nginx
tcp/443 tcp/80
.DS_Store” is an abbreviation for “Desktop Services Store”. These files are created automatically by Apples “Finder” software (which is part of their OS).
They store information about the files within a folder, including display options of folders, such as icon positions and view settings.
It may happen that .DS_Store files inadvertently leak filenames such as database backups or private administration panels.
Severity: low
Fingerprint: 5f32cf5d6962f09c4239b3d84239b3d8293ad1cc4df70392e09006f62c7007d0
Found 8 files trough .DS_Store spidering: /cdn /js /landing_css /landing_js /landingcss /landingjs /landingwebp /startup
.DS_Store” is an abbreviation for “Desktop Services Store”. These files are created automatically by Apples “Finder” software (which is part of their OS).
They store information about the files within a folder, including display options of folders, such as icon positions and view settings.
It may happen that .DS_Store files inadvertently leak filenames such as database backups or private administration panels.
Severity: low
Fingerprint: 5f32cf5d6962f09c4239b3d84239b3d8293ad1cc4df70392e09006f62c7007d0
Found 8 files trough .DS_Store spidering: /cdn /js /landing_css /landing_js /landingcss /landingjs /landingwebp /startup
Open service 18.244.18.106:80 · luckislots.vip
2026-01-23 16:44
HTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 22130
Connection: close
Server: nginx
Date: Fri, 23 Jan 2026 16:44:38 GMT
Last-Modified: Fri, 16 Jan 2026 08:56:16 GMT
Accept-Ranges: bytes
ETag: "6969fd30-5672"
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE
Access-Control-Allow-Headers: Content-Type, Authorization,userId
Vary: Accept-Encoding
X-Cache: Miss from cloudfront
Via: 1.1 cbad29402e4e90baabe7151c3f1203b6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-P11
X-Amz-Cf-Id: JedcVH1MALL1UAwdropqVg1MlG5K3lef4pjE6MLXKRPjJ_7SPIdk-g==
Page title: LuckiSlots - Bônus de R$1000
<html lang="pt-BR" data-critters-container><head><meta charset="UTF-8"><meta http-equiv="Cache-Control" content="max-age=0"><meta name="viewport" content="width=device-width,initial-scale=1,minimum-scale=1,maximum-scale=1,user-scalable=no,viewport-fit=cover"><script async>(function initRedirect() {
const pathSegments = window.location.pathname.split('/').filter(Boolean);
let channel = 'ch_h5brls003'; // 默认值
if (window.location.origin.includes('localhost')) {
channel = 'ch_h5brmain';
}
// 优先从URL路径中提取渠道信息
if (pathSegments.length > 0 && /^ch_h5br/i.test(pathSegments[0])) {
channel = pathSegments[0].toLocaleLowerCase();
return; // 已有渠道信息则停止执行
}
// 没有渠道信息时,从localstorage中获取
const storedSource = window.localStorage.getItem('br_web_apkch') || '';
if (storedSource) {
channel = storedSource.toLocaleLowerCase();
}
// 没有渠道信息时才处理JWT
const urlParams = new URLSearchParams(window.location.search);
const jwt = urlParams.get('jwt') || document.cookie.replace(/(?:(?:^|.*;\s*)jwt\s*=\s*([^;]*).*$)|^.*$/, '$1');
if (jwt) {
try {
const data = JSON.parse(atob(jwt));
channel = data.channel?.toLocaleLowerCase() || channel;
} catch (e) {
console.error('JWT parse error:', e);
}
}
// 生成标准化URL
const newUrl = `${window.location.origin}/${channel}/000000/game${window.location.search}`;
history.replaceState({}, '', newUrl);
return;
})();
// 写入安全区变量,作为 env/constant 失效时的兜底
(function setSafeAreaVars() {
function computeSafeArea() {
try {
var probe = document.createElement('div');
probe.setAttribute(
'style',
[
'position:fixed',
'inset:0',
'padding-top: constant(safe-area-inset-top)',
'padding-right: constant(safe-area-inset-right)',
'padding-bottom: constant(safe-area-inset-bottom)',
'padding-left: constant(safe-area-inset-left)',
'padding-top: env(safe-area-inset-top)',
'padding-right: env(safe-area-inset-right)',
'padding-bottom: env(safe-area-inset-bottom)',
'padding-left: env(safe-area-inset-left)',
'pointer-events:none',
'opacity:0',
'z-index:-1'
].join(';')
);
document.body.appendChild(probe);
var cs = window.getComputedStyle(probe);
var top = parseFloat(cs.paddingTop) || 0;
var right = parseFloat(cs.paddingRight) || 0;
var bottom = parseFloat(cs.paddingBottom) || 0;
var left = parseFloat(cs.paddingLeft) || 0;
if (
('standalone' in window.navigator && window.navigator.standalone) ||
window.matchMedia('(display-mode: standalone)').matches
) {
document.body.style.height = '100vh';
}
if (
window.android &&
window.android.getDeviceID &&
window.android.saveUserID &&
(!!window.android.isIpa ||
(typeof window.isIpa === 'function' && (window.isIpa() !== 'false' || window.isIpa() != false)))
) {
document.documentElement.style.setProperty('min-height', '100vh', 'important');
}
document.documentElement.style.setProperty('--safe-area-inset-top', top + 'px');
document.documentElement.style.setProperty('--safe-area-inset-right', right + 'px');
document.documentElement.style.setProperty('--safe-area-inset-bottom', bottom + 'px');
document.documentElement.style.setProperty('--safe-area-inset-left', left + 'px');
document?.b
Open service 18.244.18.18:443 · luckislots.vip
2026-01-22 11:52
HTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 22130
Connection: close
Server: nginx
Date: Thu, 22 Jan 2026 11:52:05 GMT
Last-Modified: Fri, 16 Jan 2026 08:56:16 GMT
Accept-Ranges: bytes
ETag: "6969fd30-5672"
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE
Access-Control-Allow-Headers: Content-Type, Authorization,userId
Vary: Accept-Encoding
X-Cache: Miss from cloudfront
Via: 1.1 de5feec87348dd5cbd158a449ae18d38.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-P11
X-Amz-Cf-Id: b6vp6hx36l3hMX-b10uOPetAZ9sxqUc9IQ0-F_swirDbzkdLB4h6RA==
Page title: LuckiSlots - Bônus de R$1000
<html lang="pt-BR" data-critters-container><head><meta charset="UTF-8"><meta http-equiv="Cache-Control" content="max-age=0"><meta name="viewport" content="width=device-width,initial-scale=1,minimum-scale=1,maximum-scale=1,user-scalable=no,viewport-fit=cover"><script async>(function initRedirect() {
const pathSegments = window.location.pathname.split('/').filter(Boolean);
let channel = 'ch_h5brls003'; // 默认值
if (window.location.origin.includes('localhost')) {
channel = 'ch_h5brmain';
}
// 优先从URL路径中提取渠道信息
if (pathSegments.length > 0 && /^ch_h5br/i.test(pathSegments[0])) {
channel = pathSegments[0].toLocaleLowerCase();
return; // 已有渠道信息则停止执行
}
// 没有渠道信息时,从localstorage中获取
const storedSource = window.localStorage.getItem('br_web_apkch') || '';
if (storedSource) {
channel = storedSource.toLocaleLowerCase();
}
// 没有渠道信息时才处理JWT
const urlParams = new URLSearchParams(window.location.search);
const jwt = urlParams.get('jwt') || document.cookie.replace(/(?:(?:^|.*;\s*)jwt\s*=\s*([^;]*).*$)|^.*$/, '$1');
if (jwt) {
try {
const data = JSON.parse(atob(jwt));
channel = data.channel?.toLocaleLowerCase() || channel;
} catch (e) {
console.error('JWT parse error:', e);
}
}
// 生成标准化URL
const newUrl = `${window.location.origin}/${channel}/000000/game${window.location.search}`;
history.replaceState({}, '', newUrl);
return;
})();
// 写入安全区变量,作为 env/constant 失效时的兜底
(function setSafeAreaVars() {
function computeSafeArea() {
try {
var probe = document.createElement('div');
probe.setAttribute(
'style',
[
'position:fixed',
'inset:0',
'padding-top: constant(safe-area-inset-top)',
'padding-right: constant(safe-area-inset-right)',
'padding-bottom: constant(safe-area-inset-bottom)',
'padding-left: constant(safe-area-inset-left)',
'padding-top: env(safe-area-inset-top)',
'padding-right: env(safe-area-inset-right)',
'padding-bottom: env(safe-area-inset-bottom)',
'padding-left: env(safe-area-inset-left)',
'pointer-events:none',
'opacity:0',
'z-index:-1'
].join(';')
);
document.body.appendChild(probe);
var cs = window.getComputedStyle(probe);
var top = parseFloat(cs.paddingTop) || 0;
var right = parseFloat(cs.paddingRight) || 0;
var bottom = parseFloat(cs.paddingBottom) || 0;
var left = parseFloat(cs.paddingLeft) || 0;
if (
('standalone' in window.navigator && window.navigator.standalone) ||
window.matchMedia('(display-mode: standalone)').matches
) {
document.body.style.height = '100vh';
}
if (
window.android &&
window.android.getDeviceID &&
window.android.saveUserID &&
(!!window.android.isIpa ||
(typeof window.isIpa === 'function' && (window.isIpa() !== 'false' || window.isIpa() != false)))
) {
document.documentElement.style.setProperty('min-height', '100vh', 'important');
}
document.documentElement.style.setProperty('--safe-area-inset-top', top + 'px');
document.documentElement.style.setProperty('--safe-area-inset-right', right + 'px');
document.documentElement.style.setProperty('--safe-area-inset-bottom', bottom + 'px');
document.documentElement.style.setProperty('--safe-area-inset-left', left + 'px');
document?.b
Open service 18.244.18.106:80 · luckislots.vip
2026-01-10 01:51
HTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 19204
Connection: close
Server: nginx
Date: Sat, 10 Jan 2026 01:51:41 GMT
Last-Modified: Tue, 06 Jan 2026 06:21:57 GMT
Accept-Ranges: bytes
ETag: "695caa05-4b04"
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE
Access-Control-Allow-Headers: Content-Type, Authorization,userId
Vary: Accept-Encoding
X-Cache: Miss from cloudfront
Via: 1.1 abf6c055b398b223d7325958955066c0.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-P11
X-Amz-Cf-Id: kGo-T0PLsZfz9lZ2rNHVODElYCP788KxIE6729yFNE9u29WiZozxZA==
Page title: LuckiSlots - Bônus de R$1000
<html lang="pt-BR" data-critters-container><head><meta charset="UTF-8"><meta http-equiv="Cache-Control" content="max-age=0"><meta name="viewport" content="width=device-width,initial-scale=1,minimum-scale=1,maximum-scale=1,user-scalable=no,viewport-fit=cover"><script async>(function initRedirect() {
const pathSegments = window.location.pathname.split('/').filter(Boolean);
let channel = 'ch_h5brls003'; // 默认值
if (window.location.origin.includes('localhost')) {
channel = 'ch_h5brmain';
}
// 优先从URL路径中提取渠道信息
if (pathSegments.length > 0 && /^ch_h5br/i.test(pathSegments[0])) {
channel = pathSegments[0].toLocaleLowerCase();
return; // 已有渠道信息则停止执行
}
// 没有渠道信息时,从localstorage中获取
const storedSource = window.localStorage.getItem('br_web_apkch') || '';
if (storedSource) {
channel = storedSource.toLocaleLowerCase();
}
// 没有渠道信息时才处理JWT
const urlParams = new URLSearchParams(window.location.search);
const jwt = urlParams.get('jwt') || document.cookie.replace(/(?:(?:^|.*;\s*)jwt\s*=\s*([^;]*).*$)|^.*$/, '$1');
if (jwt) {
try {
const data = JSON.parse(atob(jwt));
channel = data.channel?.toLocaleLowerCase() || channel;
} catch (e) {
console.error('JWT parse error:', e);
}
}
// 生成标准化URL
const newUrl = `${window.location.origin}/${channel}/000000/game${window.location.search}`;
history.replaceState({}, '', newUrl);
return;
})();
function applyTheme(theme = {}) {
// 设置body html的背景色
const root = document.documentElement;
root.style.setProperty('--thirdColor', theme.thirdColor);
root.style.setProperty('--fourthColor', theme.fourthColor);
// 应用主题变量
root.style.setProperty('--primaryColor', theme.primaryColor);
root.style.setProperty('--secondaryColor', theme.secondaryColor);
root.style.setProperty('--backgroundColor', theme.backgroundColor);
root.style.setProperty('--buttonColor', theme.buttonColor);
root.style.setProperty('--textColor', theme.textColor);
root.style.setProperty('--textGrayColor', theme.textGrayColor);
root.style.setProperty('--mainBgColor', theme.mainBgColor);
root.style.setProperty('--darkColor', theme.darkColor);
root.style.setProperty('--darkColor1', theme.darkColor1);
root.style.setProperty('--darkColor2', theme.darkColor2);
root.style.setProperty('--darkColor3', theme.darkColor3);
root.style.setProperty('--warningColor', theme.warningColor);
root.style.setProperty('--warningButtonColor', theme.warningButtonColor);
root.style.setProperty('--disabledButtonColor', theme.disabledButtonColor);
root.style.setProperty('--errorButtonColor', theme.errorButtonColor);
root.style.setProperty('--activityBgColor', theme.activityBgColor);
}
// 工具函数
function getCookie(name) {
const value = `; ${document.cookie}`;
const parts = value.split(`; ${name}=`);
if (parts.length === 2) return parts.pop().split(';').shift();
return '';
}
function setCookie(name, value, domain = location.hostname, days = 365) {
const date = new Date();
date.setTime(date.getTime() + days * 24 * 60 * 60 * 1000);
document.cookie = `${name}=${value};domain=${domain};path=/;expires=${date.toUTCString()}`;
}
// JWT 处理函数
async function handleJwt() {
/* 非apk包或ipa包,需要判断链接是否有jwt参数 */
/** 解码jwt参数, 加解密的算法是对json进行base64编码
* localStorage:
* 1、pushudatadict: {"userid":50000475,"channel":"H5BR_001","fingerprint":"17c429ae09b0d556ef64c8bf9e15e395","machineserial":"17c429ae09b0d556ef64c8bf9e15e395",