:59 GMT
Content-Type: image/png
Content-Length: 23286
Connection: keep-alive
Last-Modified: Mon, 14 Aug 2023 10:05:04 GMT
ETag: "64d9fc50-5af6"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:36:59 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_48_AT01.png
200 OK 26 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_48_AT01.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash f7637fd9fb8b0dd130560efe9dfcc5ac
c6a6b30f73923175a88fb0c5685c7943ef934c2e
a647abf9fc56228cf6ab783115c113b35479dce89ff1dc4db61efb0bf3234cb4
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_48_AT01.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:36:59 GMT
Content-Type: image/png
Content-Length: 25819
Connection: keep-alive
Last-Modified: Mon, 14 Aug 2023 10:05:04 GMT
ETag: "64d9fc50-64db"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:36:59 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_60_31006.png
200 OK 20 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_60_31006.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash a678f783e25a467193ee4fa0252d5bf4
ffadbf4388ce2dc312c720e75f9b9d73c05e93cd
1421dad09cedb4c186e8b4ac1cc027955d52a9d268b29144d3d8f0d60d5ed075
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_60_31006.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:36:59 GMT
Content-Type: image/png
Content-Length: 19766
Connection: keep-alive
Last-Modified: Wed, 10 May 2023 06:20:23 GMT
ETag: "645b37a7-4d36"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:36:59 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_60_31008.png
200 OK 20 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_60_31008.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash 37070ea9397e4c9bfa4c6fa5e499de59
fd2237d48600d3a6acba5c8982c1d594962418d4
f3d50d3f597d6a23e42d069971e80a14851d7c996bbce674ed591c6e87b64bda
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_60_31008.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:36:59 GMT
Content-Type: image/png
Content-Length: 20172
Connection: keep-alive
Last-Modified: Wed, 10 May 2023 06:20:23 GMT
ETag: "645b37a7-4ecc"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:36:59 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_49_12.png
200 OK 26 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_49_12.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash dc21406f53974241a6ea9d1ba342a0a3
d98181158619aa5993f35dc4821c26ea657c9c35
656f550c68b469776ebe40713d8556d43af391da6cc881918da5f6c983ba823f
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_49_12.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:00 GMT
Content-Type: image/png
Content-Length: 26500
Connection: keep-alive
Last-Modified: Tue, 30 Nov 2021 08:28:44 GMT
ETag: "61a5e0bc-6784"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:00 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_49_10.png
200 OK 22 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_49_10.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash 548f74b6fbacfdafac2d13982ea01f5b
62056e33bd99fdb7a26ed1eb6e0d34baae75ab4b
8d23af5f64406af80c5f00bbe2806c0a696eee1b9fa144135a679cf7d15c27a9
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_49_10.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:00 GMT
Content-Type: image/png
Content-Length: 21502
Connection: keep-alive
Last-Modified: Sat, 11 Sep 2021 09:11:25 GMT
ETag: "613c72bd-53fe"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:00 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_49_11.png
200 OK 20 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_49_11.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash d495fdd61d29ff61ff34fdccc5597d0f
95a2b5b377a239ccf2d5e5cc81534f79dbbbe033
08097b5ebe2de4f6d295aeb64fc72170c766ea81851e9baf96ff4de926fc678b
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_49_11.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:00 GMT
Content-Type: image/png
Content-Length: 19964
Connection: keep-alive
Last-Modified: Sat, 11 Sep 2021 09:11:25 GMT
ETag: "613c72bd-4dfc"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:00 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/mobile-api/v5/origin/loginSwitchCheck.html
200 174 B URL GET HTTP/1.1 www.36596666.net:8989/mobile-api/v5/origin/loginSwitchCheck.html
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type JSON data\012- , Unicode text, UTF-8 text, with no line terminators
Hash 1452cebf3e2bb129b06762f43f09e5c8
0ec65f1e79233e8c59f76c55fb89ac8637cfb070
99a31cd18b8ce37d3725d0a77d5e314452d2906ed2b54b8b19d4de849d1bf13d
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /mobile-api/v5/origin/loginSwitchCheck.html HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Cookie: sticket=l1TVRVME9tTmhNV00; route=4dc7dfeabaa1977335671c9d813ff1f9
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Date: Fri, 13 Oct 2023 05:37:00 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 174
Connection: keep-alive
Set-Cookie: route=608b49d6269bc6506d42172c4da4c169; Path=/
Access-Control-Allow-Methods: *
Access-Control-Max-Age: 3600
Access-Control-Allow-Headers: Content-Type,Access-Token,X-Requested-With
Content-Disposition: inline;filename=f.txt
sub-sys: mobile
X-Frame-Options: SAMEORIGIN
uuid: 00141-02-00000000-16971754209a81
out-line: gb-site-097
www.36596666.net:8989/mobile-api/v5/chess/getActivityMsg.html?function=sign
200 140 B URL GET HTTP/1.1 www.36596666.net:8989/mobile-api/v5/chess/getActivityMsg.html?function=sign
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type JSON data\012- , Unicode text, UTF-8 text, with no line terminators
Hash 5d062bc93ef9d75b27e852ed745d170f
1ecf82a0589608b26ee6a29b2cc3229916596626
26e77aa8c61c230db13c8fd74d4ab3adf8be54c3192c4e16f94e633a71efc2e1
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /mobile-api/v5/chess/getActivityMsg.html?function=sign HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Cookie: sticket=l1TVRVME9tTmhNV00; route=4dc7dfeabaa1977335671c9d813ff1f9
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Date: Fri, 13 Oct 2023 05:37:00 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 140
Connection: keep-alive
Set-Cookie: route=608b49d6269bc6506d42172c4da4c169; Path=/
Access-Control-Allow-Methods: *
Access-Control-Max-Age: 3600
Access-Control-Allow-Headers: Content-Type,Access-Token,X-Requested-With
Content-Disposition: inline;filename=f.txt
sub-sys: mobile
X-Frame-Options: SAMEORIGIN
uuid: 00141-02-00000000-1697175420fb50
out-line: gb-site-097
www.36596666.net:8989/index/getUserTimeZoneDate.html?t=lno6fbpr
200 119 B URL GET HTTP/1.1 www.36596666.net:8989/index/getUserTimeZoneDate.html?t=lno6fbpr
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type JSON data\012- , ASCII text, with no line terminators
Hash 50490e2e434def7be7e6ee6b8a02ac57
c4d0ea090efe16716354563eabfe6f8d6125e1e4
f106ba34b2f42cfd1f5e0b380dfbbd7ccbaac6f8e24172886eefcba8018f43b2
GET /index/getUserTimeZoneDate.html?t=lno6fbpr HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Cookie: sticket=l1TVRVME9tTmhNV00; route=4dc7dfeabaa1977335671c9d813ff1f9
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Date: Fri, 13 Oct 2023 05:37:00 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 119
Connection: keep-alive
Content-Disposition: inline;filename=f.txt
sub-sys: msite
cachettl: 3
X-Frame-Options: SAMEORIGIN
uuid: 00141-02-00000000-1697175420e915
out-line: gb-site-097
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_65_5002.png
200 OK 21 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_65_5002.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash d73cf218f18362d0a89cb36a4a3303ff
57bf03bb562ca33343b19db1fe5e872335cc1cb2
691d5caeb173c0c0817111fea711d2685d1e0e4e7e19f6aa7282fc525193f40c
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_65_5002.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:00 GMT
Content-Type: image/png
Content-Length: 21363
Connection: keep-alive
Last-Modified: Fri, 11 Feb 2022 05:28:08 GMT
ETag: "6205f3e8-5373"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:00 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_60_7006.png
200 OK 20 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_60_7006.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash 7facd57d474585a0c9e3b2b6d4762969
814362f72beba19c7dfb93b8d2bc760f87a2a00e
3bf01b8e569dbd7060d7dcb2222e7e3ebc9e42f715535df2315c877fed9046bd
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_60_7006.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:00 GMT
Content-Type: image/png
Content-Length: 20484
Connection: keep-alive
Last-Modified: Sat, 11 Sep 2021 09:11:25 GMT
ETag: "613c72bd-5004"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:00 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/mobile-api/v5/origin/getThirdParam.html
200 103 B URL GET HTTP/1.1 www.36596666.net:8989/mobile-api/v5/origin/getThirdParam.html
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type JSON data\012- , Unicode text, UTF-8 text, with no line terminators
Hash 9ac55fe189e4f53f37156e563e0f542e
18b13b1360ce9fbd973e046d2652be38d58a15e0
d7e02321006e1520d4c3e8d26428462419388e022cc89f3c974d0b87ad83af7b
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /mobile-api/v5/origin/getThirdParam.html HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Cookie: sticket=l1TVRVME9tTmhNV00; route=608b49d6269bc6506d42172c4da4c169
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Date: Fri, 13 Oct 2023 05:37:00 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 103
Connection: keep-alive
Access-Control-Allow-Methods: *
Access-Control-Max-Age: 3600
Access-Control-Allow-Headers: Content-Type,Access-Token,X-Requested-With
Content-Disposition: inline;filename=f.txt
sub-sys: mobile
X-Frame-Options: SAMEORIGIN
uuid: 00141-02-00000000-16971754206088
out-line: gb-site-097
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_49_13.png
200 OK 26 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_49_13.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash 1ac91d4dfd52f26f9c5682cf67ac3f49
6ca58050b81ce1be80d3b0c749b60a79d8413b98
021c28d7d369afa39f3aeac128f91dd3f377fc910a35d76a2e9d2463093e3b44
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_49_13.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:00 GMT
Content-Type: image/png
Content-Length: 26179
Connection: keep-alive
Last-Modified: Mon, 25 Apr 2022 07:55:46 GMT
ETag: "62665402-6643"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:00 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
3dsa62.gaokejd.xyz/ftl/commonPage/themes/images/layer-dialog/gui-layer-close-bg.png
200 OK 1.3 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/commonPage/themes/images/layer-dialog/gui-layer-close-bg.png
IP
ASN #138915 Kaopu Cloud HK Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type PNG image data, 34 x 34, 8-bit/color RGBA, non-interlaced\012- data
Hash a2e938202c0287b9c82461a6fd94dee9
b5e2adc7cb07c18a70a88af314e56b946ec1a1b6
df9ce20db277ad8302c704a73aff5024683a0d38aff0d3e7e884a67a24439936
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/commonPage/themes/images/layer-dialog/gui-layer-close-bg.png HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://3dsa62.gaokejd.xyz/ftl/commonPage/themes/gui-layer.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 1321
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-02
ETag: "5d848f4f-529"
Date: Thu, 28 Sep 2023 08:06:23 GMT
Last-Modified: Fri, 20 Sep 2019 08:35:27 GMT
Expires: Sat, 28 Oct 2023 08:06:23 GMT
Age: 1287037
Cache-Control: max-age=86400
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg21:443;xg12:80;
X-Cache-Status: HIT from KS-CLOUD-XG-FOREIGN-12-02, HIT from KS-CLOUD-XG-FOREIGN-21-11
X-Cdn-Request-ID: 634af11affa0a56b04ad0b74d77a3fe3
www.36596666.net:8989/game-api/v5/content/sportRecommended.html?t=lno6fbzb
200 732 B URL GET HTTP/1.1 www.36596666.net:8989/game-api/v5/content/sportRecommended.html?t=lno6fbzb
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type JSON data\012- , Unicode text, UTF-8 text, with very long lines (3769), with no line terminators
Hash d524b99347deb8ee38f6a381f8efeee2
fdbc54a589e453d6607c66a77cccb2fae4443afc
be9b5768116994f076c9fa23dd69e9d76e069df487be04604c057e4eabe42652
GET /game-api/v5/content/sportRecommended.html?t=lno6fbzb HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Cookie: sticket=l1TVRVME9tTmhNV00; route=608b49d6269bc6506d42172c4da4c169
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Date: Fri, 13 Oct 2023 05:37:00 GMT
Content-Type: text/html;charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Set-Cookie: route=6fc16a063046d21fc2e5f5c026f90787; Path=/
Content-Disposition: inline;filename=f.txt
sub-sys: mobile
Content-Encoding: gzip
X-Frame-Options: SAMEORIGIN
uuid: 00141-02-00000000-16971754206a88
out-line: gb-site-097
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_65_5007.png
200 OK 22 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_65_5007.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash feaff8384a2780bf50a660b657928245
eb492cee9a7d13b8114aa1c75c6db75742d7ef4a
ec33d957ba07daa21a098bc096b1c643ae64420e1924f0691b6b75fd4e8707f2
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_65_5007.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:00 GMT
Content-Type: image/png
Content-Length: 21877
Connection: keep-alive
Last-Modified: Fri, 09 Aug 2019 09:47:47 GMT
ETag: "5d4d4143-5575"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:00 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
3dsa62.gaokejd.xyz/ftl/bet365-141-2/themes/images/body-bg.gif?wsSecret=8a83820fff599b84f134cbfc7d8f2d22&wsTime=1697175419
200 OK 758 B URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/bet365-141-2/themes/images/body-bg.gif?wsSecret=8a83820fff599b84f134cbfc7d8f2d22&wsTime=1697175419
IP
ASN #138915 Kaopu Cloud HK Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type GIF image data, version 89a, 1 x 500\012- data
Hash 41a9eebb99ba7c3b2a905aaa45726923
abf17115c33bdea05313ce6bcebe3fe4d7da935a
f9b50670a93fcef81c4f838f7da60d397994bea07f83af0f51ae89d670f1189c
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/bet365-141-2/themes/images/body-bg.gif?wsSecret=8a83820fff599b84f134cbfc7d8f2d22&wsTime=1697175419 HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: image/gif
Content-Length: 758
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-04
ETag: "5d2c7603-2f6"
Date: Thu, 28 Sep 2023 08:02:50 GMT
Last-Modified: Mon, 15 Jul 2019 12:48:03 GMT
Expires: Sat, 28 Oct 2023 08:02:50 GMT
Age: 1287250
Cache-Control: max-age=86400
Accept-Ranges: bytes
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg21:443;xg12:80;
X-Cache-Status: HIT from KS-CLOUD-XG-FOREIGN-12-04, HIT from KS-CLOUD-XG-FOREIGN-21-04
X-Cdn-Request-ID: edb2e067f20d20e9ecf75adcaedb9523
3dsa62.gaokejd.xyz/ftl/bet365-141-2/themes/images//sec-nav-bg-grad.gif?wsSecret=a1f3646580480c9211b8fc2c36b3dc51&wsTime=1697175419
200 OK 376 B URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/bet365-141-2/themes/images//sec-nav-bg-grad.gif?wsSecret=a1f3646580480c9211b8fc2c36b3dc51&wsTime=1697175419
IP
ASN #138915 Kaopu Cloud HK Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type GIF image data, version 89a, 1 x 594\012- data
Hash 355b2cb853d78ae262c093065eaa6e70
3e8d2a456204e635cfe5bd959cff47faf63023fc
cd58d657e3d79583a5722257d8770e3b5f620f1d58e392f1d9460cc89ac485fa
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/bet365-141-2/themes/images//sec-nav-bg-grad.gif?wsSecret=a1f3646580480c9211b8fc2c36b3dc51&wsTime=1697175419 HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: image/gif
Content-Length: 376
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-03
ETag: "5d2c7603-178"
Date: Thu, 28 Sep 2023 08:02:51 GMT
Last-Modified: Mon, 15 Jul 2019 12:48:03 GMT
Expires: Sat, 28 Oct 2023 08:02:51 GMT
Age: 1287249
Cache-Control: max-age=86400
Accept-Ranges: bytes
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg21:443;xg12:80;
X-Cache-Status: HIT from KS-CLOUD-XG-FOREIGN-12-03, HIT from KS-CLOUD-XG-FOREIGN-21-04
X-Cdn-Request-ID: d553f58e1e5cf4d3d85bd3e190e430c6
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_60_7003.png
200 OK 105 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_60_7003.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit/color RGBA, non-interlaced\012- data
Size 105 kB (105068 bytes)
Hash c421c976cf701cd806a7ebeb8575e0a3
cb84123cde62bcad60f34b5a5703f7bfafca1906
e797e57325c453e7ca7e56e634ada214b51ab9298ba5aea4d183fea859857d60
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_60_7003.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:00 GMT
Content-Type: image/png
Content-Length: 105068
Connection: keep-alive
Last-Modified: Mon, 15 Jul 2019 12:48:11 GMT
ETag: "5d2c760b-19a6c"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:00 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
3dsa62.gaokejd.xyz/ftl/bet365-141-2/images/index-casino.jpg?wsSecret=ff84b1f2a9131d1fd774feb80b2ea01d&wsTime=1697175419
200 OK 12 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/bet365-141-2/images/index-casino.jpg?wsSecret=ff84b1f2a9131d1fd774feb80b2ea01d&wsTime=1697175419
IP
ASN #138915 Kaopu Cloud HK Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 271x81, components 3\012- data
Hash 62f912bb32aecad4ab710243a04a4ba9
f8a22eaaf6dc17329932db9c19484907332ea800
ecc11913678af89246c957fae2eaf6cbb07316f7ad24bdcc3e2b115293e46f60
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/bet365-141-2/images/index-casino.jpg?wsSecret=ff84b1f2a9131d1fd774feb80b2ea01d&wsTime=1697175419 HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 11660
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-05
ETag: "5d2c7603-2d8c"
Date: Thu, 28 Sep 2023 08:02:50 GMT
Last-Modified: Mon, 15 Jul 2019 12:48:03 GMT
Expires: Sat, 28 Oct 2023 08:02:50 GMT
Age: 1287249
Cache-Control: max-age=86400
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: MISS
uuid: -
out-line: gb-cdn-204
x-link-via: xg21:443;xg12:80;
X-Cache-Status: HIT from KS-CLOUD-XG-FOREIGN-12-05, HIT from KS-CLOUD-XG-FOREIGN-21-12
X-Cdn-Request-ID: c1d5900ca278ca77530b2c19293bfc6d
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_60_7004.png
200 OK 102 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_60_7004.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit/color RGBA, non-interlaced\012- data
Size 102 kB (102160 bytes)
Hash 18b9c1ca12b579e3be9de7f0b3d765b7
cabb9ddce1222608668401769754241d2667ac59
81b7527eda1e9db86dc9704173b4e9aa50932eb8c80ea08b23d969899bca9656
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_60_7004.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:00 GMT
Content-Type: image/png
Content-Length: 102160
Connection: keep-alive
Last-Modified: Mon, 15 Jul 2019 12:48:11 GMT
ETag: "5d2c760b-18f10"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:00 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
3dsa62.gaokejd.xyz/fserver/files/gb/141/carousel/10322/1663577476020.png?wsSecret=bc7a168a8c3cb1dcc2d4d901c1617c73&wsTime=1697175419
200 OK 122 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/fserver/files/gb/141/carousel/10322/1663577476020.png?wsSecret=bc7a168a8c3cb1dcc2d4d901c1617c73&wsTime=1697175419
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type PNG image data, 694 x 500, 8-bit colormap, non-interlaced\012- data
Size 122 kB (121611 bytes)
Hash 9b4d417046a78dcf8e12a51376905624
162c19341237baf7d2107461a954e4451321b55f
0bd1ed2e44971103548fd5ba76ecd6a8b8903b011e5715e869989be81e613341
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /fserver/files/gb/141/carousel/10322/1663577476020.png?wsSecret=bc7a168a8c3cb1dcc2d4d901c1617c73&wsTime=1697175419 HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 121611
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-03
ETag: "6379d70d-1db0b"
Date: Thu, 28 Sep 2023 08:09:32 GMT
Last-Modified: Sun, 20 Nov 2022 07:28:13 GMT
Expires: Sat, 28 Oct 2023 08:09:32 GMT
Age: 1286847
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: MISS
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: HIT from KS-CLOUD-XG-FOREIGN-12-03, HIT from KS-CLOUD-XG-FOREIGN-03-10
X-Cdn-Request-ID: ebb438ec4ccfd62febb6f25d63dd264e
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_65_5003.png
200 OK 21 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_65_5003.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash a03861df13ee208fcb22c604bc412484
9d5925012e3eb16bb86bbe0b0febd3941847172d
a9a4c50c7e2f04fcfdf467f4b3a6697a2a359c84000b8e38c1b5e3ab3115ab8d
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_65_5003.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:00 GMT
Content-Type: image/png
Content-Length: 21009
Connection: keep-alive
Last-Modified: Fri, 09 Aug 2019 09:47:47 GMT
ETag: "5d4d4143-5211"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:00 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
3dsa62.gaokejd.xyz/ftl/bet365-141-2/images/index-lottery.jpg?wsSecret=f7508b050b2d13dc04f498359470c9c0&wsTime=1697175419
200 OK 7.9 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/bet365-141-2/images/index-lottery.jpg?wsSecret=f7508b050b2d13dc04f498359470c9c0&wsTime=1697175419
IP
ASN #138915 Kaopu Cloud HK Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 270x81, components 3\012- data
Hash 90dfcd159d726929aa2e8140ac0a43cd
dae58fb59b64ca2922198f64c87762d10dbd161a
cd548d38e7e22e8597da17809e9dd1ee020cfe72288ac55fdb14c9b4130d9e92
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/bet365-141-2/images/index-lottery.jpg?wsSecret=f7508b050b2d13dc04f498359470c9c0&wsTime=1697175419 HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 7926
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-06
ETag: "5d2c7603-1ef6"
Date: Thu, 28 Sep 2023 08:02:50 GMT
Last-Modified: Mon, 15 Jul 2019 12:48:03 GMT
Expires: Sat, 28 Oct 2023 08:02:50 GMT
Age: 1287250
Cache-Control: max-age=86400
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg21:443;xg12:80;
X-Cache-Status: HIT from KS-CLOUD-XG-FOREIGN-12-06, HIT from KS-CLOUD-XG-FOREIGN-21-16
X-Cdn-Request-ID: 3761e78de57e3258a40752f8d69a2928
3dsa62.gaokejd.xyz/ftl/bet365-141-2/images/index-game.jpg?wsSecret=514f095b8a6f90a94e3894feff8e054a&wsTime=1697175419
200 OK 12 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/bet365-141-2/images/index-game.jpg?wsSecret=514f095b8a6f90a94e3894feff8e054a&wsTime=1697175419
IP
ASN #138915 Kaopu Cloud HK Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 271x81, components 3\012- data
Hash 6274335f5e37fb7e3aa19dba05a07ef3
d54c0b0cccf2158aee56d7f1f465d5bb907edf06
39d9bd9e19956bb52c4c880dc6987383c34dc0873aadaa6b3763e3421e06def7
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/bet365-141-2/images/index-game.jpg?wsSecret=514f095b8a6f90a94e3894feff8e054a&wsTime=1697175419 HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 11478
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-01
ETag: "5d2c7603-2cd6"
Date: Thu, 28 Sep 2023 08:02:49 GMT
Last-Modified: Mon, 15 Jul 2019 12:48:03 GMT
Expires: Sat, 28 Oct 2023 08:02:49 GMT
Age: 1287250
Cache-Control: max-age=86400
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg21:443;xg12:80;
X-Cache-Status: HIT from KS-CLOUD-XG-FOREIGN-12-01, HIT from KS-CLOUD-XG-FOREIGN-21-03
X-Cdn-Request-ID: fab468195ea27037e366b3d4c0789dc9
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_65_5004.png
200 OK 23 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_65_5004.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash 20cd47483388f1e46ed9c2304f2c60ea
1c09b695620a64ae94ba7807a41e95733c6211f9
8f091a2a4dd3a918c15d7692aeb343f3d8e8d673541411e74256a48865735448
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_65_5004.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:00 GMT
Content-Type: image/png
Content-Length: 23021
Connection: keep-alive
Last-Modified: Fri, 09 Aug 2019 09:47:47 GMT
ETag: "5d4d4143-59ed"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:00 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_65_5011.png
200 OK 23 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_65_5011.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash 2ae6a25328f92bbd4f06bf83f0d64a34
a182c94addc49f545829566f4f87e7cdf5a2b16a
92d81aa551c89d28170300c1d6ae6e5795e33ac101988de54570fae720fa15c9
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_65_5011.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:00 GMT
Content-Type: image/png
Content-Length: 23076
Connection: keep-alive
Last-Modified: Mon, 15 May 2023 01:55:35 GMT
ETag: "64619117-5a24"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:00 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_65_5001.png
200 OK 20 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_65_5001.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash 45d0f5934f7f664e4fb397fbe69c0bec
72a5c4e823954ec0111709b6aec71c1f0b08fe43
3e9fedb5bbb6caac2dfc16278ba5d0c26483aa3efb5508374eeec9de7b9f9cd4
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_65_5001.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:00 GMT
Content-Type: image/png
Content-Length: 20254
Connection: keep-alive
Last-Modified: Fri, 09 Aug 2019 09:47:47 GMT
ETag: "5d4d4143-4f1e"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:00 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_65_5005.png
200 OK 22 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_65_5005.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash 2acb631ee46633c2bb57645aa0062b24
7ebc60e9519805119574b600d0400278fb02ea7f
c026010b4e9ba86b7dd1670e242e42a1e4fec0547b7fecc3b37feddd0c21d46b
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_65_5005.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:00 GMT
Content-Type: image/png
Content-Length: 21850
Connection: keep-alive
Last-Modified: Fri, 09 Aug 2019 09:47:47 GMT
ETag: "5d4d4143-555a"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:00 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_65_5008.png
404 Not Found 150 B URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_65_5008.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 597ba0d4396e9c906225140ce907092c
28ae2ba65ccdb583d79f85b8cc9509fae697493b
ee1a27178227546d3dcc49e611a6d72e4f1c30080ee4493ae4085b58a49e28e6
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_65_5008.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Fri, 13 Oct 2023 05:37:00 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 150
Connection: keep-alive
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_65_5009.png
404 Not Found 150 B URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_65_5009.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 597ba0d4396e9c906225140ce907092c
28ae2ba65ccdb583d79f85b8cc9509fae697493b
ee1a27178227546d3dcc49e611a6d72e4f1c30080ee4493ae4085b58a49e28e6
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_65_5009.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Fri, 13 Oct 2023 05:37:00 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 150
Connection: keep-alive
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
3dsa62.gaokejd.xyz/ftl/bet365-141-2/themes/images/head1.jpg?wsSecret=953296e5e28c247748c8ddbde7408b58&wsTime=1697175419
200 OK 7.7 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/bet365-141-2/themes/images/head1.jpg?wsSecret=953296e5e28c247748c8ddbde7408b58&wsTime=1697175419
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 960x72, components 3\012- data
Hash 4e7da730a5cbfe4a7ce573ddcea0e60a
ac31a27a6d71a7a297905c195a6434f043f7f0a7
fe5506589506db3c8dad8b544636c2794a764f28a9ab79215714d5cfe2d866c0
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/bet365-141-2/themes/images/head1.jpg?wsSecret=953296e5e28c247748c8ddbde7408b58&wsTime=1697175419 HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 7727
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-01
ETag: "613c72a8-1e2f"
Date: Thu, 28 Sep 2023 08:02:50 GMT
Last-Modified: Sat, 11 Sep 2021 09:11:04 GMT
Expires: Sat, 28 Oct 2023 08:02:50 GMT
Age: 1287250
Cache-Control: max-age=86400
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: MISS
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-01, HIT from KS-CLOUD-XG-FOREIGN-03-11
X-Cdn-Request-ID: bfe735ff1a7ff5beac816e20d6876fa7
www.36596666.net:8989/fserver/files/sportTeam/football/cba19.png
200 OK 27 kB URL GET HTTP/1.1 www.36596666.net:8989/fserver/files/sportTeam/football/cba19.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced\012- data
Hash f0924511f1c27f4a8fdc2d834e9cf5a4
5762317adef2cccd113b9076296006c0eba34e7e
ec78da1aa4c778bf3b19c9ba7ab26acad528675ba8fe427e2bda029f70529996
GET /fserver/files/sportTeam/football/cba19.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Cookie: sticket=l1TVRVME9tTmhNV00; route=6fc16a063046d21fc2e5f5c026f90787; _ga_B5HTXF8BMH=GS1.1.1697175421.1.0.1697175421.0.0.0; _ga=GA1.1.444583028.1697175421
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:01 GMT
Content-Type: image/png
Content-Length: 27081
Connection: keep-alive
Last-Modified: Thu, 06 Dec 2018 10:52:00 GMT
Vary: Accept-Encoding
ETag: "5c08ff50-69c9"
Expires: Sat, 14 Oct 2023 05:37:01 GMT
Cache-Control: max-age=86400
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/fserver/files/sportTeam/football/cba08.png
200 OK 32 kB URL GET HTTP/1.1 www.36596666.net:8989/fserver/files/sportTeam/football/cba08.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced\012- data
Hash b00ff73ab034ceccf202077e5aa17c1a
8c91cc3cb7c2988d8226a8a34ff7c82d174f0479
a59c75430485ffe1d043da8e7c3f8184379a053e8e2dcbeeeefceccd6d447c00
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /fserver/files/sportTeam/football/cba08.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Cookie: sticket=l1TVRVME9tTmhNV00; route=6fc16a063046d21fc2e5f5c026f90787; _ga_B5HTXF8BMH=GS1.1.1697175421.1.0.1697175421.0.0.0; _ga=GA1.1.444583028.1697175421
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:01 GMT
Content-Type: image/png
Content-Length: 32345
Connection: keep-alive
Last-Modified: Thu, 06 Dec 2018 10:52:20 GMT
Vary: Accept-Encoding
ETag: "5c08ff64-7e59"
Expires: Sat, 14 Oct 2023 05:37:01 GMT
Cache-Control: max-age=86400
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/fserver/files/sportTeam/football/cba20.png
200 OK 30 kB URL GET HTTP/1.1 www.36596666.net:8989/fserver/files/sportTeam/football/cba20.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced\012- data
Hash 5725a37e8d82ec40f27f6646d66f08f4
894ceb24799acc09afcb9651dd5992e8052074f3
2022d335c0e793863c3c32d00c99331fcbc7c5a9740c3ca90e8a6a279ce69949
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /fserver/files/sportTeam/football/cba20.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Cookie: sticket=l1TVRVME9tTmhNV00; route=6fc16a063046d21fc2e5f5c026f90787; _ga_B5HTXF8BMH=GS1.1.1697175421.1.0.1697175421.0.0.0; _ga=GA1.1.444583028.1697175421
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:01 GMT
Content-Type: image/png
Content-Length: 30328
Connection: keep-alive
Last-Modified: Thu, 06 Dec 2018 10:52:28 GMT
Vary: Accept-Encoding
ETag: "5c08ff6c-7678"
Expires: Sat, 14 Oct 2023 05:37:01 GMT
Cache-Control: max-age=86400
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
3dsa62.gaokejd.xyz/fserver/files/gb/141/carousel/10289/1639550762197.png?wsSecret=83bb9456d533a8cc8e68bfd974917fb6&wsTime=1697175419
200 OK 218 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/fserver/files/gb/141/carousel/10289/1639550762197.png?wsSecret=83bb9456d533a8cc8e68bfd974917fb6&wsTime=1697175419
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type PNG image data, 1400 x 1047, 8-bit colormap, non-interlaced\012- data
Size 218 kB (217791 bytes)
Hash 749eb8a1547b3e80185b25a86f3f8dac
bd345cbbb9f96c74a8165ccb31db3e4c1fb88ca9
9ebf68db59bfe23f21efe6711f3cfdba4859e5a874a9587928d20a288daf13a0
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /fserver/files/gb/141/carousel/10289/1639550762197.png?wsSecret=83bb9456d533a8cc8e68bfd974917fb6&wsTime=1697175419 HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 217791
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-05
ETag: "6379d6a0-352bf"
Date: Thu, 28 Sep 2023 08:09:43 GMT
Last-Modified: Sun, 20 Nov 2022 07:26:24 GMT
Expires: Sat, 28 Oct 2023 08:09:43 GMT
Age: 1286836
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: MISS
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-05, HIT from KS-CLOUD-XG-FOREIGN-03-11
X-Cdn-Request-ID: b94ec8cb2b11aa46bdf8affa9dae4b91
3dsa62.gaokejd.xyz/fserver/files/gb/141/carousel/10311/1658375599529.png?wsSecret=287c78bc8d7d3bd6021842125584a922&wsTime=1697175419
200 OK 279 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/fserver/files/gb/141/carousel/10311/1658375599529.png?wsSecret=287c78bc8d7d3bd6021842125584a922&wsTime=1697175419
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type PNG image data, 1384 x 961, 8-bit colormap, non-interlaced\012- data
Size 279 kB (278659 bytes)
Hash a494db53e3ad3d19a85e330e33b6a182
315a19514103494c6cf60a8d91545e1944206047
1c32a585655c4d7d56b66a7e578c240d7a0d3808b16bc15a2f30b97ce02aa275
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /fserver/files/gb/141/carousel/10311/1658375599529.png?wsSecret=287c78bc8d7d3bd6021842125584a922&wsTime=1697175419 HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 278659
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-06
ETag: "6379d6df-44083"
Date: Thu, 28 Sep 2023 08:09:32 GMT
Last-Modified: Sun, 20 Nov 2022 07:27:27 GMT
Expires: Sat, 28 Oct 2023 08:09:32 GMT
Age: 1286847
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: MISS
uuid: -
out-line: gb-cdn-204
x-link-via: xg03:443;xg12:80;
X-Cache-Status: HIT from KS-CLOUD-XG-FOREIGN-12-06, HIT from KS-CLOUD-XG-FOREIGN-03-07
X-Cdn-Request-ID: 34223917eb2eafe5e6c1cbcf55254bab
www.36596666.net:8989/fserver/files/sportTeam/football/cba06.png
200 OK 26 kB URL GET HTTP/1.1 www.36596666.net:8989/fserver/files/sportTeam/football/cba06.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced\012- data
Hash 4fd80b73f84e40e8ec265e21f965c4f5
2909373a8cb0d94e309956a0c75ddc72f1e52af3
166b0d5a5c392eb6b0453b44d3d9230abc5460e7953e48552011059e3e84c06b
GET /fserver/files/sportTeam/football/cba06.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Cookie: sticket=l1TVRVME9tTmhNV00; route=6fc16a063046d21fc2e5f5c026f90787; _ga_B5HTXF8BMH=GS1.1.1697175421.1.0.1697175421.0.0.0; _ga=GA1.1.444583028.1697175421
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:01 GMT
Content-Type: image/png
Content-Length: 26373
Connection: keep-alive
Last-Modified: Thu, 06 Dec 2018 10:52:22 GMT
Vary: Accept-Encoding
ETag: "5c08ff66-6705"
Expires: Sat, 14 Oct 2023 05:37:01 GMT
Cache-Control: max-age=86400
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/fserver/files/sportTeam/football/cba11.png
200 OK 25 kB URL GET HTTP/1.1 www.36596666.net:8989/fserver/files/sportTeam/football/cba11.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced\012- data
Hash dec0875a190187ea2438159202b16b30
88bc8c72eaaf56073e6b32a4d0593cbc54339592
0c5f0a92bbfb77e2c4911a154f80c89972f3015c58b4afe034c9c8422475b1ff
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /fserver/files/sportTeam/football/cba11.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Cookie: sticket=l1TVRVME9tTmhNV00; route=6fc16a063046d21fc2e5f5c026f90787; _ga_B5HTXF8BMH=GS1.1.1697175421.1.0.1697175421.0.0.0; _ga=GA1.1.444583028.1697175421
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:01 GMT
Content-Type: image/png
Content-Length: 24647
Connection: keep-alive
Last-Modified: Thu, 06 Dec 2018 10:52:14 GMT
Vary: Accept-Encoding
ETag: "5c08ff5e-6047"
Expires: Sat, 14 Oct 2023 05:37:01 GMT
Cache-Control: max-age=86400
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
3dsa62.gaokejd.xyz/ftl/bet365-141-2/themes/images/sports-infos-bg.png?wsSecret=225a033cb68ca71b8167039078a67f0e&wsTime=1697175419
200 OK 4.3 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/bet365-141-2/themes/images/sports-infos-bg.png?wsSecret=225a033cb68ca71b8167039078a67f0e&wsTime=1697175419
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type PNG image data, 414 x 204, 8-bit/color RGB, non-interlaced\012- data
Hash 69957649d4c70d7b7cc0c1aa434c462f
9070128b8ee6a699818e5deb33c926581d5b0b6f
6cff75537c35a2a855cafaf1d2d45767867dbc28774da40ed8c4fd4f4f74a813
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/bet365-141-2/themes/images/sports-infos-bg.png?wsSecret=225a033cb68ca71b8167039078a67f0e&wsTime=1697175419 HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 4311
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-04
ETag: "5d2c7603-10d7"
Date: Thu, 28 Sep 2023 08:02:50 GMT
Last-Modified: Mon, 15 Jul 2019 12:48:03 GMT
Expires: Sat, 28 Oct 2023 08:02:50 GMT
Age: 1287250
Cache-Control: max-age=86400
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-04, HIT from KS-CLOUD-XG-FOREIGN-03-07
X-Cdn-Request-ID: dd4cd6dcf128ed0b98b027cdd1fc1505
3dsa62.gaokejd.xyz/fserver/files/gb/141/carousel/10307/1658300326348.png?wsSecret=1ef75029edea4b5be1f3a01ed25f7835&wsTime=1697175419
200 OK 328 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/fserver/files/gb/141/carousel/10307/1658300326348.png?wsSecret=1ef75029edea4b5be1f3a01ed25f7835&wsTime=1697175419
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type PNG image data, 1400 x 1047, 8-bit colormap, non-interlaced\012- data
Size 328 kB (328303 bytes)
Hash 535172ad3a435afe80c33ed17cc592f9
7d8bc3efa5a46e12b54ee07d0428c5e3d0662fc4
f7b20469f299a0722ccc52bbecdba656f73435b4c827add798de38797a2c266e
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /fserver/files/gb/141/carousel/10307/1658300326348.png?wsSecret=1ef75029edea4b5be1f3a01ed25f7835&wsTime=1697175419 HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 328303
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-06
ETag: "6379d6d4-5026f"
Date: Thu, 28 Sep 2023 08:09:42 GMT
Last-Modified: Sun, 20 Nov 2022 07:27:16 GMT
Expires: Sat, 28 Oct 2023 08:09:42 GMT
Age: 1286837
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: MISS
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-06, HIT from KS-CLOUD-XG-FOREIGN-03-05
X-Cdn-Request-ID: ad633a55b9d531ffdd88d191b8e4c3da
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_73_105.png
200 OK 102 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_73_105.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit/color RGBA, non-interlaced\012- data
Size 102 kB (102258 bytes)
Hash 8d9aba5a434311f951ac04421c7dc771
9e269ef70b1c650a4177aa6ca8f9b5c8d400be42
282aee25e5c5e665f12f0593297c59ef00dfcbb88b210b4bc9466ab4d0e14bea
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_73_105.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:00 GMT
Content-Type: image/png
Content-Length: 102258
Connection: keep-alive
Last-Modified: Sat, 11 Sep 2021 09:11:25 GMT
ETag: "613c72bd-18f72"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:00 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/fserver/files/sportTeam/football/cba13.png
200 OK 32 kB URL GET HTTP/1.1 www.36596666.net:8989/fserver/files/sportTeam/football/cba13.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced\012- data
Hash 37f8b1490674714439c6f1372c62f50c
c20e79a7bdb505aa4376435ee4dc1483f1b1ec39
661c9c4d99884080cac1b4906a8b76e9b6dd25e6db9c99b0ebff232cfa5c818a
GET /fserver/files/sportTeam/football/cba13.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Cookie: sticket=l1TVRVME9tTmhNV00; route=6fc16a063046d21fc2e5f5c026f90787; _ga_B5HTXF8BMH=GS1.1.1697175421.1.0.1697175421.0.0.0; _ga=GA1.1.444583028.1697175421
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:01 GMT
Content-Type: image/png
Content-Length: 31565
Connection: keep-alive
Last-Modified: Thu, 06 Dec 2018 10:52:12 GMT
Vary: Accept-Encoding
ETag: "5c08ff5c-7b4d"
Expires: Sat, 14 Oct 2023 05:37:01 GMT
Cache-Control: max-age=86400
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/fserver/files/sportTeam/football/cba05.png
200 OK 23 kB URL GET HTTP/1.1 www.36596666.net:8989/fserver/files/sportTeam/football/cba05.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced\012- data
Hash 5eec0f00fe4dece5e674c81c79b7d71a
bc6dcbdaf1cba4394f01a81cf8d2f19a5d1a3959
dde953fb17af97d2f4e13e619e04af578fddd050471c54c7765c25bb477bf065
GET /fserver/files/sportTeam/football/cba05.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Cookie: sticket=l1TVRVME9tTmhNV00; route=6fc16a063046d21fc2e5f5c026f90787; _ga_B5HTXF8BMH=GS1.1.1697175421.1.0.1697175421.0.0.0; _ga=GA1.1.444583028.1697175421
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:01 GMT
Content-Type: image/png
Content-Length: 22690
Connection: keep-alive
Last-Modified: Thu, 06 Dec 2018 10:52:22 GMT
Vary: Accept-Encoding
ETag: "5c08ff66-58a2"
Expires: Sat, 14 Oct 2023 05:37:01 GMT
Cache-Control: max-age=86400
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/fserver/files/sportTeam/football/cba15.png
200 OK 32 kB URL GET HTTP/1.1 www.36596666.net:8989/fserver/files/sportTeam/football/cba15.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced\012- data
Hash 1e11ab64384e11c0dfaa2c9cec272640
9c41d228bebfa180acc79036dc30244ccf8840aa
01b16ec0c4e65f27a6be39c665b724a65bc1e565730582d60696211a6b919bdb
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /fserver/files/sportTeam/football/cba15.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Cookie: sticket=l1TVRVME9tTmhNV00; route=6fc16a063046d21fc2e5f5c026f90787; _ga_B5HTXF8BMH=GS1.1.1697175421.1.0.1697175421.0.0.0; _ga=GA1.1.444583028.1697175421
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:01 GMT
Content-Type: image/png
Content-Length: 31526
Connection: keep-alive
Last-Modified: Thu, 06 Dec 2018 10:52:10 GMT
Vary: Accept-Encoding
ETag: "5c08ff5a-7b26"
Expires: Sat, 14 Oct 2023 05:37:01 GMT
Cache-Control: max-age=86400
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
ocsp.r2m01.amazontrust.com/
471 B URL ocsp.r2m01.amazontrust.com/
IP
Hash 48c483ad7d086a8c9cf815f2b2522016
eb9acb20ec26e510f09d08bb35a0c160106a739c
24f57b1754fb88d6a74d3e6272ce9d7ccba5da423734707c87c28c01fde78c4e
POST / HTTP/1.1
Host: ocsp.r2m01.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Cache-Control: max-age=7200
Date: Fri, 13 Oct 2023 05:37:01 GMT
Server: ECAcc (amb/6AC3)
X-Cache: Miss from cloudfront
Via: 1.1 1d8cf7c8865ed1078c19a98771ad34ca.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: rNzIjRcPBmVqiWIZoiNb1TtRAV4nWszprPxX2Ha79IWWLTZlIFzcoQ==
3dsa62.gaokejd.xyz/fserver/files/gb/141/carousel/10381/1687412906249.jpg?wsSecret=8d26152426d0547f29424a53cca5e40e&wsTime=1697175419
200 OK 369 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/fserver/files/gb/141/carousel/10381/1687412906249.jpg?wsSecret=8d26152426d0547f29424a53cca5e40e&wsTime=1697175419
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 694x520, components 3\012- data
Size 369 kB (368702 bytes)
Hash de11f3b1d817b150ad03f39aaedd0017
3b6dcfd2d2d5fa19397144ef3c8e1734b1635542
10ff505bcab9d3bc20bbe02032a4b5bb474368cc164c60cbc9f3f59701503a6e
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /fserver/files/gb/141/carousel/10381/1687412906249.jpg?wsSecret=8d26152426d0547f29424a53cca5e40e&wsTime=1697175419 HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 368702
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-05
ETag: "6493e0aa-5a03e"
Date: Thu, 28 Sep 2023 08:09:43 GMT
Last-Modified: Thu, 22 Jun 2023 05:48:26 GMT
Expires: Sat, 28 Oct 2023 08:09:43 GMT
Age: 1286836
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: MISS
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-05, HIT from KS-CLOUD-XG-FOREIGN-03-07
X-Cdn-Request-ID: f40f2d68a50fd742ae64a1f064046a54
vue.livehelp100service.com/visitorside/js/vendor.23e85dcd.js
200 OK 57 kB URL GET HTTP/2 vue.livehelp100service.com/visitorside/js/vendor.23e85dcd.js
IP
Requested by https://www.36596666.net:8989/
Certificate IssuerAmazon
Subject*.livehelp100service.com
Fingerprint64:45:EC:14:03:13:80:70:27:C3:0D:CA:0D:28:F6:FA:05:0E:D3:D0
ValidityTue, 15 Aug 2023 00:00:00 GMT - Thu, 12 Sep 2024 23:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (65421)
Hash 4b2709ff844ec41f3936fabb7fc84dec
3f0a1aa752f1786ce70a827034f2a7d286125de4
e6d51460a671fce5447dc8c24310fc4ef681699de7053889be4677af7636c19f
GET /visitorside/js/vendor.23e85dcd.js HTTP/1.1
Host: vue.livehelp100service.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.36596666.net:8989
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript
date: Fri, 13 Oct 2023 02:21:38 GMT
server: nginx/1.22.1
last-modified: Wed, 20 Sep 2023 11:00:35 GMT
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
access-control-expose-headers: Content-Length,Content-Range
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: br
etag: W/"650ad0d3-120cd"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 96c778ce6156d12f24b8b6cdaa0cbf66.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: A6NahLQVUXJmtTjkom2jBpla_boP8PjUsl5hPRK8lXBrKM9uCqhpxg==
age: 11722
X-Firefox-Spdy: h2
www.36596666.net:8989/fserver/files/sportTeam/football/cba16.png
200 OK 33 kB URL GET HTTP/1.1 www.36596666.net:8989/fserver/files/sportTeam/football/cba16.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced\012- data
Hash 22422f4e6146cf71c54b64d2e9eb3996
4a5d944e0102a0f62c5262b09bd4c06ce862bd3b
168b4896b9e1727c5258f11d983b88cc89d1122df43e36aa6ddcc428e46924ba
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /fserver/files/sportTeam/football/cba16.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Cookie: sticket=l1TVRVME9tTmhNV00; route=6fc16a063046d21fc2e5f5c026f90787; _ga_B5HTXF8BMH=GS1.1.1697175421.1.0.1697175421.0.0.0; _ga=GA1.1.444583028.1697175421
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:01 GMT
Content-Type: image/png
Content-Length: 32605
Connection: keep-alive
Last-Modified: Thu, 06 Dec 2018 10:52:08 GMT
Vary: Accept-Encoding
ETag: "5c08ff58-7f5d"
Expires: Sat, 14 Oct 2023 05:37:01 GMT
Cache-Control: max-age=86400
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
3dsa62.gaokejd.xyz/ftl/bet365-141-2/themes/images/btn.png?wsSecret=7f3ade32f81bdb67f8d0b2728c7afb66&wsTime=1697175419
200 OK 484 B URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/bet365-141-2/themes/images/btn.png?wsSecret=7f3ade32f81bdb67f8d0b2728c7afb66&wsTime=1697175419
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type PNG image data, 170 x 28, 8-bit colormap, non-interlaced\012- data
Hash b1ab87f2aa1045cf56bd192752fb20ba
e8b07455934b82eb6c9d1a5d657c582822eb32cc
527228714a2a640b71788550f8dcd2c0964ee13fdfddc1c57ff377134f8fcecb
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/bet365-141-2/themes/images/btn.png?wsSecret=7f3ade32f81bdb67f8d0b2728c7afb66&wsTime=1697175419 HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 484
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-05
ETag: "613c72a8-1e4"
Date: Thu, 28 Sep 2023 08:02:49 GMT
Last-Modified: Sat, 11 Sep 2021 09:11:04 GMT
Expires: Sat, 28 Oct 2023 08:02:49 GMT
Age: 1287251
Cache-Control: max-age=86400
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: MISS
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-05, HIT from KS-CLOUD-XG-03-02
X-Cdn-Request-ID: 8a52983116a7f5dec002155076f34da7
3dsa62.gaokejd.xyz/ftl/bet365-141-2/themes/images/bg-products.gif?wsSecret=3c36937c0423d8a47126ef5484d589cc&wsTime=1697175419
200 OK 21 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/bet365-141-2/themes/images/bg-products.gif?wsSecret=3c36937c0423d8a47126ef5484d589cc&wsTime=1697175419
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type GIF image data, version 89a, 271 x 302\012- data
Hash e6c33fd46eacf329da3565adb295287a
79b107df875842fd4e22809f21b60c322d128cce
1694db51d04b5d207f7bc4ca11a7fcd2ca171b2f4c2c2b12d1c75e5cb3dbe20f
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/bet365-141-2/themes/images/bg-products.gif?wsSecret=3c36937c0423d8a47126ef5484d589cc&wsTime=1697175419 HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: image/gif
Content-Length: 21028
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-04
ETag: "5d2c7603-5224"
Date: Thu, 28 Sep 2023 08:02:49 GMT
Last-Modified: Mon, 15 Jul 2019 12:48:03 GMT
Expires: Sat, 28 Oct 2023 08:02:49 GMT
Age: 1287251
Cache-Control: max-age=86400
Accept-Ranges: bytes
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-04, HIT from KS-CLOUD-XG-03-02
X-Cdn-Request-ID: 0f0db9c1234ba4b579985bd9917b1fe0
www.36596666.net:8989/fserver/files/sportTeam/football/jp.png
200 OK 1.1 kB URL GET HTTP/1.1 www.36596666.net:8989/fserver/files/sportTeam/football/jp.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 150 x 150, 8-bit colormap, non-interlaced\012- data
Hash adca7424f15ede0b64339b392f5b839c
675ce448d40be824c749f5586c748c1b047e1d93
441599ec0b7422de12f1e6a8e73ae8ddab4a14c7f8e20a707aedb7a7cb93fb2a
GET /fserver/files/sportTeam/football/jp.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Cookie: sticket=l1TVRVME9tTmhNV00; route=6fc16a063046d21fc2e5f5c026f90787; _ga_B5HTXF8BMH=GS1.1.1697175421.1.0.1697175421.0.0.0; _ga=GA1.1.444583028.1697175421
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:01 GMT
Content-Type: image/png
Content-Length: 1141
Connection: keep-alive
Last-Modified: Thu, 15 Nov 2018 09:37:12 GMT
Vary: Accept-Encoding
ETag: "5bed3e48-475"
Expires: Sat, 14 Oct 2023 05:37:01 GMT
Cache-Control: max-age=86400
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
3dsa62.gaokejd.xyz/ftl/bet365-141-2/themes/images/arrow.png?wsSecret=c3eb4376c0957865814d51097b097a87&wsTime=1697175419
200 OK 260 B URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/bet365-141-2/themes/images/arrow.png?wsSecret=c3eb4376c0957865814d51097b097a87&wsTime=1697175419
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type PNG image data, 10 x 14, 8-bit colormap, non-interlaced\012- data
Hash e602938a99acc154421381f39d5652d8
e12cb203b3e61b0cae31ad5cb3241555caba6c10
73500ead881aa273814d982b0a0e78dc29ebf04f37b5932667785f6f7c45a664
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/bet365-141-2/themes/images/arrow.png?wsSecret=c3eb4376c0957865814d51097b097a87&wsTime=1697175419 HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 260
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-01
ETag: "614d2b23-104"
Date: Thu, 28 Sep 2023 08:02:50 GMT
Last-Modified: Fri, 24 Sep 2021 01:34:27 GMT
Expires: Sat, 28 Oct 2023 08:02:50 GMT
Age: 1287250
Cache-Control: max-age=86400
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-01, HIT from KS-CLOUD-XG-FOREIGN-03-07
X-Cdn-Request-ID: 856f13d15e3a52f9e241c9f93d901d90
www.36596666.net:8989/fserver/files/sportTeam/football/ca.png
200 OK 1.5 kB URL GET HTTP/1.1 www.36596666.net:8989/fserver/files/sportTeam/football/ca.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 150 x 150, 8-bit colormap, non-interlaced\012- data
Hash 8d3528dc016689b4192b3f493d5b7d80
b1b1f89736e1d3fa99f294b0ffc1c20c235f7270
56180904fe09a63ff5ac499085fcb1dc9fcfca16ad37709f54609925e9dfef3e
GET /fserver/files/sportTeam/football/ca.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Cookie: sticket=l1TVRVME9tTmhNV00; route=6fc16a063046d21fc2e5f5c026f90787; _ga_B5HTXF8BMH=GS1.1.1697175421.1.0.1697175421.0.0.0; _ga=GA1.1.444583028.1697175421
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:01 GMT
Content-Type: image/png
Content-Length: 1493
Connection: keep-alive
Last-Modified: Wed, 14 Nov 2018 03:39:08 GMT
Vary: Accept-Encoding
ETag: "5beb98dc-5d5"
Expires: Sat, 14 Oct 2023 05:37:01 GMT
Cache-Control: max-age=86400
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/fserver/files/sportTeam/football/kp.png
200 OK 3.0 kB URL GET HTTP/1.1 www.36596666.net:8989/fserver/files/sportTeam/football/kp.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 150 x 150, 8-bit colormap, non-interlaced\012- data
Hash b9403b54d30a4fa532c98f4c0ac28e16
b13977253ce6a55c6cdc8aa9d3f6ab36fd917d55
75261850efd54173e35e5b0929f438f44a9629c5e963999e43b5117ba0507adb
GET /fserver/files/sportTeam/football/kp.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Cookie: sticket=l1TVRVME9tTmhNV00; route=6fc16a063046d21fc2e5f5c026f90787; _ga_B5HTXF8BMH=GS1.1.1697175421.1.0.1697175421.0.0.0; _ga=GA1.1.444583028.1697175421
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:01 GMT
Content-Type: image/png
Content-Length: 3029
Connection: keep-alive
Last-Modified: Thu, 15 Nov 2018 09:37:28 GMT
Vary: Accept-Encoding
ETag: "5bed3e58-bd5"
Expires: Sat, 14 Oct 2023 05:37:01 GMT
Cache-Control: max-age=86400
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/fserver/files/sportTeam/football/tn.png
200 OK 1.5 kB URL GET HTTP/1.1 www.36596666.net:8989/fserver/files/sportTeam/football/tn.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 150 x 150, 8-bit colormap, non-interlaced\012- data
Hash 42ebd7e0e362b6a14c97adbb38749e4a
e38ac9c91c46ab04c8febee32390a0ac22eb71cb
d079ff92655532da9bb3865618c50739f5e86ac69a63f265d060a0648b1749e0
GET /fserver/files/sportTeam/football/tn.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Cookie: sticket=l1TVRVME9tTmhNV00; route=6fc16a063046d21fc2e5f5c026f90787; _ga_B5HTXF8BMH=GS1.1.1697175421.1.0.1697175421.0.0.0; _ga=GA1.1.444583028.1697175421
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:01 GMT
Content-Type: image/png
Content-Length: 1511
Connection: keep-alive
Last-Modified: Fri, 16 Nov 2018 08:02:30 GMT
Vary: Accept-Encoding
ETag: "5bee7996-5e7"
Expires: Sat, 14 Oct 2023 05:37:01 GMT
Cache-Control: max-age=86400
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
3dsa62.gaokejd.xyz/fserver/files/gb/141/floatImage/273/1666693826407.png?wsSecret=8a55f0658b7b4a18f071dac16522572a&wsTime=1697175419
200 OK 59 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/fserver/files/gb/141/floatImage/273/1666693826407.png?wsSecret=8a55f0658b7b4a18f071dac16522572a&wsTime=1697175419
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type PNG image data, 140 x 476, 8-bit/color RGBA, non-interlaced\012- data
Hash 49563d45b49a4be9ca3e47e47abe4922
d3fa0c017818ad83aea64f5aa6665ffde15e69df
f30de132f8c9fea735cb30ab39ace43814273b611b804edbbf8ccd742d3ef531
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /fserver/files/gb/141/floatImage/273/1666693826407.png?wsSecret=8a55f0658b7b4a18f071dac16522572a&wsTime=1697175419 HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 59186
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-05
ETag: "6357bac2-e732"
Date: Thu, 28 Sep 2023 08:06:27 GMT
Last-Modified: Tue, 25 Oct 2022 10:30:26 GMT
Expires: Sat, 28 Oct 2023 08:06:27 GMT
Age: 1287033
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: MISS
uuid: -
out-line: gb-cdn-204
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-05, HIT from KS-CLOUD-XG-03-03
X-Cdn-Request-ID: 1d55628e414aea96c68d7de426f86153
vue.livehelp100service.com/livechat.ashx?siteId=65000584
200 OK 387 kB URL GET HTTP/2 vue.livehelp100service.com/livechat.ashx?siteId=65000584
IP
Requested by https://www.36596666.net:8989/
Certificate IssuerAmazon
Subject*.livehelp100service.com
Fingerprint64:45:EC:14:03:13:80:70:27:C3:0D:CA:0D:28:F6:FA:05:0E:D3:D0
ValidityTue, 15 Aug 2023 00:00:00 GMT - Thu, 12 Sep 2024 23:59:59 GMT
File type gzip compressed data, from Unix\012- data
Size 387 kB (387361 bytes)
Hash 9af9475fd58312606f1247458e67e434
439e5a9c869149cad78b27520b42a4a5d0bd092a
39ddc6ce3e3352aa37ee34b17958fcbf4968c510eae0a9d26a057d8ede72176e
GET /livechat.ashx?siteId=65000584 HTTP/1.1
Host: vue.livehelp100service.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/x-javascript; charset=utf-8
date: Fri, 13 Oct 2023 02:39:36 GMT
server: Kestrel
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 6480520a5e02f3163410e3134bd77baa.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: Ie12mzXWg1RgxII8NiM2ZMJZrwlqTQa6HsiJ9qI9KC90g8eVXi4Z-w==
age: 10643
X-Firefox-Spdy: h2
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_65_5006.png
200 OK 20 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_65_5006.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash 7769f6a35df5811fbe7fa97b2aea9a1c
2875a7cfef0a8a296374aba27f95a8a8d79b8acf
855a9b3bb8c24ca1ed6cbf42331ff6a243e03b1452d8c2d371df11d861f8712b
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_65_5006.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:01 GMT
Content-Type: image/png
Content-Length: 20434
Connection: keep-alive
Last-Modified: Fri, 09 Aug 2019 09:47:47 GMT
ETag: "5d4d4143-4fd2"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:01 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_88_1jeqx59c7ztqg.png
200 OK 24 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_88_1jeqx59c7ztqg.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash 19e16d0cf5c005f3fd798e8f0131db7d
ebb9c520f4047172662991c689a2e07015680dcd
57c3d3bf827de223898f46813f9bd0fd2296cc21a61f3f77d03ba6cee265c78d
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_88_1jeqx59c7ztqg.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:01 GMT
Content-Type: image/png
Content-Length: 23771
Connection: keep-alive
Last-Modified: Sat, 11 Sep 2021 09:11:25 GMT
ETag: "613c72bd-5cdb"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:01 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
vue.livehelp100service.com/visitorside/js/bundle.43270ed0.js
200 OK 135 kB URL GET HTTP/2 vue.livehelp100service.com/visitorside/js/bundle.43270ed0.js
IP
Requested by https://www.36596666.net:8989/
Certificate IssuerAmazon
Subject*.livehelp100service.com
Fingerprint64:45:EC:14:03:13:80:70:27:C3:0D:CA:0D:28:F6:FA:05:0E:D3:D0
ValidityTue, 15 Aug 2023 00:00:00 GMT - Thu, 12 Sep 2024 23:59:59 GMT
File type ASCII text, with very long lines (65422)
Size 135 kB (134707 bytes)
Hash b8205f42724de492210a5f391b9b0acb
e6508d42ca10d6dcfc5dab15687d801aa67a7468
1d4b6474cb0428fcba5fb4ced99a3724a72aa14cb10d2325274fde4aba412028
GET /visitorside/js/bundle.43270ed0.js HTTP/1.1
Host: vue.livehelp100service.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.36596666.net:8989
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript
date: Fri, 13 Oct 2023 04:04:33 GMT
server: nginx/1.22.1
last-modified: Wed, 20 Sep 2023 11:00:34 GMT
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
access-control-expose-headers: Content-Length,Content-Range
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: br
etag: W/"650ad0d2-844ac"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 96c778ce6156d12f24b8b6cdaa0cbf66.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: szFcWZH3AMSBzLacEsGJfh6HLFwnsmQsopNAPMPo0J2si5Ck-of2lg==
age: 5547
X-Firefox-Spdy: h2
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_88_b8rzo7uzqt4sw.png
200 OK 24 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_88_b8rzo7uzqt4sw.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash d7c26fb9503ab2caf040730495a59f32
06f8414b2709fac132dd2b3071843a86ab745b51
8d437af3cea1d4efc2bf19c763c17c3487f9a76db3a287a975a18f90dffea630
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_88_b8rzo7uzqt4sw.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:01 GMT
Content-Type: image/png
Content-Length: 23806
Connection: keep-alive
Last-Modified: Sat, 11 Sep 2021 09:11:25 GMT
ETag: "613c72bd-5cfe"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:01 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_90_at2_060.png
200 OK 26 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_90_at2_060.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash 51de7c3b3b21d10f38a0c30ac5e4fd24
106f9a993385ff522dad2b37dbdb3c58f035ac20
9240329d37bd41d53a4f2864a255b9f9aef025474f2965130ed5668f10ee311e
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_90_at2_060.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:01 GMT
Content-Type: image/png
Content-Length: 25785
Connection: keep-alive
Last-Modified: Fri, 07 Apr 2023 02:35:05 GMT
ETag: "642f8159-64b9"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:01 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_3_7695.png
200 OK 23 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_3_7695.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash 3c3c588128385827b532946ac86d0a6d
7d84bebb554df6b3c699352d83d640368903ceff
206c91c826cef5d9db409283a0c439a4322211588ecc14b6abb0af9d4573b328
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_3_7695.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:01 GMT
Content-Type: image/png
Content-Length: 22623
Connection: keep-alive
Last-Modified: Tue, 29 Mar 2022 10:22:55 GMT
ETag: "6242ddff-585f"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:01 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_3_7696.png
200 OK 23 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_3_7696.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash 8443275571f203acae6b53207ed73b9f
c3d112abe5edbacb300b321b54cdc9c7d4666bbf
c54b7cdaf70e87778fc4d9c645d5c0296184f7f67793a2b777c194599700882c
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_3_7696.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:01 GMT
Content-Type: image/png
Content-Length: 22876
Connection: keep-alive
Last-Modified: Tue, 29 Mar 2022 10:22:55 GMT
ETag: "6242ddff-595c"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:01 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_3_7697.png
200 OK 27 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_3_7697.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash 6806dc9c36ddfc927f9814ab1f8a021c
fee37bf769af8a26bf58ed70405100bfee39e867
1455e15577781e784863594804797d19c9edb69c6aaa32fe86f9268b9847d6c0
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_3_7697.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:01 GMT
Content-Type: image/png
Content-Length: 26952
Connection: keep-alive
Last-Modified: Tue, 29 Mar 2022 10:22:55 GMT
ETag: "6242ddff-6948"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:01 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_10_38001.png
200 OK 23 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_10_38001.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash 14f7dbafc1472fa05db8eb17ae826f30
991915b5ae07c7a47e93dce0c6c82d0d0b690993
7287fcb933e5bf3eba0d13e7312cf5ba90f94c0593310090fdc521f866b0b134
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_10_38001.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:01 GMT
Content-Type: image/png
Content-Length: 23355
Connection: keep-alive
Last-Modified: Mon, 15 Jul 2019 12:48:11 GMT
ETag: "5d2c760b-5b3b"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:01 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_10_30599.png
200 OK 22 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_10_30599.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash a83dc10b4e607a2685552e62c61e28ba
0f879b68bd5690faa0577ec9335ad219468e2670
3983d86b32d2cba092eea2e69dbdd3e6739824505d27c3ed04c892b28861a6e7
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_10_30599.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:01 GMT
Content-Type: image/png
Content-Length: 22499
Connection: keep-alive
Last-Modified: Mon, 15 Jul 2019 12:48:11 GMT
ETag: "5d2c760b-57e3"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:01 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_90_ds_1010.png
200 OK 104 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_90_ds_1010.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit/color RGBA, non-interlaced\012- data
Size 104 kB (103628 bytes)
Hash 8d666e925b25cb11e51e73f93c070f4d
c6ff29c0819e955832f80eb564569cadd6a2b6e9
58377e7130027c1bc0b0d1640be5c18574464c78253ee14a8957586e32f55e0a
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_90_ds_1010.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:01 GMT
Content-Type: image/png
Content-Length: 103628
Connection: keep-alive
Last-Modified: Tue, 10 May 2022 03:35:17 GMT
ETag: "6279dd75-194cc"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:01 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_3_8673.png
200 OK 25 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_3_8673.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash 230a3ba266ae64dee8f70d0ff2f3b0e0
e5bd5defc0486a69adf7d8b187c2100e015260a2
c38424550af0abe01c532bcfdb9d3985a006a2f50ebe65da95b5a4afd2495449
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_3_8673.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:01 GMT
Content-Type: image/png
Content-Length: 25030
Connection: keep-alive
Last-Modified: Mon, 19 Dec 2022 03:01:08 GMT
ETag: "639fd3f4-61c6"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:01 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_3_7583.png
200 OK 20 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_3_7583.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash a33f52ea5bd6275e21267f80791ef78a
8c628b103599834a360c53bbb3fbc9e01c5878c6
bb5a4afcdc59886a05b426337bdc6480c07742c0d06ca7bb3a03f66d904731e7
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_3_7583.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:01 GMT
Content-Type: image/png
Content-Length: 20322
Connection: keep-alive
Last-Modified: Tue, 29 Mar 2022 10:22:55 GMT
ETag: "6242ddff-4f62"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:01 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
3dsa62.gaokejd.xyz/fserver/files/gb/141/carousel/10316/1659084716430.png?wsSecret=ab6d8e170d02a7733a1f7c0708c9af4e&wsTime=1697175419
200 OK 70 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/fserver/files/gb/141/carousel/10316/1659084716430.png?wsSecret=ab6d8e170d02a7733a1f7c0708c9af4e&wsTime=1697175419
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type PNG image data, 750 x 190, 8-bit colormap, non-interlaced\012- data
Hash 3cec45bced128357804406f23fdb94d1
2e300c18f2c721f4d8580098b46829ef2be4ce1e
36d46701f11f890e85341c03a1381dd46dce7c1be4c2582ebfa67b0e39101d15
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /fserver/files/gb/141/carousel/10316/1659084716430.png?wsSecret=ab6d8e170d02a7733a1f7c0708c9af4e&wsTime=1697175419 HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 70362
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-01
ETag: "62e39fac-112da"
Date: Thu, 28 Sep 2023 08:09:43 GMT
Last-Modified: Fri, 29 Jul 2022 08:51:56 GMT
Expires: Sat, 28 Oct 2023 08:09:43 GMT
Age: 1286838
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: MISS
uuid: -
out-line: gb-cdn-204
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-01, HIT from KS-CLOUD-XG-03-02
X-Cdn-Request-ID: 0fce2c96eeae0ff2125e8db5da9c2505
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_10_30595.png
200 OK 28 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_10_30595.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash b2c524e4d0297da3203c6d45d2f07115
e91bac7336aabae38e8038d2fd931a2f42fe3c84
91c4128aa7b5fa411efae3f85e25b618c0e83958b984a0460dc5e51cb83ccdd1
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_10_30595.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:02 GMT
Content-Type: image/png
Content-Length: 27580
Connection: keep-alive
Last-Modified: Tue, 21 Dec 2021 09:55:47 GMT
ETag: "61c1a4a3-6bbc"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:02 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_9_6.png
200 OK 22 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_9_6.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash 18fc529cc0b071eee9ab764c7b3cebf2
e79958322824752ee3be995515d242f3a65dbd15
7dc7c033a2391b021f70e5576b15806c1e3e73b2bf5a0beda751bbdff7513b7b
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_9_6.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:02 GMT
Content-Type: image/png
Content-Length: 21622
Connection: keep-alive
Last-Modified: Mon, 15 Jul 2019 12:48:11 GMT
ETag: "5d2c760b-5476"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:02 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_73_411.png
200 OK 107 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_73_411.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit/color RGBA, non-interlaced\012- data
Size 107 kB (107367 bytes)
Hash f391a00c7ca4a801c7c46431f6949f3e
392e698fcd6b15c2397eb576de33134e7abae702
1ffd1f9416cc641e5c5659de5a2f1530bbe7ddeeb71c91af2db8129c6624f64f
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_73_411.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:01 GMT
Content-Type: image/png
Content-Length: 107367
Connection: keep-alive
Last-Modified: Sat, 11 Sep 2021 09:11:25 GMT
ETag: "613c72bd-1a367"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:01 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_9_HMSH.png
200 OK 20 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_9_HMSH.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash 82c905f14c36be0d2fa670516edded31
437546d720284de3982ff79df6a946b81e923371
f3cdfd33e75d6f3877e1e0da0491c2b2a65c66f95d434c6b08950b0b5d5b9cc6
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_9_HMSH.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:02 GMT
Content-Type: image/png
Content-Length: 19597
Connection: keep-alive
Last-Modified: Sat, 11 Sep 2021 09:11:26 GMT
ETag: "613c72be-4c8d"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:02 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_10_30598.png
200 OK 20 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_10_30598.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash 06b42bc87015b1f21a614c47bd914859
533e764dcc3ae171ac0c8f51a7fbcca10f26072f
dbcc205b41e6eec3484c66381d57bd921175da6e5936ade916c42e8bd1110eb3
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_10_30598.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:02 GMT
Content-Type: image/png
Content-Length: 20250
Connection: keep-alive
Last-Modified: Mon, 15 Jul 2019 12:48:11 GMT
ETag: "5d2c760b-4f1a"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:02 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_10_30592.png
200 OK 18 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_10_30592.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash 2a8b9275fdec775b8d1ec6e4b0c5df8f
d1d297beee93861fd031fa9e66ddfbe8f7822e28
d2e8ae7ed84c4081f1aa6e15229af593354b571a2097b506a489a0bc1eeea8ec
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_10_30592.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:02 GMT
Content-Type: image/png
Content-Length: 17796
Connection: keep-alive
Last-Modified: Fri, 10 Mar 2023 09:30:12 GMT
ETag: "640af8a4-4584"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:02 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_3_8339.png
200 OK 96 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_3_8339.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit/color RGBA, non-interlaced\012- data
Hash 852c361c9460f489e179f3d34edab1dd
c981b28bbab1500869ff9aa937c3f17e67262ad8
97538b6351173a03757ff751ee08d62cf615b8e01725bc60ec299a2b54a6859b
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_3_8339.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:02 GMT
Content-Type: image/png
Content-Length: 95973
Connection: keep-alive
Last-Modified: Mon, 20 Jun 2022 03:50:04 GMT
ETag: "62afee6c-176e5"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:02 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_10_30588.png
200 OK 20 kB URL GET HTTP/1.1 www.36596666.net:8989/ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_10_30588.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 250 x 215, 8-bit colormap, non-interlaced\012- data
Hash f5a323409d6eeca58e65b88d3d0bdd15
6b60c6305e3065a1e9641865eb20243526444f17
b895770db7a902a14119dae3f32bb5622b8e0ae8ddb181f5b4e833e6cd535fb2
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/resource/chess/public/game/game01/2x/zh_CN/game_fish_10_30588.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:02 GMT
Content-Type: image/png
Content-Length: 19724
Connection: keep-alive
Last-Modified: Mon, 05 Jun 2023 01:35:42 GMT
ETag: "647d3bee-4d0c"
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Expires: Sat, 14 Oct 2023 05:37:02 GMT
Cache-Control: max-age=86400
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
3dsa62.gaokejd.xyz/ftl/commonPage/images/favicon/favicon_141.png?wsSecret=ba3fc3f5004e09e91c32e12510d84d2f&wsTime=1697175419
200 OK 4.7 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/ftl/commonPage/images/favicon/favicon_141.png?wsSecret=ba3fc3f5004e09e91c32e12510d84d2f&wsTime=1697175419
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type PNG image data, 64 x 64, 8-bit/color RGB, non-interlaced\012- data
Hash 834417d344a1bd995c78df66fe45edbd
79a5cd12dc1bf06043f38349e6dd492e58144a01
736b8041b08f7ec7a5f5a8e8d4d857dc58f1f03d4e2b6f738a2f1c9ae3892bbb
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /ftl/commonPage/images/favicon/favicon_141.png?wsSecret=ba3fc3f5004e09e91c32e12510d84d2f&wsTime=1697175419 HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 4704
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-06
ETag: "6311d300-1260"
Date: Thu, 28 Sep 2023 08:10:46 GMT
Last-Modified: Fri, 02 Sep 2022 09:55:12 GMT
Expires: Sat, 28 Oct 2023 08:10:46 GMT
Age: 1286775
Cache-Control: max-age=86400
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-06, HIT from KS-CLOUD-XG-03-03
X-Cdn-Request-ID: abcd9104c74aeee05e01ed8f753b94d5
aus5.mozilla.org/update/3/GMP/111.0a1/20230218104546/Linux_x86_64-gcc3/null/default/Linux%205.15.0-76-generic%20(GTK%203.24.34%2Clibpulse%20not-available)/default/default/update.xml
445 B URL aus5.mozilla.org/update/3/GMP/111.0a1/20230218104546/Linux_x86_64-gcc3/null/default/Linux%205.15.0-76-generic%20(GTK%203.24.34%2Clibpulse%20not-available)/default/default/update.xml
IP
File type XML 1.0 document text\012- XML document, ASCII text, with very long lines (332)
Hash d39546249a86d29697ea6b389afd84f2
244ce5f2d9a3e80da843e527f35cae0b9d9e20be
ba339c9812783530a739e05b9bc0ec254d9c22eb13779e8e5be5860a192f8c80
GET /update/3/GMP/111.0a1/20230218104546/Linux_x86_64-gcc3/null/default/Linux%205.15.0-76-generic%20(GTK%203.24.34%2Clibpulse%20not-available)/default/default/update.xml HTTP/1.1
Host: aus5.mozilla.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Cache-Control: no-cache
Pragma: no-cache
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
rule-id: 17805
rule-data-version: 1
content-signature: x5u=https://content-signature-2.cdn.mozilla.net/chains/aus.content-signature.mozilla.org-2023-11-18-16-07-40.chain; p384ecdsa=VreoDSG2izSxdsWEoK5azG-q6KDmC1gti0BO96XEKueE8scpEi-Yxy1JA2xioYG23gw6i-1lTQgzY2u3hGKd9y_egydfCZFZ2PyIaE_l3rf4n4q10FQDukqoj_AaByRN
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'
x-proxy-cache-status: MISS
content-encoding: gzip
via: 1.1 google
date: Fri, 13 Oct 2023 05:36:55 GMT
content-type: text/xml; charset=utf-8
vary: Accept-Encoding
content-length: 445
age: 16
cache-control: public,max-age=90
alt-svc: clear
X-Firefox-Spdy: h2
ciscobinary.openh264.org/openh264-linux64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
512 kB URL ciscobinary.openh264.org/openh264-linux64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
IP
ASN #20940 Akamai International B.V.
File type Zip archive data, at least v2.0 to extract, compression method=deflate\012- data
Size 512 kB (511815 bytes)
Hash 152eda253e242e18443ef3282495bc7c
ff0fa85565f21ec4931baad4573b4c0bd08c4019
8e03090fee16f6e0ee2e436af8e51d0c3deed6d9f0db80dec048e668fc009a48
GET /openh264-linux64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip HTTP/1.1
Host: ciscobinary.openh264.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
HTTP/1.1 200 OK
Last-Modified: Wed, 07 Jun 2023 18:17:03 GMT
ETag: 152eda253e242e18443ef3282495bc7c
Content-Length: 511815
Accept-Ranges: bytes
X-Timestamp: 1686161822.36709
Content-Type: application/zip
X-Trans-Id: tx5d74d51dc63e41b488f08-006481c906dfw1
Cache-Control: public, max-age=74736
Expires: Sat, 14 Oct 2023 02:22:47 GMT
Date: Fri, 13 Oct 2023 05:37:11 GMT
Connection: keep-alive
firefox-settings-attachments.cdn.mozilla.net/staging/addons-bloomfilters/6c7d9b78-4642-461c-9b2d-b802ccd7a1d5.bin
817 kB URL firefox-settings-attachments.cdn.mozilla.net/staging/addons-bloomfilters/6c7d9b78-4642-461c-9b2d-b802ccd7a1d5.bin
IP
Size 817 kB (817083 bytes)
Hash 6b5b15372ca108d4b33caf02ed016f3e
13df17583626a0987070dde4340f876d08c401c0
9c890391b90d43bf692755185bfa1780ee051467ae9a2775759d9866f4546664
GET /staging/addons-bloomfilters/6c7d9b78-4642-461c-9b2d-b802ccd7a1d5.bin HTTP/1.1
Host: firefox-settings-attachments.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-guploader-uploadid: ADPycduhTbxLTpdHHN8-SuYxFE79rTn1EVCpynUwhTLhx7Slql4J9bxYQWP1oV1MBzGRamdRTIbknEU67G6zpVMezCmM
x-goog-generation: 1690223885754624
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 817083
x-goog-hash: crc32c=NmyCHA==, md5=a1sVNyyhCNSzPK8C7QFvPg==
x-goog-storage-class: STANDARD
accept-ranges: bytes
content-length: 817083
server: UploadServer
date: Fri, 06 Oct 2023 10:21:14 GMT
cache-control: public,max-age=604800
age: 587758
last-modified: Mon, 24 Jul 2023 18:38:05 GMT
etag: "6b5b15372ca108d4b33caf02ed016f3e"
content-type: application/octet-stream
alt-svc: clear
X-Firefox-Spdy: h2
3dsa62.gaokejd.xyz/fserver/files/gb/141/carousel/10366/1678507559237.jpg?wsSecret=89c60928d7294c21e01135b2f0a263a9&wsTime=1697175419
200 OK 386 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/fserver/files/gb/141/carousel/10366/1678507559237.jpg?wsSecret=89c60928d7294c21e01135b2f0a263a9&wsTime=1697175419
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 694x520, components 3\012- data
Size 386 kB (386527 bytes)
Hash 81a5f65507df89f605fbf600872099fe
791d238960719ed5e3dd17b592c868d029dbc7a4
656130b23da3fb9ce75eee3708b6f22f7c160f1640f7e858ffa64bc054856519
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /fserver/files/gb/141/carousel/10366/1678507559237.jpg?wsSecret=89c60928d7294c21e01135b2f0a263a9&wsTime=1697175419 HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 386527
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-04
ETag: "640bfe27-5e5df"
Date: Thu, 28 Sep 2023 08:09:32 GMT
Last-Modified: Sat, 11 Mar 2023 04:05:59 GMT
Expires: Sat, 28 Oct 2023 08:09:32 GMT
Age: 1286847
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: MISS
uuid: -
out-line: gb-cdn-204
x-link-via: xg03:443;xg12:80;
X-Cache-Status: HIT from KS-CLOUD-XG-FOREIGN-12-04, HIT from KS-CLOUD-XG-03-09
X-Cdn-Request-ID: 87adcecff4fe50c62b2a1de1fd67c3d3
vue.livehelp100service.com/visitorside/js/Button.fa84d0c8.js
200 OK 9.7 kB URL GET HTTP/2 vue.livehelp100service.com/visitorside/js/Button.fa84d0c8.js
IP
Requested by https://www.36596666.net:8989/
Certificate IssuerAmazon
Subject*.livehelp100service.com
Fingerprint64:45:EC:14:03:13:80:70:27:C3:0D:CA:0D:28:F6:FA:05:0E:D3:D0
ValidityTue, 15 Aug 2023 00:00:00 GMT - Thu, 12 Sep 2024 23:59:59 GMT
File type ASCII text, with very long lines (9846), with no line terminators
Hash f4b75a65708568ed20cb1c0c5ff526b5
fcc8b2cc155327433213703a0b3ce4a564b2dd45
95e6c40191a50b016b493df94625397c9766dccc6ae7b5b0d5e051663916a61b
GET /visitorside/js/Button.fa84d0c8.js HTTP/1.1
Host: vue.livehelp100service.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.36596666.net:8989
DNT: 1
Connection: keep-alive
Referer: https://vue.livehelp100service.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript
date: Fri, 13 Oct 2023 03:22:09 GMT
server: nginx/1.22.1
last-modified: Wed, 20 Sep 2023 11:00:34 GMT
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
access-control-expose-headers: Content-Length,Content-Range
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: br
etag: W/"650ad0d2-25cd"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 96c778ce6156d12f24b8b6cdaa0cbf66.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: xVosypze-iH24JX7C6sPDOiHlvTE-EyRUf_n_APiiBYb51f7MdwG7g==
age: 8093
X-Firefox-Spdy: h2
3dsa62.gaokejd.xyz/fserver/files/gb/141/floatImage/273/1666693826530.png?wsSecret=52a9eda0df4b67e2e93671131f130fa9&wsTime=1697175419
200 OK 8.6 kB URL GET HTTP/1.1 3dsa62.gaokejd.xyz/fserver/files/gb/141/floatImage/273/1666693826530.png?wsSecret=52a9eda0df4b67e2e93671131f130fa9&wsTime=1697175419
IP
ASN #137280 Kingsoft cloud corporation limited
Requested by https://www.36596666.net:8989/
Certificate IssuerSectigo Limited
Subject*.gaokejd.xyz
FingerprintBF:3B:B1:34:33:54:2B:51:01:C2:15:B8:63:A1:ED:18:22:95:04:03
ValidityTue, 29 Nov 2022 00:00:00 GMT - Wed, 29 Nov 2023 23:59:59 GMT
File type PNG image data, 140 x 35, 8-bit/color RGBA, non-interlaced\012- data
Hash e9b65c8ad826f51a6e0d8b30801ebe97
a6b5f8cf0772e12117fe5db956482ed8f15140d5
2a2c01d75b9b60e977fb5a8e535fc8ea4e9146bb499e2af25ccf1bd5ebaaf840
Analyzer Verdict Alert urlquery phishing Phishing - Bet365
GET /fserver/files/gb/141/floatImage/273/1666693826530.png?wsSecret=52a9eda0df4b67e2e93671131f130fa9&wsTime=1697175419 HTTP/1.1
Host: 3dsa62.gaokejd.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 8612
Connection: keep-alive
Server: Default-server-KS-CLOUD-XG-FOREIGN-12-02
ETag: "6357bac2-21a4"
Date: Thu, 28 Sep 2023 08:06:26 GMT
Last-Modified: Tue, 25 Oct 2022 10:30:26 GMT
Expires: Sat, 28 Oct 2023 08:06:26 GMT
Age: 1287034
Cache-Control: max-age=86400
Accept-Ranges: bytes
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: MISS
uuid: -
out-line: gb-cdn-205
x-link-via: xg03:443;xg12:80;
X-Cache-Status: MISS from KS-CLOUD-XG-FOREIGN-12-02, HIT from KS-CLOUD-XG-FOREIGN-03-11
X-Cdn-Request-ID: 2ac839e900f28d270dfe1de34890c818
786ad.239tgaaagf.com/visitor.ashx?siteId=65000584
200 OK 1.3 kB URL POST HTTP/2 786ad.239tgaaagf.com/visitor.ashx?siteId=65000584
IP
Requested by https://www.36596666.net:8989/
Certificate IssuerAmazon
Subject*.livehelp100service.com
Fingerprint30:5B:92:F8:D3:3F:D6:BC:AB:CB:92:F8:DB:62:DE:57:A3:32:FC:AC
ValidityFri, 11 Aug 2023 00:00:00 GMT - Sun, 08 Sep 2024 23:59:59 GMT
File type HTML document, ASCII text, with very long lines (1405), with no line terminators
Hash 07aec707a9be30fd34d401b0980c1053
52bc9d27748972e500b931f87fe131a320ed3d96
dc29cc96fb32ffa7aeb5dcb290da778d4d253d04abc42e8f11ab98ad403399d2
POST /visitor.ashx?siteId=65000584 HTTP/1.1
Host: 786ad.239tgaaagf.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 69
Origin: https://www.36596666.net:8989
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 13 Oct 2023 05:37:01 GMT
content-type: text/json
server: nginx
access-control-allow-credentials: true
access-control-allow-origin: https://www.36596666.net:8989
arrserver: chatserver2
p3p: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-security-policy: default-src 'self'
referrer-policy: no-referrer
X-Firefox-Spdy: h2
786ad.239tgaaagf.com/campaign.ashx?siteId=65000584&campaignId=10b42444-f030-4724-9472-c5b49997c716&lastUpdateTime=000000000B173E4B
200 OK 14 kB URL GET HTTP/2 786ad.239tgaaagf.com/campaign.ashx?siteId=65000584&campaignId=10b42444-f030-4724-9472-c5b49997c716&lastUpdateTime=000000000B173E4B
IP
Requested by https://www.36596666.net:8989/
Certificate IssuerAmazon
Subject*.livehelp100service.com
Fingerprint30:5B:92:F8:D3:3F:D6:BC:AB:CB:92:F8:DB:62:DE:57:A3:32:FC:AC
ValidityFri, 11 Aug 2023 00:00:00 GMT - Sun, 08 Sep 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /campaign.ashx?siteId=65000584&campaignId=10b42444-f030-4724-9472-c5b49997c716&lastUpdateTime=000000000B173E4B HTTP/1.1
Host: 786ad.239tgaaagf.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.36596666.net:8989
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 13 Oct 2023 05:37:02 GMT
content-type: text/json
server: nginx
access-control-allow-origin: *
cache-control: max-age=31536000
arrserver: chatserver2
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-security-policy: default-src 'self'
referrer-policy: no-referrer
X-Firefox-Spdy: h2
www.36596666.net:8989/fserver/files/sportTeam/football/cba03.png
200 OK 33 kB URL GET HTTP/1.1 www.36596666.net:8989/fserver/files/sportTeam/football/cba03.png
IP
ASN #140227 Hong Kong Communications International Co., Limited
Requested by https://www.36596666.net:8989/
Certificate IssuerLet's Encrypt
Subject36596666.net
Fingerprint7E:BE:29:5F:99:71:BE:8B:E6:24:B9:93:22:28:9C:0B:05:E5:45:11
ValiditySat, 29 Jul 2023 15:19:53 GMT - Fri, 27 Oct 2023 15:19:52 GMT
File type PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced\012- data
Hash 63532c1597fcc2e435603c4776bbae79
870e1c879a668f1177469d56da4966e64c3fb16b
d6cc6c514c5a87114fe22042a1df1eada9224a20b2c20ca42e5bbd51f28f7ecd
GET /fserver/files/sportTeam/football/cba03.png HTTP/1.1
Host: www.36596666.net:8989
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Cookie: sticket=l1TVRVME9tTmhNV00; route=6fc16a063046d21fc2e5f5c026f90787; _ga_B5HTXF8BMH=GS1.1.1697175421.1.0.1697175421.0.0.0; _ga=GA1.1.444583028.1697175421
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2023 05:37:01 GMT
Content-Type: image/png
Content-Length: 32676
Connection: keep-alive
Last-Modified: Thu, 06 Dec 2018 10:52:24 GMT
Vary: Accept-Encoding
ETag: "5c08ff68-7fa4"
Expires: Sat, 14 Oct 2023 05:37:01 GMT
Cache-Control: max-age=86400
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Cache: HIT
uuid: -
out-line: gb-site-097
Accept-Ranges: bytes
vue.livehelp100service.com/visitorside/js/common.80370cb8.js
200 OK 67 kB URL GET HTTP/2 vue.livehelp100service.com/visitorside/js/common.80370cb8.js
IP
Requested by https://www.36596666.net:8989/
Certificate IssuerAmazon
Subject*.livehelp100service.com
Fingerprint64:45:EC:14:03:13:80:70:27:C3:0D:CA:0D:28:F6:FA:05:0E:D3:D0
ValidityTue, 15 Aug 2023 00:00:00 GMT - Thu, 12 Sep 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /visitorside/js/common.80370cb8.js HTTP/1.1
Host: vue.livehelp100service.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.36596666.net:8989
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript
date: Fri, 13 Oct 2023 02:21:38 GMT
server: nginx/1.22.1
last-modified: Wed, 20 Sep 2023 11:00:35 GMT
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
access-control-expose-headers: Content-Length,Content-Range
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: br
etag: W/"650ad0d3-10474"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 96c778ce6156d12f24b8b6cdaa0cbf66.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: VxC4Cq3Tahb04zf5yYFbu-aWIk9ktk0tQfSuRCsaJLuwYpCzr0YaiA==
age: 11722
X-Firefox-Spdy: h2
786ad.239tgaaagf.com/visitor.ashx?siteId=65000584
200 OK 1.4 kB URL POST HTTP/2 786ad.239tgaaagf.com/visitor.ashx?siteId=65000584
IP
Requested by https://www.36596666.net:8989/
Certificate IssuerAmazon
Subject*.livehelp100service.com
Fingerprint30:5B:92:F8:D3:3F:D6:BC:AB:CB:92:F8:DB:62:DE:57:A3:32:FC:AC
ValidityFri, 11 Aug 2023 00:00:00 GMT - Sun, 08 Sep 2024 23:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (1464), with no line terminators
Hash a9e3eabebd219eba7465edf0df195feb
546a97dbbaf450b8328034a4494dc0eb928ba296
ef7d65082d88a7374833f010b46f92f8ec5be9ca94818ca74a085e9b705f2f89
POST /visitor.ashx?siteId=65000584 HTTP/1.1
Host: 786ad.239tgaaagf.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 1347
Origin: https://www.36596666.net:8989
DNT: 1
Connection: keep-alive
Referer: https://www.36596666.net:8989/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 13 Oct 2023 05:37:01 GMT
content-type: text/json
server: nginx
access-control-allow-credentials: true
access-control-allow-origin: https://www.36596666.net:8989
set-cookie: visitorGuid_65000584=60db29b1-ddce-4bf0-aa7d-2fa71cbee886; expires=Thu, 13 Feb 3023 05:37:01 GMT; path=/; secure; samesite=none
arrserver: chatserver2
p3p: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-security-policy: default-src 'self'
referrer-policy: no-referrer
X-Firefox-Spdy: h2
43.198.190.53
35.244.181.201
104.18.14.101
104.250.33.35
2.22.61.56