Edit tour

Windows Analysis Report
http://888881e.com/

Overview

General Information

Sample URL:	http://888881e.com/
Analysis ID:	1637076
Infos:

Detection

Score:	56
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Executes massive DNS lookups (> 100)

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2544 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 4504 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2224,i,6825167350514398730,10082469752665076186,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6780 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://888881e.com/" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: http://888881e.com/

Avira URL Cloud: detection malicious, Label: phishing

Antivirus detection for URL or domain

Source: http://888881e.com/layer/skin/default/loading-0.gif	Avira URL Cloud: Label: phishing
Source: http://888881e.com/layer/x.html	Avira URL Cloud: Label: phishing
Source: http://888881e.com/static/picture/4_qiu.png	Avira URL Cloud: Label: phishing
Source: http://888881e.com/layer/skin/layer.css	Avira URL Cloud: Label: phishing
Source: http://888881e.com/static/image/kf.png	Avira URL Cloud: Label: phishing
Source: http://888881e.com/layer/skin/default/icon.png	Avira URL Cloud: Label: phishing
Source: http://888881e.com/layer/layer.js	Avira URL Cloud: Label: phishing
Source: http://888881e.com/static/picture/bg.jpg	Avira URL Cloud: Label: phishing
Source: http://888881e.com/favicon.ico	Avira URL Cloud: Label: phishing
Source: http://888881e.com/static/image/favicon.ico	Avira URL Cloud: Label: phishing
Source: http://888881e.com/static/image/bet365.png	Avira URL Cloud: Label: phishing
Source: http://888881e.com/static/image/hover.png	Avira URL Cloud: Label: phishing
Source: https://365.qwe123-asd456-zxc789.qiuyeqgmsyumeise.com/	Avira URL Cloud: Label: phishing
Source: http://888881e.com/static/css/reset.css	Avira URL Cloud: Label: phishing
Source: http://888881e.com/static/picture/logo.png	Avira URL Cloud: Label: phishing
Source: http://888881e.com/static/image/jh.png	Avira URL Cloud: Label: phishing
Source: http://888881e.com/betx.txt	Avira URL Cloud: Label: phishing
Source: http://888881e.com/layer/jquery-1.8.3.min.js	Avira URL Cloud: Label: phishing

Source: https://www.365920.top/js/cms-sports.4e4070db.js

HTTP Parser: "use strict";(self["cms_tpl"]=self["cms_tpl"]||[]).push([[39137],{45371:function(e,t,o){o.d(t,{z:function(){return n}});const n="data:audio/mpeg;base64,suqzbaaaaaaae1rywfgaaaasaaadbwfqb3jfynjhbmqacxqgiabuwfhyaaaaeqaaa21pbm9yx3zlcnnpb24amabuwfhyaaaagaaaa2nvbxbhdglibgvfynjhbmrzahf0icaavfntrqaaaa4aaanmyxzmntguos4xmdaaaaaaaaaaaaaaap/7uaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaeluzm8aaaapaaaagaaaj/8adw8pdxoaghokjcqkli4uljk5otldq0ndtk5otk5ywfhyy2njy21tbw14ehh4gokcgo2njy2nl5exl6ghoagsrkystra2tshbwchly8vly9bw1tbg4odg6+vr6/x19fx/////aaaaaexhdmm1oc4xmqaaaaaaaaaaaaaaacqcqaaaaaaaacf/p4stjqaaaaaaaaaaaaaaaaaaaad/+5bkaa/waabpaaaacaaadsaaaaeaaagkaaaaiaaaniaaaarmqu1fmy45os41vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvmqu1fmy45os41vvvvvvvvvvvvvvvvvvvv...

Source: http://888881e.com/	HTTP Parser: No favicon
Source: http://888881e.com/url/bet.html	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.92.38.89:443 -> 192.168.2.11:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.92.38.89:443 -> 192.168.2.11:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.92.38.89:443 -> 192.168.2.11:50043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50028 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50069 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50055 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 43.252.161.7:443 -> 192.168.2.11:50081 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 43.252.161.7:443 -> 192.168.2.11:50079 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 43.252.161.7:443 -> 192.168.2.11:50084 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 43.252.161.7:443 -> 192.168.2.11:50106 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50118 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50125 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 43.252.161.7:443 -> 192.168.2.11:50127 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50132 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50137 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 43.252.161.7:443 -> 192.168.2.11:50136 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50151 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50154 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.92.38.89:443 -> 192.168.2.11:50157 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50159 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50170 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50167 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.92.38.89:443 -> 192.168.2.11:50180 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.92.38.89:443 -> 192.168.2.11:50176 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50187 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50188 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50193 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.92.38.89:443 -> 192.168.2.11:50194 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.92.38.89:443 -> 192.168.2.11:50189 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50195 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50192 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50196 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.92.38.89:443 -> 192.168.2.11:50199 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50201 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50202 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.92.38.89:443 -> 192.168.2.11:50200 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50204 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50205 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50203 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50215 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.92.38.89:443 -> 192.168.2.11:50218 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.92.38.89:443 -> 192.168.2.11:50219 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.92.38.89:443 -> 192.168.2.11:50222 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.92.38.89:443 -> 192.168.2.11:50227 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.92.38.89:443 -> 192.168.2.11:50226 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.92.38.89:443 -> 192.168.2.11:50220 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 43.252.161.7:443 -> 192.168.2.11:50235 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50234 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50221 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.92.38.89:443 -> 192.168.2.11:50223 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.92.38.89:443 -> 192.168.2.11:50230 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 43.252.161.7:443 -> 192.168.2.11:50232 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.92.38.89:443 -> 192.168.2.11:50237 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50233 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50231 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.92.38.89:443 -> 192.168.2.11:50229 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.146.55:443 -> 192.168.2.11:50239 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.144.107:443 -> 192.168.2.11:50085 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.144.107:443 -> 192.168.2.11:50091 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.144.107:443 -> 192.168.2.11:50093 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.144.107:443 -> 192.168.2.11:50114 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.144.107:443 -> 192.168.2.11:50117 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.144.107:443 -> 192.168.2.11:50123 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.144.107:443 -> 192.168.2.11:50101 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.144.107:443 -> 192.168.2.11:50108 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.144.107:443 -> 192.168.2.11:50152 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.144.107:443 -> 192.168.2.11:50139 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.144.107:443 -> 192.168.2.11:50224 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.144.107:443 -> 192.168.2.11:50228 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.144.107:443 -> 192.168.2.11:50225 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.203.144.107:443 -> 192.168.2.11:50238 version: TLS 1.2

Source: global traffic	TCP traffic: 192.168.2.11:49768 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.11:49864 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.11:49783 -> 1.1.1.1:53

Source: global traffic

DNS traffic detected: number of DNS queries: 223

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.7
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.7
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.35
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.35
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.35
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.7
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.35
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.35
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.7
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.35
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.35
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.365920.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: http://888881e.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.365909.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: http://888881e.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365.505-606-707-808-909.365933.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: http://888881e.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365.505-606-707-808-909.365931.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: http://888881e.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365903.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: http://888881e.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365901.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: http://888881e.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365908.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: http://888881e.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.365906.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: http://888881e.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.365915.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: http://888881e.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365913.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: http://888881e.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365910.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: http://888881e.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365919.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: http://888881e.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.365911.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: http://888881e.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365917.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: http://888881e.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365920.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: http://888881e.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.365916.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: http://888881e.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365.qwe123-asd456-zxc789.365908.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: http://888881e.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.365909.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.365651.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: http://888881e.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.ksaoksockaogumcu.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: http://888881e.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365.qwe123-asd456-zxc789.365911.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: http://888881e.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365.qwe123-asd456-zxc789.365623.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: http://888881e.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.3836bet.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: http://888881e.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365904.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: http://888881e.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365.qwe123-asd456-zxc789.365627.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: http://888881e.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365.qwe123-asd456-zxc789.365645.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: http://888881e.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365901.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365908.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365913.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365902.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365920.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365.505-606-707-808-909.365933.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365.qwe123-asd456-zxc789.365908.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365.505-606-707-808-909.365931.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365.qwe123-asd456-zxc789.365902.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.365902.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365.qwe123-asd456-zxc789.3503bet.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365.qwe123-asd456-zxc789.ksaoksockaogumcu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365.qwe123-asd456-zxc789.365621.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365.qwe123-asd456-zxc789.365603.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.3507bet.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365.qwe123-asd456-zxc789.3509bet.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365.505-606-707-808-909.365934.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365.qwe123-asd456-zxc789.3502bet.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365.qwe123-asd456-zxc789.qiuyeqgmsyumeise.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365.qwe123-asd456-zxc789.365674.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365.qwe123-asd456-zxc789.365683.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365.qwe123-asd456-zxc789.0353bet.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365.qwe123-asd456-zxc789.365677.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365.qwe123-asd456-zxc789.365659.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365.qwe123-asd456-zxc789.365665.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365.qwe123-asd456-zxc789.365660.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365.qwe123-asd456-zxc789.3835bet.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365.qwe123-asd456-zxc789.365619.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/chunk-vendors.09a194bd.css HTTP/1.1Host: www.365920.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.365920.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365.qwe123-asd456-zxc789.365919.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 365917.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/cms-sports.a8449357.css HTTP/1.1Host: www.365920.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.365920.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET /configPage.js HTTP/1.1Host: www.365920.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.365920.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET /config/initGeetest4.js HTTP/1.1Host: www.365920.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.365920.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET /theme.config.c2bc06b4.js HTTP/1.1Host: www.365920.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.365920.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET /js/chunk-vendors.40c3fb70.js HTTP/1.1Host: www.365920.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.365920.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET /js/cms-sports.4e4070db.js HTTP/1.1Host: www.365920.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.365920.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET /js/index.68482a3f.js HTTP/1.1Host: www.365920.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.365920.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.365620.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/chunk-common.d0c95296.css HTTP/1.1Host: www.365920.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.365920.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET /css/52351.acaf9ede.css HTTP/1.1Host: www.365920.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.365920.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET /css/home.294d25c7.css HTTP/1.1Host: www.365920.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.365920.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET /js/chunk-common.b186ab9f.js HTTP/1.1Host: www.365920.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.365920.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET /js/88495.59166de1.js HTTP/1.1Host: www.365920.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.365920.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET /js/73316.5a7c8b75.js HTTP/1.1Host: www.365920.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.365920.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET /js/52351.a7a197c2.js HTTP/1.1Host: www.365920.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.365920.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET /js/home.90ec6cf4.js HTTP/1.1Host: www.365920.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.365920.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET /kc338-1/sponsor/sponsor.json?1740114807189 HTTP/1.1Host: www.365920.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/plain, /sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.365920.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET /kc338-1/sponsor/sponsor_nav_web_1.png?1740114807189 HTTP/1.1Host: www.365920.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.365920.top/homeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET /kc338-1/sponsor/sponsor_nav_web_2.png?1740114807189 HTTP/1.1Host: www.365920.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.365920.top/homeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET /img/appdown.6e7c9177.png HTTP/1.1Host: www.365920.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.365920.top/css/cms-sports.a8449357.cssAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET /kc338-1/sponsor/sponsor_nav_web_3.png?1740114807189 HTTP/1.1Host: www.365920.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.365920.top/homeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET /img/bj1.17ef2db8.png HTTP/1.1Host: www.365920.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.365920.top/css/home.294d25c7.cssAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET /img/bj.ada43481.png HTTP/1.1Host: www.365920.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.365920.top/css/home.294d25c7.cssAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET /kc338-1/sponsor/sponsor.json?1740114807189 HTTP/1.1Host: www.365920.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET /img/help.4e3cf897.png HTTP/1.1Host: www.365920.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.365920.top/css/cms-sports.a8449357.cssAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET /img/service.68be110a.png HTTP/1.1Host: www.365920.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.365920.top/css/cms-sports.a8449357.cssAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET /kc338-1/sponsor/sponsor_web_2.png?1740114807189 HTTP/1.1Host: www.365920.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.365920.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET /kc338-1/sponsor/sponsor_web_3.png?1740114807189 HTTP/1.1Host: www.365920.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.365920.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET /kc338-1/sponsor/sponsor_nav_web_1.png?1740114807189 HTTP/1.1Host: www.365920.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET /kc338-1/sponsor/sponsor_nav_web_2.png?1740114807189 HTTP/1.1Host: www.365920.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET /img/appdown.6e7c9177.png HTTP/1.1Host: www.365920.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET /kc338-1/sponsor/sponsor_nav_web_3.png?1740114807189 HTTP/1.1Host: www.365920.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET /kc338-1/sponsor/sponsor_web_1.png?1740114807189 HTTP/1.1Host: www.365920.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.365920.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET /img/bj1.17ef2db8.png HTTP/1.1Host: www.365920.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: rcCode=xinym
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 888881e.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/reset.css HTTP/1.1Host: 888881e.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://888881e.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/js.js HTTP/1.1Host: 888881e.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Referer: http://888881e.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/picture/logo.png HTTP/1.1Host: 888881e.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://888881e.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/picture/4_qiu.png HTTP/1.1Host: 888881e.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://888881e.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /layer/jquery-1.8.3.min.js HTTP/1.1Host: 888881e.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Referer: http://888881e.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /layer/layer.js HTTP/1.1Host: 888881e.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Referer: http://888881e.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js-sdk-pro.min.js HTTP/1.1Host: sdk.51.laConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Referer: http://888881e.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/image/app.png HTTP/1.1Host: 888881e.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://888881e.com/static/css/reset.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/image/kf.png HTTP/1.1Host: 888881e.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://888881e.com/static/css/reset.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/image/jh.png HTTP/1.1Host: 888881e.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://888881e.com/static/css/reset.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/picture/bg.jpg HTTP/1.1Host: 888881e.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://888881e.com/static/css/reset.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/image/bet365.png HTTP/1.1Host: 888881e.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://888881e.com/static/css/reset.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/image/hover.png HTTP/1.1Host: 888881e.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://888881e.com/static/css/reset.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/picture/logo.png HTTP/1.1Host: 888881e.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/picture/4_qiu.png HTTP/1.1Host: 888881e.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/image/jh.png HTTP/1.1Host: 888881e.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/image/bet365.png HTTP/1.1Host: 888881e.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/image/hover.png HTTP/1.1Host: 888881e.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/image/app.png HTTP/1.1Host: 888881e.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/image/kf.png HTTP/1.1Host: 888881e.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/picture/bg.jpg HTTP/1.1Host: 888881e.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __vtins__Kb2PYob7U8z6aJo7=%7B%22sid%22%3A%20%228e327b52-f3b2-5381-9105-f9af2dfa4c3f%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201741860859909%2C%20%22ct%22%3A%201741859059909%7D; __51uvsct__Kb2PYob7U8z6aJo7=1; __51vcke__Kb2PYob7U8z6aJo7=6249b691-833c-58d3-8ed3-25dbb88196e4; __51vuft__Kb2PYob7U8z6aJo7=1741859059920
Source: global traffic	HTTP traffic detected: GET /v6/collect?dt=4 HTTP/1.1Host: collect-v6.51.laConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /layer/skin/layer.css HTTP/1.1Host: 888881e.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://888881e.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __vtins__Kb2PYob7U8z6aJo7=%7B%22sid%22%3A%20%228e327b52-f3b2-5381-9105-f9af2dfa4c3f%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201741860859909%2C%20%22ct%22%3A%201741859059909%7D; __51uvsct__Kb2PYob7U8z6aJo7=1; __51vcke__Kb2PYob7U8z6aJo7=6249b691-833c-58d3-8ed3-25dbb88196e4; __51vuft__Kb2PYob7U8z6aJo7=1741859059920
Source: global traffic	HTTP traffic detected: GET /layer/x.html HTTP/1.1Host: 888881e.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://888881e.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __vtins__Kb2PYob7U8z6aJo7=%7B%22sid%22%3A%20%228e327b52-f3b2-5381-9105-f9af2dfa4c3f%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201741860859909%2C%20%22ct%22%3A%201741859059909%7D; __51uvsct__Kb2PYob7U8z6aJo7=1; __51vcke__Kb2PYob7U8z6aJo7=6249b691-833c-58d3-8ed3-25dbb88196e4; __51vuft__Kb2PYob7U8z6aJo7=1741859059920
Source: global traffic	HTTP traffic detected: GET /layer/skin/default/loading-0.gif HTTP/1.1Host: 888881e.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://888881e.com/layer/skin/layer.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __vtins__Kb2PYob7U8z6aJo7=%7B%22sid%22%3A%20%228e327b52-f3b2-5381-9105-f9af2dfa4c3f%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201741860859909%2C%20%22ct%22%3A%201741859059909%7D; __51uvsct__Kb2PYob7U8z6aJo7=1; __51vcke__Kb2PYob7U8z6aJo7=6249b691-833c-58d3-8ed3-25dbb88196e4; __51vuft__Kb2PYob7U8z6aJo7=1741859059920
Source: global traffic	HTTP traffic detected: GET /layer/skin/default/icon.png HTTP/1.1Host: 888881e.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://888881e.com/layer/skin/layer.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __vtins__Kb2PYob7U8z6aJo7=%7B%22sid%22%3A%20%228e327b52-f3b2-5381-9105-f9af2dfa4c3f%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201741860859909%2C%20%22ct%22%3A%201741859059909%7D; __51uvsct__Kb2PYob7U8z6aJo7=1; __51vcke__Kb2PYob7U8z6aJo7=6249b691-833c-58d3-8ed3-25dbb88196e4; __51vuft__Kb2PYob7U8z6aJo7=1741859059920
Source: global traffic	HTTP traffic detected: GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /layer/skin/default/icon.png HTTP/1.1Host: 888881e.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __vtins__Kb2PYob7U8z6aJo7=%7B%22sid%22%3A%20%228e327b52-f3b2-5381-9105-f9af2dfa4c3f%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201741860859909%2C%20%22ct%22%3A%201741859059909%7D; __51uvsct__Kb2PYob7U8z6aJo7=1; __51vcke__Kb2PYob7U8z6aJo7=6249b691-833c-58d3-8ed3-25dbb88196e4; __51vuft__Kb2PYob7U8z6aJo7=1741859059920
Source: global traffic	HTTP traffic detected: GET /layer/skin/default/loading-0.gif HTTP/1.1Host: 888881e.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __vtins__Kb2PYob7U8z6aJo7=%7B%22sid%22%3A%20%228e327b52-f3b2-5381-9105-f9af2dfa4c3f%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201741860859909%2C%20%22ct%22%3A%201741859059909%7D; __51uvsct__Kb2PYob7U8z6aJo7=1; __51vcke__Kb2PYob7U8z6aJo7=6249b691-833c-58d3-8ed3-25dbb88196e4; __51vuft__Kb2PYob7U8z6aJo7=1741859059920
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /static/image/favicon.ico HTTP/1.1Host: 888881e.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://888881e.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __vtins__Kb2PYob7U8z6aJo7=%7B%22sid%22%3A%20%228e327b52-f3b2-5381-9105-f9af2dfa4c3f%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201741860859909%2C%20%22ct%22%3A%201741859059909%7D; __51uvsct__Kb2PYob7U8z6aJo7=1; __51vcke__Kb2PYob7U8z6aJo7=6249b691-833c-58d3-8ed3-25dbb88196e4; __51vuft__Kb2PYob7U8z6aJo7=1741859059920
Source: global traffic	HTTP traffic detected: GET /static/image/favicon.ico HTTP/1.1Host: 888881e.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __vtins__Kb2PYob7U8z6aJo7=%7B%22sid%22%3A%20%228e327b52-f3b2-5381-9105-f9af2dfa4c3f%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201741860859909%2C%20%22ct%22%3A%201741859059909%7D; __51uvsct__Kb2PYob7U8z6aJo7=1; __51vcke__Kb2PYob7U8z6aJo7=6249b691-833c-58d3-8ed3-25dbb88196e4; __51vuft__Kb2PYob7U8z6aJo7=1741859059920
Source: global traffic	HTTP traffic detected: GET /url/bet.html HTTP/1.1Host: 888881e.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://888881e.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __vtins__Kb2PYob7U8z6aJo7=%7B%22sid%22%3A%20%228e327b52-f3b2-5381-9105-f9af2dfa4c3f%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201741860859909%2C%20%22ct%22%3A%201741859059909%7D; __51uvsct__Kb2PYob7U8z6aJo7=1; __51vcke__Kb2PYob7U8z6aJo7=6249b691-833c-58d3-8ed3-25dbb88196e4; __51vuft__Kb2PYob7U8z6aJo7=1741859059920
Source: global traffic	HTTP traffic detected: GET /betx.txt HTTP/1.1Host: 888881e.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Referer: http://888881e.com/url/bet.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __vtins__Kb2PYob7U8z6aJo7=%7B%22sid%22%3A%20%228e327b52-f3b2-5381-9105-f9af2dfa4c3f%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201741860859909%2C%20%22ct%22%3A%201741859059909%7D; __51uvsct__Kb2PYob7U8z6aJo7=1; __51vcke__Kb2PYob7U8z6aJo7=6249b691-833c-58d3-8ed3-25dbb88196e4; __51vuft__Kb2PYob7U8z6aJo7=1741859059920
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: 888881e.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://888881e.com/url/bet.htmlAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __vtins__Kb2PYob7U8z6aJo7=%7B%22sid%22%3A%20%228e327b52-f3b2-5381-9105-f9af2dfa4c3f%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201741860859909%2C%20%22ct%22%3A%201741859059909%7D; __51uvsct__Kb2PYob7U8z6aJo7=1; __51vcke__Kb2PYob7U8z6aJo7=6249b691-833c-58d3-8ed3-25dbb88196e4; __51vuft__Kb2PYob7U8z6aJo7=1741859059920
Source: global traffic	HTTP traffic detected: GET /betx.txt HTTP/1.1Host: 888881e.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __vtins__Kb2PYob7U8z6aJo7=%7B%22sid%22%3A%20%228e327b52-f3b2-5381-9105-f9af2dfa4c3f%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201741860859909%2C%20%22ct%22%3A%201741859059909%7D; __51uvsct__Kb2PYob7U8z6aJo7=1; __51vcke__Kb2PYob7U8z6aJo7=6249b691-833c-58d3-8ed3-25dbb88196e4; __51vuft__Kb2PYob7U8z6aJo7=1741859059920
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: 888881e.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __vtins__Kb2PYob7U8z6aJo7=%7B%22sid%22%3A%20%228e327b52-f3b2-5381-9105-f9af2dfa4c3f%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201741860859909%2C%20%22ct%22%3A%201741859059909%7D; __51uvsct__Kb2PYob7U8z6aJo7=1; __51vcke__Kb2PYob7U8z6aJo7=6249b691-833c-58d3-8ed3-25dbb88196e4; __51vuft__Kb2PYob7U8z6aJo7=1741859059920

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: 888881e.com
Source: global traffic	DNS traffic detected: DNS query: sdk.51.la
Source: global traffic	DNS traffic detected: DNS query: os-js.com
Source: global traffic	DNS traffic detected: DNS query: collect-v6.51.la
Source: global traffic	DNS traffic detected: DNS query: 365.505-606-707-808-909.365938.top
Source: global traffic	DNS traffic detected: DNS query: 365.505-606-707-808-909.365937.top
Source: global traffic	DNS traffic detected: DNS query: 365.505-606-707-808-909.365936.top
Source: global traffic	DNS traffic detected: DNS query: 365.505-606-707-808-909.365935.top
Source: global traffic	DNS traffic detected: DNS query: 365.505-606-707-808-909.365934.top
Source: global traffic	DNS traffic detected: DNS query: 365.505-606-707-808-909.365933.top
Source: global traffic	DNS traffic detected: DNS query: 365.505-606-707-808-909.365932.top
Source: global traffic	DNS traffic detected: DNS query: 365.505-606-707-808-909.365931.top
Source: global traffic	DNS traffic detected: DNS query: 365.505-606-707-808-909.365929.top
Source: global traffic	DNS traffic detected: DNS query: 365.505-606-707-808-909.365926.top
Source: global traffic	DNS traffic detected: DNS query: 365.505-606-707-808-909.365925.top
Source: global traffic	DNS traffic detected: DNS query: 365.505-606-707-808-909.365924.top
Source: global traffic	DNS traffic detected: DNS query: 365.505-606-707-808-909.365923.top
Source: global traffic	DNS traffic detected: DNS query: 365.505-606-707-808-909.365922.top
Source: global traffic	DNS traffic detected: DNS query: 365901.top
Source: global traffic	DNS traffic detected: DNS query: 365903.top
Source: global traffic	DNS traffic detected: DNS query: 365907.top
Source: global traffic	DNS traffic detected: DNS query: 365908.top
Source: global traffic	DNS traffic detected: DNS query: 365909.top
Source: global traffic	DNS traffic detected: DNS query: 365910.top
Source: global traffic	DNS traffic detected: DNS query: 365913.top
Source: global traffic	DNS traffic detected: DNS query: 365917.top
Source: global traffic	DNS traffic detected: DNS query: 365919.top
Source: global traffic	DNS traffic detected: DNS query: 365920.top
Source: global traffic	DNS traffic detected: DNS query: www.365920.top
Source: global traffic	DNS traffic detected: DNS query: www.365919.top
Source: global traffic	DNS traffic detected: DNS query: www.365917.top
Source: global traffic	DNS traffic detected: DNS query: www.365916.top
Source: global traffic	DNS traffic detected: DNS query: www.365915.top
Source: global traffic	DNS traffic detected: DNS query: www.365912.top
Source: global traffic	DNS traffic detected: DNS query: www.365911.top
Source: global traffic	DNS traffic detected: DNS query: www.365910.top
Source: global traffic	DNS traffic detected: DNS query: www.365909.top
Source: global traffic	DNS traffic detected: DNS query: www.365908.top
Source: global traffic	DNS traffic detected: DNS query: www.365907.top
Source: global traffic	DNS traffic detected: DNS query: www.365906.top
Source: global traffic	DNS traffic detected: DNS query: www.365904.top
Source: global traffic	DNS traffic detected: DNS query: www.365903.top
Source: global traffic	DNS traffic detected: DNS query: www.365902.top
Source: global traffic	DNS traffic detected: DNS query: www.365901.top
Source: global traffic	DNS traffic detected: DNS query: www.365900.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365920.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365914.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365912.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365908.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365906.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365903.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365901.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365900.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365680.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365682.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365684.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365690.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365694.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365698.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.0350bet.com
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.3503bet.com
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.3505bet.com
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.3507bet.com
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.3508bet.com
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365602.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365603.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365604.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365606.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365608.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365609.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365610.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365611.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365613.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365615.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365616.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365620.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365621.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365624.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365626.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365628.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365630.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365632.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365634.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365635.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365642.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365644.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365646.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365647.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365650.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365654.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365656.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365657.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365662.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365663.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365668.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365669.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365670.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365672.top
Source: global traffic	DNS traffic detected: DNS query: 365.qwe123-asd456-zxc789.365673.top

Source: unknown

HTTP traffic detected: POST /v6/collect?dt=4 HTTP/1.1Host: collect-v6.51.laConnection: keep-aliveContent-Length: 264User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Origin: http://888881e.comReferer: http://888881e.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Data Raw: 1f 8b 08 00 f3 a8 d2 67 00 03 5d 90 c1 4e 03 21 14 45 7f a5 61 69 c4 81 c7 30 03 dd ba 52 37 26 a6 0b 97 c3 00 6a 3a 85 a6 33 4c 13 8d 7b bf c5 8d 3f e0 ef 98 f8 19 e5 d1 76 53 16 e4 72 ef cd cb 79 7c 90 59 de c6 cd 9d 25 cb 45 48 c3 70 bd 20 6f a8 c9 83 81 c7 e7 68 da 95 7a 6f ba fb d8 92 9c ec a6 9c f0 b6 e6 4a 6a 26 b5 66 3a 9b 13 9a e4 ef e7 f7 ff eb 1b 4b eb 3d be 51 d9 f1 ac c6 e3 4c e5 04 b4 46 02 f5 c2 00 95 42 71 aa 39 93 d4 eb ce 83 f5 5d dd 0b 8f f5 3e 61 fb 75 9a b6 cb aa 52 78 b8 bb e9 e3 a6 c2 70 5b c2 82 33 a0 e2 a0 d8 15 67 50 a3 35 74 e1 05 4d 17 e8 ea a9 8c 2a 74 29 ac 43 dc 17 92 19 49 38 26 ee 2c d0 81 1a c3 b2 0b 43 f4 dd 49 a4 79 ec 4f bd 74 5c a2 81 5a 9b 46 73 aa 84 e8 a9 54 56 50 e5 f2 05 d2 1a 93 49 75 e3 0a 4a f2 17 bf 05 ec f3 00 5c 72 59 5b 6e 01 00 00 Data Ascii: g]N!Eai0R7&j:3L{?vSry|Y%EHp ohzoJj&f:K=QLFBq9]>auRxp[3gP5tM*t)CI8&,CIyOt\ZFsTVPIuJ\rY[n

Source: chromecache_182.3.dr	String found in binary or memory: http://developer.yahoo.com/yui/license.html
Source: chromecache_182.3.dr, chromecache_133.3.dr	String found in binary or memory: http://hildenbiddle.com
Source: chromecache_182.3.dr	String found in binary or memory: http://underscorejs.org/LICENSE
Source: chromecache_92.3.dr	String found in binary or memory: https://github.com/emn178/js-md5
Source: chromecache_182.3.dr, chromecache_133.3.dr	String found in binary or memory: https://github.com/jhildenbiddle/get-css-data
Source: chromecache_182.3.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_182.3.dr	String found in binary or memory: https://github.com/nodeca/pako
Source: chromecache_182.3.dr, chromecache_133.3.dr	String found in binary or memory: https://jhildenbiddle.github.io/css-vars-ponyfill/
Source: chromecache_182.3.dr	String found in binary or memory: https://kjur.github.io/jsrsasign/license/
Source: chromecache_182.3.dr	String found in binary or memory: https://lodash.com/
Source: chromecache_182.3.dr	String found in binary or memory: https://lodash.com/license
Source: chromecache_182.3.dr	String found in binary or memory: https://npms.io/search?q=ponyfill.
Source: chromecache_182.3.dr	String found in binary or memory: https://openjsf.org/
Source: chromecache_184.3.dr	String found in binary or memory: https://www.baidu.com

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2224,i,6825167350514398730,10082469752665076186,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://888881e.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2224,i,6825167350514398730,10082469752665076186,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://365.qwe123-asd456-zxc789.3509bet.com/	0%	Avira URL Cloud	safe
https://www.365920.top/img/service.68be110a.png	0%	Avira URL Cloud	safe
http://888881e.com/layer/skin/default/loading-0.gif	100%	Avira URL Cloud	phishing
https://www.365920.top/kc338-1/sponsor/sponsor_nav_web_3.png?1740114807189	0%	Avira URL Cloud	safe
https://365.qwe123-asd456-zxc789.365911.top/	0%	Avira URL Cloud	safe
http://888881e.com/layer/x.html	100%	Avira URL Cloud	phishing
http://888881e.com/static/picture/4_qiu.png	100%	Avira URL Cloud	phishing
http://888881e.com/layer/skin/layer.css	100%	Avira URL Cloud	phishing
https://www.365920.top/js/52351.a7a197c2.js	0%	Avira URL Cloud	safe
https://365.qwe123-asd456-zxc789.0353bet.com/	0%	Avira URL Cloud	safe
https://www.365920.top/css/chunk-common.d0c95296.css	0%	Avira URL Cloud	safe
http://888881e.com/static/image/kf.png	100%	Avira URL Cloud	phishing
https://www.365920.top/js/chunk-vendors.40c3fb70.js	0%	Avira URL Cloud	safe
https://www.365920.top/css/home.294d25c7.css	0%	Avira URL Cloud	safe
http://888881e.com/layer/skin/default/icon.png	100%	Avira URL Cloud	phishing
https://www.365920.top/img/appdown.6e7c9177.png	0%	Avira URL Cloud	safe
https://www.365920.top/config/initGeetest4.js	0%	Avira URL Cloud	safe
https://www.365620.top/	0%	Avira URL Cloud	safe
https://365.qwe123-asd456-zxc789.365919.top/	0%	Avira URL Cloud	safe
http://888881e.com/layer/layer.js	100%	Avira URL Cloud	phishing
https://www.365651.top/	0%	Avira URL Cloud	safe
http://888881e.com/static/picture/bg.jpg	100%	Avira URL Cloud	phishing
http://888881e.com/favicon.ico	100%	Avira URL Cloud	phishing
https://365.qwe123-asd456-zxc789.365623.top/	0%	Avira URL Cloud	safe
https://www.365920.top/img/bj.ada43481.png	0%	Avira URL Cloud	safe
https://www.365920.top/configPage.js	0%	Avira URL Cloud	safe
http://888881e.com/static/image/favicon.ico	100%	Avira URL Cloud	phishing
https://www.365920.top/img/bj1.17ef2db8.png	0%	Avira URL Cloud	safe
https://www.365920.top/theme.config.c2bc06b4.js	0%	Avira URL Cloud	safe
http://888881e.com/static/image/bet365.png	100%	Avira URL Cloud	phishing
https://www.365920.top/kc338-1/sponsor/sponsor_nav_web_2.png?1740114807189	0%	Avira URL Cloud	safe
https://365.505-606-707-808-909.365933.top/	0%	Avira URL Cloud	safe
http://888881e.com/static/image/hover.png	100%	Avira URL Cloud	phishing
https://365.qwe123-asd456-zxc789.365902.top/	0%	Avira URL Cloud	safe
https://www.365920.top/css/52351.acaf9ede.css	0%	Avira URL Cloud	safe
https://www.365920.top/js/chunk-common.b186ab9f.js	0%	Avira URL Cloud	safe
https://www.365920.top/js/home.90ec6cf4.js	0%	Avira URL Cloud	safe
https://www.365920.top/css/cms-sports.a8449357.css	0%	Avira URL Cloud	safe
https://365.qwe123-asd456-zxc789.qiuyeqgmsyumeise.com/	100%	Avira URL Cloud	phishing
https://www.3507bet.com/	0%	Avira URL Cloud	safe
http://888881e.com/static/css/reset.css	100%	Avira URL Cloud	phishing
https://365.qwe123-asd456-zxc789.365665.top/	0%	Avira URL Cloud	safe
https://www.365920.top/kc338-1/sponsor/sponsor_web_3.png?1740114807189	0%	Avira URL Cloud	safe
https://www.ksaoksockaogumcu.com/	0%	Avira URL Cloud	safe
https://www.365920.top/kc338-1/sponsor/sponsor_web_2.png?1740114807189	0%	Avira URL Cloud	safe
https://www.365920.top/js/88495.59166de1.js	0%	Avira URL Cloud	safe
http://888881e.com/static/picture/logo.png	100%	Avira URL Cloud	phishing
https://www.365920.top/kc338-1/sponsor/sponsor_web_1.png?1740114807189	0%	Avira URL Cloud	safe
https://365.qwe123-asd456-zxc789.365659.top/	0%	Avira URL Cloud	safe
https://www.365920.top/kc338-1/sponsor/sponsor_nav_web_1.png?1740114807189	0%	Avira URL Cloud	safe
https://www.365920.top/js/index.68482a3f.js	0%	Avira URL Cloud	safe
http://888881e.com/static/image/jh.png	100%	Avira URL Cloud	phishing
http://888881e.com/betx.txt	100%	Avira URL Cloud	phishing
http://888881e.com/layer/jquery-1.8.3.min.js	100%	Avira URL Cloud	phishing
https://www.365920.top/js/cms-sports.4e4070db.js	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
b3jsuvrd.n.xmocloud01.com	43.252.161.7	true	false	high
xin.jump4mnydu.xyz	45.138.71.205	true	false	high
hcdnwsa120.v5.cdnhwczoy106.cn	98.98.25.18	true	false	high
zcfb8453.n.xmocloud01.com	66.203.146.55	true	false	high
www.google.com	142.250.186.164	true	false	high
888881e.com	23.248.226.78	true	false	unknown
os-js.com	104.21.90.19	true	false	high
365.qwe123-asd456-zxc789.3508bet.com	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365698.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365663.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.3506bet.com	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365612.top	unknown	unknown	false	high
365.505-606-707-808-909.365934.top	unknown	unknown	false	high
www.365907.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365914.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365620.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365906.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.3502bet.com	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365671.top	unknown	unknown	false	high
www.3508bet.com	unknown	unknown	false	high
www.365633.top	unknown	unknown	false	high
www.3506bet.com	unknown	unknown	false	high
www.365621.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365683.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365635.top	unknown	unknown	false	high
www.365641.top	unknown	unknown	false	high
www.365605.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365678.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365694.top	unknown	unknown	false	high
365917.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365604.top	unknown	unknown	false	high
www.365919.top	unknown	unknown	false	high
365.505-606-707-808-909.365926.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365647.top	unknown	unknown	false	high
www.lingzun.net	unknown	unknown	false	high
www.365911.top	unknown	unknown	false	high
www.365610.top	unknown	unknown	false	high
www.365636.top	unknown	unknown	false	high
365910.top	unknown	unknown	false	high
365901.top	unknown	unknown	false	high
365.505-606-707-808-909.365938.top	unknown	unknown	false	high
www.365629.top	unknown	unknown	false	high
www.365904.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365624.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365615.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365675.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365632.top	unknown	unknown	false	high
www.0352bet.com	unknown	unknown	false	high
www.365625.top	unknown	unknown	false	high
www.365900.top	unknown	unknown	false	high
www.365608.top	unknown	unknown	false	high
365.505-606-707-808-909.365923.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365607.top	unknown	unknown	false	high
365908.top	unknown	unknown	false	high
www.365915.top	unknown	unknown	false	high
www.365614.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365690.top	unknown	unknown	false	high
www.365644.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365660.top	unknown	unknown	false	high
www.365657.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.0350bet.com	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365638.top	unknown	unknown	false	high
www.365649.top	unknown	unknown	false	high
www.365606.top	unknown	unknown	false	high
365.505-606-707-808-909.365925.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.0353bet.com	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365672.top	unknown	unknown	false	high
www.365630.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365697.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365662.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365654.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365611.top	unknown	unknown	false	high
www.jinanfuke.net	unknown	unknown	false	high
www.365624.top	unknown	unknown	false	high
www.365908.top	unknown	unknown	false	high
365.505-606-707-808-909.365931.top	unknown	unknown	false	high
www.365634.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365628.top	unknown	unknown	false	high
www.0357bet.com	unknown	unknown	false	high
www.3835bet.com	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365903.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.ksaoksockaogumcu.com	unknown	unknown	false	high
www.qiuyeqgmsyumeise.com	unknown	unknown	false	high
365.qwe123-asd456-zxc789.yoqceqmcqoosawsu.com	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365634.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365682.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365677.top	unknown	unknown	false	high
www.365618.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365650.top	unknown	unknown	false	high
www.365628.top	unknown	unknown	false	high
365902.top	unknown	unknown	false	high
www.365903.top	unknown	unknown	false	high
www.365602.top	unknown	unknown	false	high
www.365645.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365616.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365676.top	unknown	unknown	false	high
365.505-606-707-808-909.365929.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365659.top	unknown	unknown	false	high
www.365920.top	unknown	unknown	false	high
365.qwe123-asd456-zxc789.365633.top	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
http://888881e.com/static/picture/4_qiu.png	true	Avira URL Cloud: phishing	unknown
https://365.qwe123-asd456-zxc789.365911.top/	false	Avira URL Cloud: safe	unknown
https://365.qwe123-asd456-zxc789.0353bet.com/	false	Avira URL Cloud: safe	unknown
http://888881e.com/layer/skin/layer.css	true	Avira URL Cloud: phishing	unknown
https://365.qwe123-asd456-zxc789.365908.top/	false		high
https://www.365920.top/img/service.68be110a.png	false	Avira URL Cloud: safe	unknown
https://www.365920.top/kc338-1/sponsor/sponsor_nav_web_3.png?1740114807189	false	Avira URL Cloud: safe	unknown
http://888881e.com/layer/x.html	true	Avira URL Cloud: phishing	unknown
https://365.qwe123-asd456-zxc789.3509bet.com/	false	Avira URL Cloud: safe	unknown
https://365908.top/	false		high
http://888881e.com/layer/skin/default/loading-0.gif	true	Avira URL Cloud: phishing	unknown
https://www.365920.top/js/52351.a7a197c2.js	false	Avira URL Cloud: safe	unknown
https://365919.top/	false		high
https://www.365920.top/css/chunk-common.d0c95296.css	false	Avira URL Cloud: safe	unknown
http://888881e.com/layer/skin/default/icon.png	true	Avira URL Cloud: phishing	unknown
https://www.365920.top/	false		high
http://888881e.com/static/image/kf.png	true	Avira URL Cloud: phishing	unknown
https://www.365920.top/js/chunk-vendors.40c3fb70.js	false	Avira URL Cloud: safe	unknown
https://www.365920.top/img/appdown.6e7c9177.png	false	Avira URL Cloud: safe	unknown
https://365910.top/	false		high
https://www.365920.top/css/home.294d25c7.css	false	Avira URL Cloud: safe	unknown
https://365920.top/	false		high
https://www.365920.top/config/initGeetest4.js	false	Avira URL Cloud: safe	unknown
https://365.qwe123-asd456-zxc789.365919.top/	false	Avira URL Cloud: safe	unknown
https://www.365909.top/	false		high
https://www.365620.top/	false	Avira URL Cloud: safe	unknown
http://888881e.com/layer/layer.js	true	Avira URL Cloud: phishing	unknown
https://365.qwe123-asd456-zxc789.365645.top/	false		high
https://www.365916.top/	false		high
https://www.365651.top/	false	Avira URL Cloud: safe	unknown
http://888881e.com/favicon.ico	true	Avira URL Cloud: phishing	unknown
https://365.qwe123-asd456-zxc789.365623.top/	false	Avira URL Cloud: safe	unknown
https://365904.top/	false		high
https://365.qwe123-asd456-zxc789.365627.top/	false		high
http://888881e.com/static/picture/bg.jpg	true	Avira URL Cloud: phishing	unknown
https://365.qwe123-asd456-zxc789.ksaoksockaogumcu.com/	false		high
http://888881e.com/static/image/favicon.ico	true	Avira URL Cloud: phishing	unknown
http://888881e.com/static/image/bet365.png	true	Avira URL Cloud: phishing	unknown
http://888881e.com/url/bet.html	true		unknown
https://www.365920.top/img/bj.ada43481.png	false	Avira URL Cloud: safe	unknown
https://365.qwe123-asd456-zxc789.365677.top/	false		high
https://365.qwe123-asd456-zxc789.365674.top/	false		high
https://www.365920.top/theme.config.c2bc06b4.js	false	Avira URL Cloud: safe	unknown
https://www.365920.top/img/bj1.17ef2db8.png	false	Avira URL Cloud: safe	unknown
https://365917.top/	false		high
https://www.365906.top/	false		high
https://www.365920.top/configPage.js	false	Avira URL Cloud: safe	unknown
https://www.365920.top/kc338-1/sponsor/sponsor_nav_web_2.png?1740114807189	false	Avira URL Cloud: safe	unknown
http://888881e.com/static/image/hover.png	true	Avira URL Cloud: phishing	unknown
https://365.505-606-707-808-909.365933.top/	false	Avira URL Cloud: safe	unknown
https://www.365920.top/css/52351.acaf9ede.css	false	Avira URL Cloud: safe	unknown
https://365.qwe123-asd456-zxc789.365902.top/	false	Avira URL Cloud: safe	unknown
https://www.3507bet.com/	false	Avira URL Cloud: safe	unknown
https://365.qwe123-asd456-zxc789.365603.top/	false		high
https://www.365920.top/js/home.90ec6cf4.js	false	Avira URL Cloud: safe	unknown
https://365901.top/	false		high
https://www.365920.top/css/cms-sports.a8449357.css	false	Avira URL Cloud: safe	unknown
https://www.365920.top/js/chunk-common.b186ab9f.js	false	Avira URL Cloud: safe	unknown
https://365.qwe123-asd456-zxc789.qiuyeqgmsyumeise.com/	false	Avira URL Cloud: phishing	unknown
http://888881e.com/static/css/reset.css	true	Avira URL Cloud: phishing	unknown
https://365.qwe123-asd456-zxc789.365665.top/	false	Avira URL Cloud: safe	unknown
http://sdk.51.la/js-sdk-pro.min.js	false		high
https://365.qwe123-asd456-zxc789.3503bet.com/	false		high
https://www.ksaoksockaogumcu.com/	false	Avira URL Cloud: safe	unknown
https://www.365915.top/	false		high
https://www.365920.top/kc338-1/sponsor/sponsor_web_3.png?1740114807189	false	Avira URL Cloud: safe	unknown
https://365.qwe123-asd456-zxc789.365621.top/	false		high
https://www.365920.top/js/88495.59166de1.js	false	Avira URL Cloud: safe	unknown
https://www.365920.top/kc338-1/sponsor/sponsor_web_2.png?1740114807189	false	Avira URL Cloud: safe	unknown
https://365.qwe123-asd456-zxc789.365683.top/	false		high
https://365913.top/	false		high
https://365902.top/	false		high
https://www.365920.top/kc338-1/sponsor/sponsor_nav_web_1.png?1740114807189	false	Avira URL Cloud: safe	unknown
https://www.365911.top/	false		high
https://365.qwe123-asd456-zxc789.365659.top/	false	Avira URL Cloud: safe	unknown
https://www.365920.top/kc338-1/sponsor/sponsor_web_1.png?1740114807189	false	Avira URL Cloud: safe	unknown
https://365903.top/	false		high
http://888881e.com/static/picture/logo.png	true	Avira URL Cloud: phishing	unknown
https://www.365920.top/js/index.68482a3f.js	false	Avira URL Cloud: safe	unknown
http://888881e.com/static/image/jh.png	true	Avira URL Cloud: phishing	unknown
https://365.qwe123-asd456-zxc789.365619.top/	false		high
https://www.365902.top/	false		high
http://collect-v6.51.la/v6/collect?dt=4	false		high
https://www.3836bet.com/	false		high
https://www.365920.top/js/cms-sports.4e4070db.js	false	Avira URL Cloud: safe	unknown
https://365.qwe123-asd456-zxc789.3502bet.com/	false		high
http://888881e.com/betx.txt	true	Avira URL Cloud: phishing	unknown
http://888881e.com/layer/jquery-1.8.3.min.js	true	Avira URL Cloud: phishing	unknown

Name	Source	Malicious	Reputation
https://github.com/nodeca/pako	chromecache_182.3.dr	false	high
https://openjsf.org/	chromecache_182.3.dr	false	high
https://github.com/emn178/js-md5	chromecache_92.3.dr	false	high
http://hildenbiddle.com	chromecache_182.3.dr, chromecache_133.3.dr	false	high
http://underscorejs.org/LICENSE	chromecache_182.3.dr	false	high
https://github.com/js-cookie/js-cookie	chromecache_182.3.dr	false	high
https://npms.io/search?q=ponyfill.	chromecache_182.3.dr	false	high
https://github.com/jhildenbiddle/get-css-data	chromecache_182.3.dr, chromecache_133.3.dr	false	high
https://kjur.github.io/jsrsasign/license/	chromecache_182.3.dr	false	high
https://lodash.com/	chromecache_182.3.dr	false	high
https://jhildenbiddle.github.io/css-vars-ponyfill/	chromecache_182.3.dr, chromecache_133.3.dr	false	high
https://www.baidu.com	chromecache_184.3.dr	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
23.248.226.78	888881e.com	United States	136800	XIAOZHIYUN1-AS-APICIDCNETWORKUS	false
90.84.161.15	unknown	France	5511	OPENTRANSITFR	false
147.92.38.89	unknown	Hong Kong	59371	DNC-ASDimensionNetworkCommunicationLimitedHK	false
66.203.144.107	unknown	Hong Kong	59371	DNC-ASDimensionNetworkCommunicationLimitedHK	false
66.203.146.55	zcfb8453.n.xmocloud01.com	Hong Kong	59371	DNC-ASDimensionNetworkCommunicationLimitedHK	false
98.98.25.18	hcdnwsa120.v5.cdnhwczoy106.cn	United States	7018	ATT-INTERNET4US	false
43.252.161.7	b3jsuvrd.n.xmocloud01.com	Hong Kong	59371	DNC-ASDimensionNetworkCommunicationLimitedHK	false
149.104.73.29	unknown	United States	174	COGENT-174US	false
104.21.90.19	os-js.com	United States	13335	CLOUDFLARENETUS	false
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false
45.138.71.205	xin.jump4mnydu.xyz	Italy	40676	AS40676US	false

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1637076
Start date and time:	2025-03-13 10:43:02 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://888881e.com/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.win@24/165@594/13
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 5793
Category:	dropped
Size (bytes):	4950
Entropy (8bit):	7.961898941293263
Encrypted:	false
SSDEEP:	96:arV1BMEd63upXXu1ffm2SPacwfxf2ZCAc3pkXoxe0yqboC8Z:arV1uEdjZu1XmfhwiCvpEoAcoZZ
MD5:	CDFBA8B3124C6B661EBF35AF416C2233
SHA1:	26A84B450A7DDB99B6C106981D379DA9250B975E
SHA-256:	B19A41D99293AB0F1BC36C2B21C22D7875BF1EFD98A96E3D77289E06470FA68D
SHA-512:	865701B0C9CD3534C9647492530DFD56385FDA6EEB30F9EE23DC5DACA75860220CC4AA07C7315325FDF186976AC2F369464AB365CA3A608350090DBC7312D5D8
Malicious:	false
Reputation:	low
Preview:	...........WgXSg.?'..$!4K@\|..X.... +$.!.)%.`XIH.FY.... ""(e.."8..Q[E.@....>.jm....z].../...................{...y.......F.<?$.M..Jj.)..}f...\|...D.o...O..Aoq.....h.(...z+....+..C../..(...1b;...4...eG...dxJ9BQ.k.L.._..'`EQ..)..6......OIM...mR..(I..F...M.R.(......N.D&.X.....%.b.17.[YY.P..L..aFg..2.l6..0.....Z.,....K.zeG.).R.:=%%....&.m.3Y,..33S5..<M......$p.r.,F....).....$..U}.?!$H}c.......h.I.=./.3i...-.2.w\......7.\.+...+...I.t_.\.$.......wE..a.....j/...r...OO./..c..x.D.. .+.vT..-*&...p.l.F........Xry.<..9....N.J..,.....li.d:3YL.%........w.nb../....Q....._ym82!_!..K$....[$QH."....x..1......D...b..Q<.$....61+..ZYXZ...f...?y..?6../C_...b..:..?..$...\.....3.\|...._....._.....>[Z\|.....>.......{g....7..~m..o........9w...gN.:y.....G.&...88>6:2.........................................PU........#3#=-5%9I!.%J%.......ha. ...Y.........~.>.^[<=6......'......&.......F3u..LM>....uF..T}...Y..FWG{5.D$.?..ib1h...._..B..J.%.....&...,WA.../

IP
192.168.2.11
127.0.0.1

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (383)
Category:	dropped
Size (bytes):	7900
Entropy (8bit):	4.807469673831077
Encrypted:	false
SSDEEP:	192:l1awIifNhJRaL3a2HGslJdXCA44Ahy/9BDZLBZywMGRS38i2C:AR4jaiz
MD5:	96511478965FE55138F6D7C12948A815
SHA1:	FE6B155EB1B344E9EDC9E74902098B37BA94AB0E
SHA-256:	CF66B65651262A9B06F108CBFCF03348B2A4FFBD4F74B2FD204E3B00FC06426C
SHA-512:	182C559076D2F6B96C349C372C923930C55BA048E3EB869BB4652B24C9C4FCC75A369B3FE297573E2B0A4D61A63B1469750E13CF3C9716C2582E33B460FE5256
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>.<html lang="zh-CN" data-buildtime="2/21/2025, 13:19:24">. <head>. <meta charset="utf-8">. <title></title>. <meta name="next-font-preconnect">. <meta name="renderer" content="webkit">. <meta name="force-rendering" content="webkit">. <meta http-equiv="Content-Language" content="zh-CN">. <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">. <meta name="theme-color" content="transparent">. <meta name="apple-mobile-web-app-capable" content="yes">. <meta name="apple-touch-fullscreen" content="yes">. <meta name="referrer" content="origin">. <meta name="x5-orientation" content="portrait">. <meta name="google" content="notranslate">. <meta name="screen-orientation" content="portrait">. <meta name="apple-mobile-web-app-capable" content="yes">. <meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1,minimum-scale=1,user-scalable=no,viewport-fit=cover">. -->. <style>. .con {.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (383)
Category:	dropped
Size (bytes):	7900
Entropy (8bit):	4.807469673831077
Encrypted:	false
SSDEEP:	192:l1awIifNhJRaL3a2HGslJdXCA44Ahy/9BDZLBZywMGRS38i2C:AR4jaiz
MD5:	96511478965FE55138F6D7C12948A815
SHA1:	FE6B155EB1B344E9EDC9E74902098B37BA94AB0E
SHA-256:	CF66B65651262A9B06F108CBFCF03348B2A4FFBD4F74B2FD204E3B00FC06426C
SHA-512:	182C559076D2F6B96C349C372C923930C55BA048E3EB869BB4652B24C9C4FCC75A369B3FE297573E2B0A4D61A63B1469750E13CF3C9716C2582E33B460FE5256
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>.<html lang="zh-CN" data-buildtime="2/21/2025, 13:19:24">. <head>. <meta charset="utf-8">. <title></title>. <meta name="next-font-preconnect">. <meta name="renderer" content="webkit">. <meta name="force-rendering" content="webkit">. <meta http-equiv="Content-Language" content="zh-CN">. <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">. <meta name="theme-color" content="transparent">. <meta name="apple-mobile-web-app-capable" content="yes">. <meta name="apple-touch-fullscreen" content="yes">. <meta name="referrer" content="origin">. <meta name="x5-orientation" content="portrait">. <meta name="google" content="notranslate">. <meta name="screen-orientation" content="portrait">. <meta name="apple-mobile-web-app-capable" content="yes">. <meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1,minimum-scale=1,user-scalable=no,viewport-fit=cover">. -->. <style>. .con {.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://888881e.com/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Windows Analysis Report
http://888881e.com/