{"report_id":"052991cb-7d48-4f74-8689-13d148ec36c9","version":0,"status":"done","tags":[],"date":"2026-07-17T13:48:52Z","url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.126","port":0,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"title":"ToDesk远程","dom":{"size":40887,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (2111)","md5":"34b1a8c9ee3d782cd20d24da6caacaf1","sha1":"31b0fab30fe0b94add8efbf14193ad59e25c6555","sha256":"fbafb2d71c600d90b81acc6b20fe7de6478112e1483f5a04a2d195fbaf1abe8e","sha512":"e873e751526362ff57480d95b315e13e412dceab65df8d5c71707f129b65faa45961d3563608430920a96818387e55a0b55371b4a6f45e573f3a5927db530345","ssdeep":"384:71EvvlmM6TRMTG6nRMTG6qRMTG6URMTG6pRMTG6E7dtxvOEF8HrBn8KFiatzv+WZ:uQ6t6m6c6j6+tQqcvMhDpe8Aq+","tlshash":"5f030a321c5658231663d2e814b92f9edc9ae74fd80540f475bc6a92afc7fa4d8bf480","dom_hash":"domhashd9f9fe5159aa9279659276f2787d7837","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.126","port":0,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-21T13:48:52Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null},"summary":[{"fqdn":"ztosk.eh.xznkjzx.cn","ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"domain_registered":"2023-08-10","domain_rank":0,"first_seen":"2026-07-17T13:48:55.656292Z","last_seen":"2026-07-17T13:48:55.656292Z","alert_count":183,"request_count":61,"received_data":3363630,"sent_data":29390,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]},{"name":"jQuery:1.10.2","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Google Tag Manager","description":"Google Tag Manager is a tag management system (TMS) that allows you to quickly and easily update measurement codes and related code fragments collectively known as tags on your website or mobile app.","website":"https://www.google.com/tagmanager","common_platform_enumeration":"","icon":"Google Tag Manager.svg","categories":["Tag managers"]},{"name":"Nuxt.js","description":"Nuxt is a Vue framework for developing modern web applications.","website":"https://nuxt.com","common_platform_enumeration":"","icon":"Nuxt.js.svg","categories":["JavaScript frameworks","Web frameworks","Web servers","Static site generator"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}]},{"fqdn":"s1.pstatp.com","ip":{"addr":"163.171.242.128","port":443,"asn":54994,"as":"ML-1432-54994","country":"United States","country_code":"US"},"domain_registered":"2011-12-27","domain_rank":2838773,"first_seen":"2017-01-31T08:50:20Z","last_seen":"2026-07-08T10:18:13.55997Z","alert_count":0,"request_count":2,"received_data":188630,"sent_data":1010,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"27c15be15d951da4d46f198ba2a7aede","sha1":"adbe98783ad42ab6851eaed2c456283cbc4e539b","sha256":"093fe740d7872aa85a8f4d14d5fab265b93840b52c9435307c050eedf56d186f","sha512":"f135bdac0761d601ad74964421cda3991103b9c51f0116d97bb56e03e5ac5b27271ed06d6e51294e2b9e4888884be44d7991f6aed67f2d39f5fc3fc58a819ce8","ssdeep":"","tlshash":"b1e02bab2084134aa8379462fe1f60243633306f7f20d461393e7ca10fc9b5c0087054","size":314,"data":"","first_seen":"2026-07-17T13:49:02.425012Z","last_seen":"2026-07-17T13:53:29.49527Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/js/55587a0.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"c94535cda1a21147c82218a6c358d69f","sha1":"832c41ae0ed3fe99876ec9150fcd4d2ce758a75e","sha256":"767f446c90ce6e57c8b942fc55e857e199842cc060c8bc0c6ae6c1dc5ed73d3b","sha512":"385b53c21e40060f94ffc0a7a74f1e6c7705819752d0f936def2739777bbcafed37e0a221ef7674d869595c08e14cfc54f2150e4d5eeae313dc6b685e1c4af8d","ssdeep":"192:EqqD+lbScS/lwplf7TzSI0VlbScS/lwpdT4OGQAcPmHf681:K+lk/lwjf7XSI4lk/lwDHDA+mT","tlshash":"69d1d86b37ecfaa792710551487be46fba2838513d15c080db99d77d683cdc19423bb2","size":6252,"data":"","first_seen":"2026-07-14T03:50:10.837739Z","last_seen":"2026-07-17T13:53:29.482503Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/js/102eb0d.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"628e017ed644c5d8f602added414f430","sha1":"b53d07cac48bfe44837cada9d29e9fab0418ba39","sha256":"68e88c5034dd078c434218e5be16c2894809f907459519e08a3cee1a1850a226","sha512":"685c1c8079885db9a8afbfc0178f7131e04f1244f7ea9878613b8724b94ba4ee06ae389a8f9b936976fce75397ee06cea4845d6ece08a208eeaece988a9373c9","ssdeep":"384:YPvMCLEjIkUzvS8GMpQrBItzvfWYYCdiVEG8KniftxvaEFIuYx5Upl:dEOavlIiJz5LiUD","tlshash":"53c229773082f9fe0e1e5076511b25388db91eadc849b842b67cfc44e6f8a78561f25c","size":26546,"data":"","first_seen":"2026-07-14T03:50:10.793982Z","last_seen":"2026-07-17T13:53:29.484188Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/js/f879a2d.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"975a638f84662bb8458fd037bb2ab334","sha1":"11e673b4df51890b4b9d60bc8fb14bfb72a5893a","sha256":"4fed1ab25ec43f53e40a596ebe9d5271d7dcf42cf2b505bdbe1df1aef058b017","sha512":"2b6cce5e858b480fd625c5283837b509e9201c426583eb9227e933d6c01c7bd5b701c61bb52a38b546d02cbcfb36565067299e974e3818e0d7968fe38719e912","ssdeep":"3072:1XuT8wbxbQ2eTykHSKnbvuvRJ0cRBecuJ0rE3qY5wX:4T8PbbvanecuJ0QjwX","tlshash":"b124c3cdf695b0b113e720b4406f550bf27ab855b84a81d0e266e4d1bcbc98ea127f3d","size":225045,"data":"","first_seen":"2026-07-14T03:50:10.801602Z","last_seen":"2026-07-17T13:53:29.488402Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/js/qrcode-with-logo.min.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"4d47effbbd9dbf1cd3c8dd84e8c193f4","sha1":"fe4e1aed878dbfa25403c39b7b261e217faee7f8","sha256":"1de6e45af0c2432423778a652d5d0ffbdcbfa7830e576600cc88232eb0711fba","sha512":"c13fc9ba42d3a1f9051ba0f0f61852c02f0e2f9ccd2de3085f1968a606128e9dbfa1ee2fb4fe4b58251a9600db67b620185d0195511e414a1bd73a155677dc35","ssdeep":"768:rUDAp/Gue0Mp86NkZTD688rRfnVtX06boY3b6rCEEe3/tocnWirqBRavKqre1G3q:rOW1T/8rR/x3bitoQuSZbQQKjqq7","tlshash":"7f53d888f6d5b06943a365a4401f500bf1baae69b80d48a4f655d4d2bcfcdce807bf78","size":60682,"data":"","first_seen":"2026-07-14T03:50:10.808747Z","last_seen":"2026-07-17T13:53:29.487594Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/js/7fb6e02.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"66b31fac73aaa0155fb42d9959b03eb3","sha1":"8a4e86b167ea2ace18af8d2ebb874c1488b72861","sha256":"b0f3ac375b29d9c61387ed41fb27de0c101b47720b81d0c5fd7faf36575d18a3","sha512":"e01a68a34e9bcf9c78d24635ace5aa446c0e2d067aeb6c55800e39d3f0d9b61a785bb428fda43ad12979c89b9087f4ddca3d2770749962bd2cbd5c0e4af3a0de","ssdeep":"6144:ToSVfdlQUgcXoSWvHSYs3ESuSJQSSHUxQ12NxP9Nbwesdu3y/K7iknWPGXJIUdPe:ToSVfLWfS1Hg23Be","tlshash":"25b43b4e7290b06643e761a6403f560bb337381d940ec098b6b5d8ebadbd94d122bf7d","size":534721,"data":"","first_seen":"2026-07-14T03:50:10.780379Z","last_seen":"2026-07-17T13:53:29.486417Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/js/bf3d6f4.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"bbd9df8007292f539cb19f9e75b4df92","sha1":"a01e56137c8cc9b0391bc4292c9c26a87f919488","sha256":"ecc6debb864fc4340e229c9f3aa807b722dfa26679463a584a8ed77790e0bc15","sha512":"9fe1a77d16142ebf3941c7033287d712b3f93762213faa13c604e4d8cbdce189b4124c06613f143e71f1d06c6409faf9bd25bc34ad7fafd704600aadea6df25b","ssdeep":"1536:49uOeQG/Oavp/UGT4J8pFSuI6X4+67f2aVP/e6X/xqVXoOdf2n0LH31etTeZyi6s:W7OaV/ei0SnU3pyI","tlshash":"21c30859b5c2f47a0a9b2071403f240af1796d99e01dd192e334fdc2bdb894a912bf7e","size":122016,"data":"","first_seen":"2026-07-14T03:50:10.819281Z","last_seen":"2026-07-17T13:53:29.485125Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s1.pstatp.com/cdn/expire-1-M/jquery/1.10.2/jquery.min.js","fqdn":"s1.pstatp.com","domain":"pstatp.com","tld":"com"},"ip":{"addr":"163.171.242.128","port":443,"asn":54994,"as":"ML-1432-54994","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e0e0559014b222245deb26b6ae8bd940","sha1":"e2f3603e23711f6446f278a411d905623d65201e","sha256":"89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e","sha512":"60740da8f871b8263675db2421b0e565fc18e95c772f7c3d5916f224263cd71a6a2e6acceab2f6f8ba1c0607951f0198f525d87d0589fa57045b1d5f292dacf0","ssdeep":"1536:q4mCgi8DyCuXXFiJ+L0kJQsJVPEKLQRZdC/RlfDknv+p0WzH/IoSZ7qABZnu0sFv:qGsKXlI2p0WPSbDrstfam","tlshash":"ba93f8ddb2d1b06257bb21bd006f540ff236195e280d8850f129e8eabc74a4d9277fad","size":93100,"data":"","first_seen":"2023-03-07T01:02:01Z","last_seen":"2026-07-17T13:56:29.389195Z","times_seen":21665,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/js/lowerie.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"58513e6d3d2fa092c6a862bf7b4eb4d4","sha1":"b9d6223641a5255218d0c0b2517f43eaa2fd3527","sha256":"c1652bfab331ccd5b6a6ae38abf50b2f738c3c0bc8314a75b559bb2d603b06a9","sha512":"1dadb346e38d08d024b715865c772cb15611970a9288f73c1d92b5656ad15252a3329067e5f93ed13450b41cbef15f4c02c07bf2286abd72a5656c9a039d39ae","ssdeep":"","tlshash":"50f0ac2614b1157e0d2f154e7a259e5dfa303429a4175a00f56a89cdada2e43882fcec","size":601,"data":"","first_seen":"2026-07-14T03:50:10.783141Z","last_seen":"2026-07-17T13:53:29.490308Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"error","text":"Loading chunk 4 failed.\n(error: https://ztosk.eh.xznkjzx.cn/dist/494fe3c.js)","filename":"","line_number":0,"column_number":0},{"level":"error","text":"Loading chunk 4 failed.\n(error: https://ztosk.eh.xznkjzx.cn/dist/494fe3c.js)","filename":"","line_number":0,"column_number":0}]},"http":[{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/dist/55587a0.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:25.438Z","timestamp":1784296105438,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /dist/55587a0.js HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ndate: Fri, 17 Jul 2026 13:48:25 GMT\r\ncontent-type: text/html\r\ncontent-length: 479\r\netag: \"6a54b62f-1df\"\r\nserver: nginx\r\nx-cache-status: MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":479,"size_decoded":656,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"57dd7bfa6c07bfe5eeada45d4bdd78ec","sha1":"395c6ad5c3ae0e8ea47281f5007c369551b32ad7","sha256":"c870990950ca5802e260be6786d1e6a148b1acdfeed4fa9bb6acce744488c0b5","sha512":"c455d00381bde372d6016e7b01eb8682dcbc2fbb032ef522f01f0ea1cd85abeb962aeb8de621b49b138b614b14285686a2c432b4214630f23fda2ed19bf4b9d6","ssdeep":"","tlshash":"27f0dc93d243040e220c45702fb2702450877ddbcb9a0d028897e1bfccd5a698363bad","first_seen":"2023-04-28T05:56:14Z","last_seen":"2026-07-17T13:53:29.483624Z","times_seen":3618,"resource_available":true,"data":null}},"time_used":777,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":776,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/dist/f879a2d.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:25.439Z","timestamp":1784296105439,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /dist/f879a2d.js HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ndate: Fri, 17 Jul 2026 13:48:25 GMT\r\ncontent-type: text/html\r\ncontent-length: 479\r\netag: \"6a54b62f-1df\"\r\nserver: nginx\r\nx-cache-status: MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":479,"size_decoded":656,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"57dd7bfa6c07bfe5eeada45d4bdd78ec","sha1":"395c6ad5c3ae0e8ea47281f5007c369551b32ad7","sha256":"c870990950ca5802e260be6786d1e6a148b1acdfeed4fa9bb6acce744488c0b5","sha512":"c455d00381bde372d6016e7b01eb8682dcbc2fbb032ef522f01f0ea1cd85abeb962aeb8de621b49b138b614b14285686a2c432b4214630f23fda2ed19bf4b9d6","ssdeep":"","tlshash":"27f0dc93d243040e220c45702fb2702450877ddbcb9a0d028897e1bfccd5a698363bad","first_seen":"2023-04-28T05:56:14Z","last_seen":"2026-07-17T13:53:29.483624Z","times_seen":3618,"resource_available":true,"data":null}},"time_used":775,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":775,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/picture/xing.png","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:25.461Z","timestamp":1784296105461,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/picture/xing.png HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:25 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 13 Jul 2026 14:04:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a54f06d-18ea0\"\r\nexpires: Sat, 15 Aug 2026 06:27:02 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":102048,"size_decoded":101498,"mime_type":"image/png","magic":"PNG image data, 468 x 395, 8-bit/color RGBA, non-interlaced","md5":"f0d891591747b149744c05e667345755","sha1":"5872d11ad75466cc74c582933e7a8859d1040795","sha256":"7457ba2031370e6a0234365bf5e9a07e6103c8f4e8b6ea77c8d07fc601277e23","sha512":"dd304d503c605bf24dfd1985c27432ac14e40e77ec20c9677e89ded4d65e34331f101fce512fd299da49e04eeaf5b7c9a392da1dd764616ab98a05a64e4e02c7","ssdeep":"1536:1LpQPl7iQZ8QnKyVEWKMwdLgp7XzdKgXMlWHv1uK9BnRGXMQmesr/OtVrknEk:5pWlOQWQnKyVEWKMwdEhzjthQVq0lknZ","tlshash":"87a31238544b11a3199f3c2a7e73649ad08b5ee237db92f431b787f28849c491c8676f","first_seen":"2026-07-17T13:49:02.38266Z","last_seen":"2026-07-17T13:56:00.862284Z","times_seen":4,"resource_available":false,"data":null}},"time_used":384,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":384,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/picture/d6947e1.svg","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:25.464Z","timestamp":1784296105464,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/picture/d6947e1.svg HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:25 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Mon, 13 Jul 2026 09:55:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a54b62f-1a96\"\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6806,"size_decoded":3103,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"5980b08b37e53900660136220a147f8b","sha1":"dc66fe0cf80a64a2b8c931c88937dca87b3a6ab8","sha256":"35502fb56116744a80aeb07d14b753b650929e081185ab8ddf54a7d94f236c7b","sha512":"174181d1795f07c653669ad3caab349e600d3161b4b5f1957fcd53831b5d49e981c4c61248208344a6c1d19e7026662430466fd28362c8ff611a6c57c9063969","ssdeep":"192:MJu5TBKQdltFjILCApbBck/DDHISoc9+X:zoQTtRWbBh/DDHIM+X","tlshash":"bbe196ee77e473f0d500fbf1da2c58ad3a0f28fe3aa18628c35a5c55b69516e8844cc0","first_seen":"2025-08-17T19:07:36.705932Z","last_seen":"2026-07-17T13:53:29.488998Z","times_seen":5,"resource_available":false,"data":null}},"time_used":412,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":412,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/js/55587a0.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:25.728Z","timestamp":1784296105728,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/js/55587a0.js HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:25 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 13 Jul 2026 09:55:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a54b62f-186c\"\r\nexpires: Fri, 17 Jul 2026 19:37:13 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6252,"size_decoded":3027,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (6252), with no line terminators","md5":"c94535cda1a21147c82218a6c358d69f","sha1":"832c41ae0ed3fe99876ec9150fcd4d2ce758a75e","sha256":"767f446c90ce6e57c8b942fc55e857e199842cc060c8bc0c6ae6c1dc5ed73d3b","sha512":"385b53c21e40060f94ffc0a7a74f1e6c7705819752d0f936def2739777bbcafed37e0a221ef7674d869595c08e14cfc54f2150e4d5eeae313dc6b685e1c4af8d","ssdeep":"192:EqqD+lbScS/lwplf7TzSI0VlbScS/lwpdT4OGQAcPmHf681:K+lk/lwjf7XSI4lk/lwDHDA+mT","tlshash":"69d1d86b37ecfaa792710551487be46fba2838513d15c080db99d77d683cdc19423bb2","first_seen":"2026-07-14T03:50:10.837739Z","last_seen":"2026-07-17T13:53:29.482503Z","times_seen":3,"resource_available":true,"data":null}},"time_used":388,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":388,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/css/24b70c7.css","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:23.372Z","timestamp":1784296103372,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/css/24b70c7.css HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:23 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 13 Jul 2026 09:55:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a54b62f-561c\"\r\nexpires: Fri, 17 Jul 2026 19:37:12 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":22044,"size_decoded":3095,"mime_type":"text/css","magic":"ASCII text, with very long lines (22044), with no line terminators","md5":"61b21047631d3fc7b663542ccb4dfb22","sha1":"2eeb073bd39b81809e8b7c9f20dd3940709d70dc","sha256":"82d67816d199d567f2b11b8b7a425be1c07b544a4dfbb62d222257fdb00bfb79","sha512":"a1385ee3bac1b17829f1276ee4f0057318a5b98d6643bcebd9ebd1ed57dc2aa0e86832db471426ae8712ec2a9f1283008397dd486300931d1a396cc4dd23b82d","ssdeep":"192:jO2AnJrDfKg2UfNW/IkhA2gLls/GphbJ6WCFlmLLXPdW:PoJrDfm8NW/FHMls/GphbJ6WCFIfdW","tlshash":"b0a2323272dca119b277da1170247ee568145b93d34653b8fa31383dcca7887397eb8a","first_seen":"2026-07-14T03:50:10.786677Z","last_seen":"2026-07-17T13:53:29.490826Z","times_seen":3,"resource_available":false,"data":null}},"time_used":140,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":140,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/js/bf3d6f4.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:25.735Z","timestamp":1784296105735,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/js/bf3d6f4.js HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:25 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 13 Jul 2026 09:55:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a54b62f-1dca0\"\r\nexpires: Fri, 17 Jul 2026 19:37:14 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":122016,"size_decoded":36738,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64559), with no line terminators","md5":"bbd9df8007292f539cb19f9e75b4df92","sha1":"a01e56137c8cc9b0391bc4292c9c26a87f919488","sha256":"ecc6debb864fc4340e229c9f3aa807b722dfa26679463a584a8ed77790e0bc15","sha512":"9fe1a77d16142ebf3941c7033287d712b3f93762213faa13c604e4d8cbdce189b4124c06613f143e71f1d06c6409faf9bd25bc34ad7fafd704600aadea6df25b","ssdeep":"1536:49uOeQG/Oavp/UGT4J8pFSuI6X4+67f2aVP/e6X/xqVXoOdf2n0LH31etTeZyi6s:W7OaV/ei0SnU3pyI","tlshash":"21c30859b5c2f47a0a9b2071403f240af1796d99e01dd192e334fdc2bdb894a912bf7e","first_seen":"2026-07-14T03:50:10.819281Z","last_seen":"2026-07-17T13:53:29.485125Z","times_seen":3,"resource_available":true,"data":null}},"time_used":382,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":382,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/dist/494fe3c.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:26.435Z","timestamp":1784296106435,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /dist/494fe3c.js HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ndate: Fri, 17 Jul 2026 13:48:26 GMT\r\ncontent-type: text/html\r\ncontent-length: 479\r\netag: \"6a54b62f-1df\"\r\nserver: nginx\r\nx-cache-status: MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":479,"size_decoded":656,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"57dd7bfa6c07bfe5eeada45d4bdd78ec","sha1":"395c6ad5c3ae0e8ea47281f5007c369551b32ad7","sha256":"c870990950ca5802e260be6786d1e6a148b1acdfeed4fa9bb6acce744488c0b5","sha512":"c455d00381bde372d6016e7b01eb8682dcbc2fbb032ef522f01f0ea1cd85abeb962aeb8de621b49b138b614b14285686a2c432b4214630f23fda2ed19bf4b9d6","ssdeep":"","tlshash":"27f0dc93d243040e220c45702fb2702450877ddbcb9a0d028897e1bfccd5a698363bad","first_seen":"2023-04-28T05:56:14Z","last_seen":"2026-07-17T13:53:29.483624Z","times_seen":3618,"resource_available":true,"data":null}},"time_used":344,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":344,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/dist/102eb0d.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:23.141Z","timestamp":1784296103141,"http_version":"HTTP/2","security_state":"secure","security_info":null,"request":{"raw":"GET /dist/102eb0d.js HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T15:40:28.095252Z","times_seen":17318195,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/js/qrcode-with-logo.min.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:23.443Z","timestamp":1784296103443,"http_version":"HTTP/2","security_state":"secure","security_info":null,"request":{"raw":"GET /static/js/qrcode-with-logo.min.js HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T15:40:28.095252Z","times_seen":17318195,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/js/lowerie.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:25.435Z","timestamp":1784296105435,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/js/lowerie.js HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:25 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 601\r\nlast-modified: Mon, 13 Jul 2026 09:55:59 GMT\r\netag: \"6a54b62f-259\"\r\nexpires: Fri, 17 Jul 2026 15:20:03 GMT\r\ncache-control: max-age=43200\r\nserver: nginx\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":601,"size_decoded":928,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"58513e6d3d2fa092c6a862bf7b4eb4d4","sha1":"b9d6223641a5255218d0c0b2517f43eaa2fd3527","sha256":"c1652bfab331ccd5b6a6ae38abf50b2f738c3c0bc8314a75b559bb2d603b06a9","sha512":"1dadb346e38d08d024b715865c772cb15611970a9288f73c1d92b5656ad15252a3329067e5f93ed13450b41cbef15f4c02c07bf2286abd72a5656c9a039d39ae","ssdeep":"","tlshash":"50f0ac2614b1157e0d2f154e7a259e5dfa303429a4175a00f56a89cdada2e43882fcec","first_seen":"2026-07-14T03:50:10.783141Z","last_seen":"2026-07-17T13:53:29.490308Z","times_seen":3,"resource_available":true,"data":null}},"time_used":135,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":135,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s1.pstatp.com/cdn/expire-1-M/jquery/1.10.2/jquery.min.js","fqdn":"s1.pstatp.com","domain":"pstatp.com","tld":"com"},"ip":{"addr":"163.171.242.128","port":443,"asn":54994,"as":"ML-1432-54994","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:25.455Z","timestamp":1784296105455,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pstatp.com","organization":""},"issuer":{"commonName":"RapidSSL TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Mon, 19 Jan 2026 00:00:00 GMT","end":"Mon, 18 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"A9:6A:E1:A7:75:8A:53:CB:21:EE:80:98:D4:AF:64:06:5E:E0:51:06","sha256":"A1:BC:E6:8F:15:E7:B3:45:C2:FA:F6:70:64:64:31:70:82:BA:4C:BB:B5:CD:B4:1C:F8:84:E2:72:4B:EC:9D:5B"}}},"request":{"raw":"GET /cdn/expire-1-M/jquery/1.10.2/jquery.min.js HTTP/1.1\r\nHost: s1.pstatp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 13:48:25 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 30 Jul 2026 06:21:58 GMT\r\nLast-Modified: Wed, 26 Jan 2022 04:18:24 GMT\r\nETag: W/\"61f0cb90-16bac\"\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nContent-Encoding: gzip\r\nx-tt-trace-host: 013c516a47b755f26745caabca11e0425ad359ce62203137fbf44990f59080aca2f1513a99e5157cdfea6ca12b10256501b17adcd8d883372878e1171e1c79928cde31274f922d98b3bcf4a8dacf559f4b75216a86cb2da8483145b15e98bf3825eb9331e53d512480961b84bf6a36e6f17c15a58d911f922069675cb10f0195f5\r\nx-tt-trace-id: 00-25022307062252ED95F3BE70BA6E1482-61E170E1443E06D6-00\r\nServer: TLB\r\nX-TT-LOGID: 2025022307062252ED95F3BE70BA6E1482\r\nX-Cache-new: HIT\r\nx-via: 1.1 PS-HFE-01Ama46:2 (Cdn Cache Server V2.0), 1.1 PSrbJP1tu67:4 (Cdn Cache Server V2.0), 1.1 PSdgflkfFRA1je97:17 (Cdn Cache Server V2.0)\r\nx-response-cache: edge_hit\r\nx-upper-cache-status: hit\r\nage: 1\r\nserver-timing: cdn-cache;desc=hit,edge;dur=2\r\nx-tt-trace-tag: id=01;cdn-cache=hit;type=static\r\nx-ws-request-id: 6a5a32a9_PSdgflkfFRA1je97_18607-23351\r\nTiming-Allow-Origin: *\r\nx-tt-supplier-id: 0_2\r\nX-Response-Cinfo: 195.64.118.152\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":93100,"size_decoded":34036,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (32072)","md5":"e0e0559014b222245deb26b6ae8bd940","sha1":"e2f3603e23711f6446f278a411d905623d65201e","sha256":"89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e","sha512":"60740da8f871b8263675db2421b0e565fc18e95c772f7c3d5916f224263cd71a6a2e6acceab2f6f8ba1c0607951f0198f525d87d0589fa57045b1d5f292dacf0","ssdeep":"1536:q4mCgi8DyCuXXFiJ+L0kJQsJVPEKLQRZdC/RlfDknv+p0WzH/IoSZ7qABZnu0sFv:qGsKXlI2p0WPSbDrstfam","tlshash":"ba93f8ddb2d1b06257bb21bd006f540ff236195e280d8850f129e8eabc74a4d9277fad","first_seen":"2023-03-07T01:02:01Z","last_seen":"2026-07-17T13:56:29.389195Z","times_seen":21665,"resource_available":true,"data":null}},"time_used":74,"timings":{"blocked":-1,"dns":0,"connect":20,"send":0,"wait":26,"receive":2,"ssl":26},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/js/7fb6e02.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:25.733Z","timestamp":1784296105733,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/js/7fb6e02.js HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:25 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 13 Jul 2026 09:55:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a54b62f-828c1\"\r\nexpires: Fri, 17 Jul 2026 19:37:14 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":534721,"size_decoded":147360,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65485)","md5":"66b31fac73aaa0155fb42d9959b03eb3","sha1":"8a4e86b167ea2ace18af8d2ebb874c1488b72861","sha256":"b0f3ac375b29d9c61387ed41fb27de0c101b47720b81d0c5fd7faf36575d18a3","sha512":"e01a68a34e9bcf9c78d24635ace5aa446c0e2d067aeb6c55800e39d3f0d9b61a785bb428fda43ad12979c89b9087f4ddca3d2770749962bd2cbd5c0e4af3a0de","ssdeep":"6144:ToSVfdlQUgcXoSWvHSYs3ESuSJQSSHUxQ12NxP9Nbwesdu3y/K7iknWPGXJIUdPe:ToSVfLWfS1Hg23Be","tlshash":"25b43b4e7290b06643e761a6403f560bb337381d940ec098b6b5d8ebadbd94d122bf7d","first_seen":"2026-07-14T03:50:10.780379Z","last_seen":"2026-07-17T13:53:29.486417Z","times_seen":3,"resource_available":true,"data":null}},"time_used":383,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":383,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/dist/css/f09ac36.css","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:26.441Z","timestamp":1784296106441,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /dist/css/f09ac36.css HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ndate: Fri, 17 Jul 2026 13:48:26 GMT\r\ncontent-type: text/html\r\ncontent-length: 479\r\netag: \"6a54b62f-1df\"\r\nserver: nginx\r\nx-cache-status: MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":479,"size_decoded":656,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"57dd7bfa6c07bfe5eeada45d4bdd78ec","sha1":"395c6ad5c3ae0e8ea47281f5007c369551b32ad7","sha256":"c870990950ca5802e260be6786d1e6a148b1acdfeed4fa9bb6acce744488c0b5","sha512":"c455d00381bde372d6016e7b01eb8682dcbc2fbb032ef522f01f0ea1cd85abeb962aeb8de621b49b138b614b14285686a2c432b4214630f23fda2ed19bf4b9d6","ssdeep":"","tlshash":"27f0dc93d243040e220c45702fb2702450877ddbcb9a0d028897e1bfccd5a698363bad","first_seen":"2023-04-28T05:56:14Z","last_seen":"2026-07-17T13:53:29.483624Z","times_seen":3618,"resource_available":true,"data":null}},"time_used":348,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":348,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/js/f879a2d.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:23.424Z","timestamp":1784296103424,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/js/f879a2d.js HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:23 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 13 Jul 2026 09:55:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a54b62f-36f15\"\r\nexpires: Fri, 17 Jul 2026 19:37:14 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":225045,"size_decoded":79178,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65485)","md5":"975a638f84662bb8458fd037bb2ab334","sha1":"11e673b4df51890b4b9d60bc8fb14bfb72a5893a","sha256":"4fed1ab25ec43f53e40a596ebe9d5271d7dcf42cf2b505bdbe1df1aef058b017","sha512":"2b6cce5e858b480fd625c5283837b509e9201c426583eb9227e933d6c01c7bd5b701c61bb52a38b546d02cbcfb36565067299e974e3818e0d7968fe38719e912","ssdeep":"3072:1XuT8wbxbQ2eTykHSKnbvuvRJ0cRBecuJ0rE3qY5wX:4T8PbbvanecuJ0QjwX","tlshash":"b124c3cdf695b0b113e720b4406f550bf27ab855b84a81d0e266e4d1bcbc98ea127f3d","first_seen":"2026-07-14T03:50:10.801602Z","last_seen":"2026-07-17T13:53:29.488402Z","times_seen":3,"resource_available":true,"data":null}},"time_used":359,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":359,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/picture/202303161405035f6fe3ddbe7164.png","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:25.725Z","timestamp":1784296105725,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/picture/202303161405035f6fe3ddbe7164.png HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:25 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 13 Jul 2026 09:55:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a54b62f-9ac7a\"\r\nexpires: Sat, 15 Aug 2026 06:27:03 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":633978,"size_decoded":630953,"mime_type":"image/png","magic":"PNG image data, 1160 x 880, 8-bit/color RGBA, interlaced","md5":"6a9bfcefdca2fc6d42173d43a2ecb275","sha1":"7f3a3d01f772b80fc8f061eccdee9183eefaaed4","sha256":"a39be7b94c7df2ffe5e80c17f128c3406e39c1e315265f6a32860ca55c2b2126","sha512":"f777779789d5424065e2f8e49a0a4da1560288ce9142c4912cd3ae7d40dfbaedc1ef081fa46cfa7dc44d4d1a6d28161c3759e3cf7ab14d89f66dd63da8448a25","ssdeep":"12288:AYtfxspD/Hc9pMZyo1qqwebFkkq0P2zEhzH6GdlsbheC8aW:nMoo1qTeakAEeheT","tlshash":"29d423c0576fbcd25013d2e2c31d7c895338a79aea346acb46a6c51b2c1358b7a5ed0b","first_seen":"2026-07-14T03:50:10.831421Z","last_seen":"2026-07-17T13:53:29.485726Z","times_seen":3,"resource_available":false,"data":null}},"time_used":391,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":391,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/dist/css/24b70c7.css","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:23.139Z","timestamp":1784296103139,"http_version":"HTTP/2","security_state":"secure","security_info":null,"request":{"raw":"GET /dist/css/24b70c7.css HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T15:40:28.095252Z","times_seen":17318195,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/dist/7fb6e02.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:25.443Z","timestamp":1784296105443,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /dist/7fb6e02.js HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ndate: Fri, 17 Jul 2026 13:48:25 GMT\r\ncontent-type: text/html\r\ncontent-length: 479\r\netag: \"6a54b62f-1df\"\r\nserver: nginx\r\nx-cache-status: MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":479,"size_decoded":656,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"57dd7bfa6c07bfe5eeada45d4bdd78ec","sha1":"395c6ad5c3ae0e8ea47281f5007c369551b32ad7","sha256":"c870990950ca5802e260be6786d1e6a148b1acdfeed4fa9bb6acce744488c0b5","sha512":"c455d00381bde372d6016e7b01eb8682dcbc2fbb032ef522f01f0ea1cd85abeb962aeb8de621b49b138b614b14285686a2c432b4214630f23fda2ed19bf4b9d6","ssdeep":"","tlshash":"27f0dc93d243040e220c45702fb2702450877ddbcb9a0d028897e1bfccd5a698363bad","first_seen":"2023-04-28T05:56:14Z","last_seen":"2026-07-17T13:53:29.483624Z","times_seen":3618,"resource_available":true,"data":null}},"time_used":771,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":771,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/css/c896625.css","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:25.452Z","timestamp":1784296105452,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/css/c896625.css HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:25 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 13 Jul 2026 09:55:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a54b62f-8a79\"\r\nexpires: Fri, 17 Jul 2026 19:37:12 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":35449,"size_decoded":6718,"mime_type":"text/css","magic":"ASCII text, with very long lines (35449), with no line terminators","md5":"25badf2ca372c04f8bfce55a98b1e771","sha1":"b09a785614ad6d3409fe094ce95b46248ec1558d","sha256":"70bac8381f1adde10762affe5f4ae7178aa6f346f99196dd5e85398818494ba8","sha512":"140059e6bfcf5839ab937bdd7a38cc9b251b58e8115b687109fedeebf493e6d68bf6d13796154d5acf06c5f337d8d1d897eead596018709e4f2a74e42d1bd2f1","ssdeep":"384:5gxUTssHASBjld+EZQmNA8UOPngJwLwhwVBj9L:GxUTssHASBld+E3KOPgJwLwGVBjh","tlshash":"daf24633a6ad710bb177d566b0417e9e70982b43e3134769ee22793ec8c35973a72306","first_seen":"2026-07-14T03:50:10.776814Z","last_seen":"2026-07-17T13:53:29.481879Z","times_seen":3,"resource_available":false,"data":null}},"time_used":329,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/picture/202303161406305f6fe4304d7990.png","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:25.719Z","timestamp":1784296105719,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/picture/202303161406305f6fe4304d7990.png HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:25 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 13 Jul 2026 09:55:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a54b62f-237f7\"\r\nexpires: Sat, 15 Aug 2026 06:27:03 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":145399,"size_decoded":144806,"mime_type":"image/png","magic":"PNG image data, 593 x 415, 8-bit/color RGBA, non-interlaced","md5":"fb820755008ebcee86cef295a804c5d0","sha1":"372d4c98982161248c2be5e5f30e485c7b6641cb","sha256":"f050dbe1d9f20a8c8f6e5116a5305d7a2afc2008cea2fe5153626e7039a1a228","sha512":"f683e96f2158c29807a31a66042860ecccd5eabf5d342363a1f08ce6d2e6de5952c9b49ae9b92191e068e3eb8d2256b0f0fb21e82ad5efcbe4f71e11a45fa3f4","ssdeep":"3072:jJ83MuwfbJTQJjH9vEfn96dGItd5vn4dLAG0In3sQhkwM:jJ83MP18JDQ96J1wCgsQhkh","tlshash":"7ee31328a01b708001b59f09ddea2106bb1a08b675f422de7ab587e6a41facdc4f4f75","first_seen":"2026-07-14T03:50:10.825139Z","last_seen":"2026-07-17T13:53:29.494737Z","times_seen":3,"resource_available":false,"data":null}},"time_used":315,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":315,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-17T13:48:21.786Z","timestamp":1784296101786,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:22 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 15 Jul 2026 08:35:10 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a57463e-9d6c\"\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]},{"name":"jQuery:1.10.2","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Google Tag Manager","description":"Google Tag Manager is a tag management system (TMS) that allows you to quickly and easily update measurement codes and related code fragments collectively known as tags on your website or mobile app.","website":"https://www.google.com/tagmanager","common_platform_enumeration":"","icon":"Google Tag Manager.svg","categories":["Tag managers"]},{"name":"Nuxt.js","description":"Nuxt is a Vue framework for developing modern web applications.","website":"https://nuxt.com","common_platform_enumeration":"","icon":"Nuxt.js.svg","categories":["JavaScript frameworks","Web frameworks","Web servers","Static site generator"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":40300,"size_decoded":12514,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1194)","md5":"9fd4cda65e253a650019d13a8c8984a5","sha1":"4c58dc389ee76485b2b009c8bd3cbdf33ffc9ef7","sha256":"729833c22ec59f0c7b9abf2e82376556dc0d08b59e164a7c2acba8ae7f46605b","sha512":"29a39014d16c472ba6ebc496c962a936b2b7af7c613084cd1d34e9fe2ab4566b54d71183e8ed679ec0022e5e2411a7a6c9e0363f0891df38772171c168f8a7d9","ssdeep":"384:m1EvR2mZaRMTG6nRMTG6qRMTG6URMTG6pRMTG6RVjtxvYEFiJrBp8K/iItzvoWYe:Y6t6m6c6j6fXw0kv6KvuKEHq1","tlshash":"f403c8322c5658631363d2f015b92f9becdaeb4fd80941b4756c6991afc7f60e8bb480","first_seen":"2026-07-17T13:49:02.40909Z","last_seen":"2026-07-17T13:53:29.489563Z","times_seen":2,"resource_available":true,"data":null}},"time_used":1062,"timings":{"blocked":-1,"dns":442,"connect":135,"send":0,"wait":344,"receive":0,"ssl":141},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/js/qrcode-with-logo.min.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:23.096Z","timestamp":1784296103096,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/js/qrcode-with-logo.min.js HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:23 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 13 Jul 2026 09:55:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a54b62f-ed0a\"\r\nexpires: Fri, 17 Jul 2026 19:37:12 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":60682,"size_decoded":20544,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (24021), with CRLF line terminators","md5":"4d47effbbd9dbf1cd3c8dd84e8c193f4","sha1":"fe4e1aed878dbfa25403c39b7b261e217faee7f8","sha256":"1de6e45af0c2432423778a652d5d0ffbdcbfa7830e576600cc88232eb0711fba","sha512":"c13fc9ba42d3a1f9051ba0f0f61852c02f0e2f9ccd2de3085f1968a606128e9dbfa1ee2fb4fe4b58251a9600db67b620185d0195511e414a1bd73a155677dc35","ssdeep":"768:rUDAp/Gue0Mp86NkZTD688rRfnVtX06boY3b6rCEEe3/tocnWirqBRavKqre1G3q:rOW1T/8rR/x3bitoQuSZbQQKjqq7","tlshash":"7f53d888f6d5b06943a365a4401f500bf1baae69b80d48a4f655d4d2bcfcdce807bf78","first_seen":"2026-07-14T03:50:10.808747Z","last_seen":"2026-07-17T13:53:29.487594Z","times_seen":3,"resource_available":true,"data":null}},"time_used":196,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":196,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/picture/202303161405035f6fe3ddbe7164.png","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:23.433Z","timestamp":1784296103433,"http_version":"HTTP/2","security_state":"secure","security_info":null,"request":{"raw":"GET /static/picture/202303161405035f6fe3ddbe7164.png HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T15:40:28.095252Z","times_seen":17318195,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/dist/css/640e107.css","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:23.133Z","timestamp":1784296103133,"http_version":"HTTP/2","security_state":"secure","security_info":null,"request":{"raw":"GET /dist/css/640e107.css HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T15:40:28.095252Z","times_seen":17318195,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/css/c896625.css","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:23.144Z","timestamp":1784296103144,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/css/c896625.css HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:23 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 13 Jul 2026 09:55:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a54b62f-8a79\"\r\nexpires: Fri, 17 Jul 2026 19:37:12 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":35449,"size_decoded":6718,"mime_type":"text/css","magic":"ASCII text, with very long lines (35449), with no line terminators","md5":"25badf2ca372c04f8bfce55a98b1e771","sha1":"b09a785614ad6d3409fe094ce95b46248ec1558d","sha256":"70bac8381f1adde10762affe5f4ae7178aa6f346f99196dd5e85398818494ba8","sha512":"140059e6bfcf5839ab937bdd7a38cc9b251b58e8115b687109fedeebf493e6d68bf6d13796154d5acf06c5f337d8d1d897eead596018709e4f2a74e42d1bd2f1","ssdeep":"384:5gxUTssHASBjld+EZQmNA8UOPngJwLwhwVBj9L:GxUTssHASBld+E3KOPgJwLwGVBjh","tlshash":"daf24633a6ad710bb177d566b0417e9e70982b43e3134769ee22793ec8c35973a72306","first_seen":"2026-07-14T03:50:10.776814Z","last_seen":"2026-07-17T13:53:29.481879Z","times_seen":3,"resource_available":false,"data":null}},"time_used":297,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":297,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/picture/0a54c32.png","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:23.396Z","timestamp":1784296103396,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/picture/0a54c32.png HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:23 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 13 Jul 2026 09:55:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a54b62f-6dd\"\r\nexpires: Sat, 15 Aug 2026 06:27:02 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1757,"size_decoded":2081,"mime_type":"image/png","magic":"PNG image data, 120 x 122, 8-bit colormap, non-interlaced","md5":"c7967aeaf10ba38352e0f0a501ed1804","sha1":"5848b2b2a43808df2a6debf66e427d433ddb34ba","sha256":"d509f7aac4be786757640fa73276546a391b6bca49cc4d552ab7cc6032d8fe06","sha512":"e2deda3dd0f8d40d3f0b07e206165c801c8c28db1d0bb200cf2121268e50d585d30542710ad830a6fccdfc2a5fec023e30ecda1d701708051193f695611a7c90","ssdeep":"","tlshash":"bf310baf7e604a15ee2181c046e050cf59ade76c18b04d0477bb0f37673ba27595d5d8","first_seen":"2023-09-12T08:15:12Z","last_seen":"2026-07-17T13:53:29.494197Z","times_seen":9,"resource_available":false,"data":null}},"time_used":329,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/js/bf3d6f4.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:23.426Z","timestamp":1784296103426,"http_version":"HTTP/2","security_state":"secure","security_info":null,"request":{"raw":"GET /static/js/bf3d6f4.js HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T15:40:28.095252Z","times_seen":17318195,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/picture/202303161407135f6fe459fdc14c.png","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:23.435Z","timestamp":1784296103435,"http_version":"HTTP/2","security_state":"secure","security_info":null,"request":{"raw":"GET /static/picture/202303161407135f6fe459fdc14c.png HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T15:40:28.095252Z","times_seen":17318195,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/picture/d6947e1.svg","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:23.399Z","timestamp":1784296103399,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/picture/d6947e1.svg HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:23 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Mon, 13 Jul 2026 09:55:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a54b62f-1a96\"\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6806,"size_decoded":3103,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"5980b08b37e53900660136220a147f8b","sha1":"dc66fe0cf80a64a2b8c931c88937dca87b3a6ab8","sha256":"35502fb56116744a80aeb07d14b753b650929e081185ab8ddf54a7d94f236c7b","sha512":"174181d1795f07c653669ad3caab349e600d3161b4b5f1957fcd53831b5d49e981c4c61248208344a6c1d19e7026662430466fd28362c8ff611a6c57c9063969","ssdeep":"192:MJu5TBKQdltFjILCApbBck/DDHISoc9+X:zoQTtRWbBh/DDHIM+X","tlshash":"bbe196ee77e473f0d500fbf1da2c58ad3a0f28fe3aa18628c35a5c55b69516e8844cc0","first_seen":"2025-08-17T19:07:36.705932Z","last_seen":"2026-07-17T13:53:29.488998Z","times_seen":5,"resource_available":false,"data":null}},"time_used":336,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":336,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/picture/202303161405455f6fe40569d9f8.png","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:23.432Z","timestamp":1784296103432,"http_version":"HTTP/2","security_state":"secure","security_info":null,"request":{"raw":"GET /static/picture/202303161405455f6fe40569d9f8.png HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T15:40:28.095252Z","times_seen":17318195,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/js/qrcode-with-logo.min.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:25.437Z","timestamp":1784296105437,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/js/qrcode-with-logo.min.js HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:25 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 13 Jul 2026 09:55:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a54b62f-ed0a\"\r\nexpires: Fri, 17 Jul 2026 19:37:12 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":60682,"size_decoded":20544,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (24021), with CRLF line terminators","md5":"4d47effbbd9dbf1cd3c8dd84e8c193f4","sha1":"fe4e1aed878dbfa25403c39b7b261e217faee7f8","sha256":"1de6e45af0c2432423778a652d5d0ffbdcbfa7830e576600cc88232eb0711fba","sha512":"c13fc9ba42d3a1f9051ba0f0f61852c02f0e2f9ccd2de3085f1968a606128e9dbfa1ee2fb4fe4b58251a9600db67b620185d0195511e414a1bd73a155677dc35","ssdeep":"768:rUDAp/Gue0Mp86NkZTD688rRfnVtX06boY3b6rCEEe3/tocnWirqBRavKqre1G3q:rOW1T/8rR/x3bitoQuSZbQQKjqq7","tlshash":"7f53d888f6d5b06943a365a4401f500bf1baae69b80d48a4f655d4d2bcfcdce807bf78","first_seen":"2026-07-14T03:50:10.808747Z","last_seen":"2026-07-17T13:53:29.487594Z","times_seen":3,"resource_available":true,"data":null}},"time_used":193,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":193,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/css/640e107.css","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:25.451Z","timestamp":1784296105451,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/css/640e107.css HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:25 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 13 Jul 2026 09:55:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a54b62f-1d5d7\"\r\nexpires: Fri, 17 Jul 2026 19:37:12 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":120279,"size_decoded":14277,"mime_type":"text/css","magic":"ASCII text, with very long lines (65365)","md5":"8e209c1644eeba3b2a7b681f7cbd9111","sha1":"b4f96966be6a14324b8f444e984f8033776668f8","sha256":"f6933074375887d09b65315fb3b383f89ddfdc336c80a8dedb5a994b3cdb4480","sha512":"088e36a2c2b9a5acc701cdbe89c51566e8d6668c1ba5e2394bbb5d69a43deab876f482939f82d02debb7ff51d5a568f5be83e8c0a883b125aca14b9414ac050a","ssdeep":"1536:uuN6Qfd3PwawneMfl7yM2pkZKPhwh1nAukdDO3Xyr5Ir5eP0dTdIctV28Y7SrW3N:7kZewh1nAukdDO3Xyr5Ir5eP0dTKBNH","tlshash":"a1c3f7da8a97129952238e6787cc5e544f2cc7b394610ded7245380e8b82f9d33db72b","first_seen":"2026-07-14T03:50:10.836283Z","last_seen":"2026-07-17T13:53:29.481262Z","times_seen":3,"resource_available":false,"data":null}},"time_used":313,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":313,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/dist/7fb6e02.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:23.134Z","timestamp":1784296103134,"http_version":"HTTP/2","security_state":"secure","security_info":null,"request":{"raw":"GET /dist/7fb6e02.js HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T15:40:28.095252Z","times_seen":17318195,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/picture/202303161406305f6fe4304d7990.png","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:23.430Z","timestamp":1784296103430,"http_version":"HTTP/2","security_state":"secure","security_info":null,"request":{"raw":"GET /static/picture/202303161406305f6fe4304d7990.png HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T15:40:28.095252Z","times_seen":17318195,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/dist/css/24b70c7.css","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:25.448Z","timestamp":1784296105448,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /dist/css/24b70c7.css HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ndate: Fri, 17 Jul 2026 13:48:25 GMT\r\ncontent-type: text/html\r\ncontent-length: 479\r\netag: \"6a54b62f-1df\"\r\nserver: nginx\r\nx-cache-status: MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":479,"size_decoded":656,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"57dd7bfa6c07bfe5eeada45d4bdd78ec","sha1":"395c6ad5c3ae0e8ea47281f5007c369551b32ad7","sha256":"c870990950ca5802e260be6786d1e6a148b1acdfeed4fa9bb6acce744488c0b5","sha512":"c455d00381bde372d6016e7b01eb8682dcbc2fbb032ef522f01f0ea1cd85abeb962aeb8de621b49b138b614b14285686a2c432b4214630f23fda2ed19bf4b9d6","ssdeep":"","tlshash":"27f0dc93d243040e220c45702fb2702450877ddbcb9a0d028897e1bfccd5a698363bad","first_seen":"2023-04-28T05:56:14Z","last_seen":"2026-07-17T13:53:29.483624Z","times_seen":3618,"resource_available":true,"data":null}},"time_used":767,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":766,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/dist/102eb0d.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:25.449Z","timestamp":1784296105449,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /dist/102eb0d.js HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ndate: Fri, 17 Jul 2026 13:48:25 GMT\r\ncontent-type: text/html\r\ncontent-length: 479\r\netag: \"6a54b62f-1df\"\r\nserver: nginx\r\nx-cache-status: MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":479,"size_decoded":656,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"57dd7bfa6c07bfe5eeada45d4bdd78ec","sha1":"395c6ad5c3ae0e8ea47281f5007c369551b32ad7","sha256":"c870990950ca5802e260be6786d1e6a148b1acdfeed4fa9bb6acce744488c0b5","sha512":"c455d00381bde372d6016e7b01eb8682dcbc2fbb032ef522f01f0ea1cd85abeb962aeb8de621b49b138b614b14285686a2c432b4214630f23fda2ed19bf4b9d6","ssdeep":"","tlshash":"27f0dc93d243040e220c45702fb2702450877ddbcb9a0d028897e1bfccd5a698363bad","first_seen":"2023-04-28T05:56:14Z","last_seen":"2026-07-17T13:53:29.483624Z","times_seen":3618,"resource_available":true,"data":null}},"time_used":765,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":765,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/js/qrcode-with-logo.min.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:25.668Z","timestamp":1784296105668,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/js/qrcode-with-logo.min.js HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:25 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 13 Jul 2026 09:55:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a54b62f-ed0a\"\r\nexpires: Fri, 17 Jul 2026 19:37:12 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":60682,"size_decoded":20544,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (24021), with CRLF line terminators","md5":"4d47effbbd9dbf1cd3c8dd84e8c193f4","sha1":"fe4e1aed878dbfa25403c39b7b261e217faee7f8","sha256":"1de6e45af0c2432423778a652d5d0ffbdcbfa7830e576600cc88232eb0711fba","sha512":"c13fc9ba42d3a1f9051ba0f0f61852c02f0e2f9ccd2de3085f1968a606128e9dbfa1ee2fb4fe4b58251a9600db67b620185d0195511e414a1bd73a155677dc35","ssdeep":"768:rUDAp/Gue0Mp86NkZTD688rRfnVtX06boY3b6rCEEe3/tocnWirqBRavKqre1G3q:rOW1T/8rR/x3bitoQuSZbQQKjqq7","tlshash":"7f53d888f6d5b06943a365a4401f500bf1baae69b80d48a4f655d4d2bcfcdce807bf78","first_seen":"2026-07-14T03:50:10.808747Z","last_seen":"2026-07-17T13:53:29.487594Z","times_seen":3,"resource_available":true,"data":null}},"time_used":350,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":350,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/picture/202303161405455f6fe40569d9f8.png","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:25.721Z","timestamp":1784296105721,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/picture/202303161405455f6fe40569d9f8.png HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:25 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 13 Jul 2026 09:55:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a54b62f-4598d\"\r\nexpires: Sat, 15 Aug 2026 06:27:03 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":285069,"size_decoded":274769,"mime_type":"image/png","magic":"PNG image data, 1741 x 1321, 8-bit/color RGBA, non-interlaced","md5":"6c670e45b24709fc7bc6d24a4e4c66eb","sha1":"059a3157f532d5887fc40dcfadf191364508e104","sha256":"3b6602eda9e7fea14b49729f1515bdf5172af8f51b1fef7150b290ae86479195","sha512":"deda32cc6cf99d505427d8c2db7c1d3fda91fa81fb34f5ce6c949e3fcc8bde483459517cc9d79ab5cf2ada5532322b41d60b3a44ac395971314346230674e899","ssdeep":"6144:0Rjm64WcbzzfbZOc85usVXqzt+ijFFhm4hYhfl0N/yTRUX0EezlfbWSC:4jQW4N8UWqzt+ijHhm4ygNEUwVk","tlshash":"9f542395cf31fe85ce2341749a7a5f2f433b524b02fa7658cb883dadb140f848655658","first_seen":"2025-08-17T19:07:36.707124Z","last_seen":"2026-07-17T13:53:29.49299Z","times_seen":5,"resource_available":false,"data":null}},"time_used":395,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":395,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/dist/css/c896625.css","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:23.136Z","timestamp":1784296103136,"http_version":"HTTP/2","security_state":"secure","security_info":null,"request":{"raw":"GET /dist/css/c896625.css HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T15:40:28.095252Z","times_seen":17318195,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/dist/bf3d6f4.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:23.138Z","timestamp":1784296103138,"http_version":"HTTP/2","security_state":"secure","security_info":null,"request":{"raw":"GET /dist/bf3d6f4.js HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T15:40:28.095252Z","times_seen":17318195,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s1.pstatp.com/cdn/expire-1-M/jquery/1.10.2/jquery.min.js","fqdn":"s1.pstatp.com","domain":"pstatp.com","tld":"com"},"ip":{"addr":"163.171.242.128","port":443,"asn":54994,"as":"ML-1432-54994","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:23.374Z","timestamp":1784296103374,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pstatp.com","organization":""},"issuer":{"commonName":"RapidSSL TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Mon, 19 Jan 2026 00:00:00 GMT","end":"Mon, 18 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"A9:6A:E1:A7:75:8A:53:CB:21:EE:80:98:D4:AF:64:06:5E:E0:51:06","sha256":"A1:BC:E6:8F:15:E7:B3:45:C2:FA:F6:70:64:64:31:70:82:BA:4C:BB:B5:CD:B4:1C:F8:84:E2:72:4B:EC:9D:5B"}}},"request":{"raw":"GET /cdn/expire-1-M/jquery/1.10.2/jquery.min.js HTTP/1.1\r\nHost: s1.pstatp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 13:48:23 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 30 Jul 2026 06:21:58 GMT\r\nLast-Modified: Wed, 26 Jan 2022 04:18:24 GMT\r\nETag: W/\"61f0cb90-16bac\"\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nContent-Encoding: gzip\r\nx-tt-trace-host: 013c516a47b755f26745caabca11e0425ad359ce62203137fbf44990f59080aca2f1513a99e5157cdfea6ca12b10256501b17adcd8d883372878e1171e1c79928cde31274f922d98b3bcf4a8dacf559f4b75216a86cb2da8483145b15e98bf3825eb9331e53d512480961b84bf6a36e6f17c15a58d911f922069675cb10f0195f5\r\nx-tt-trace-id: 00-25022307062252ED95F3BE70BA6E1482-61E170E1443E06D6-00\r\nServer: TLB\r\nX-TT-LOGID: 2025022307062252ED95F3BE70BA6E1482\r\nX-Cache-new: HIT\r\nx-via: 1.1 PS-HFE-01Ama46:2 (Cdn Cache Server V2.0), 1.1 PSrbJP1tu67:4 (Cdn Cache Server V2.0), 1.1 PSdgflkfFRA1je97:18 (Cdn Cache Server V2.0)\r\nx-response-cache: edge_hit\r\nx-upper-cache-status: hit\r\nage: 1\r\nserver-timing: cdn-cache;desc=hit,edge;dur=109\r\nx-tt-trace-tag: id=01;cdn-cache=hit;type=static\r\nx-ws-request-id: 6a5a32a7_PSdgflkfFRA1je97_19468-37866\r\nTiming-Allow-Origin: *\r\nx-tt-supplier-id: 0_2\r\nX-Response-Cinfo: 195.64.118.152\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":93100,"size_decoded":34038,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (32072)","md5":"e0e0559014b222245deb26b6ae8bd940","sha1":"e2f3603e23711f6446f278a411d905623d65201e","sha256":"89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e","sha512":"60740da8f871b8263675db2421b0e565fc18e95c772f7c3d5916f224263cd71a6a2e6acceab2f6f8ba1c0607951f0198f525d87d0589fa57045b1d5f292dacf0","ssdeep":"1536:q4mCgi8DyCuXXFiJ+L0kJQsJVPEKLQRZdC/RlfDknv+p0WzH/IoSZ7qABZnu0sFv:qGsKXlI2p0WPSbDrstfam","tlshash":"ba93f8ddb2d1b06257bb21bd006f540ff236195e280d8850f129e8eabc74a4d9277fad","first_seen":"2023-03-07T01:02:01Z","last_seen":"2026-07-17T13:56:29.389195Z","times_seen":21665,"resource_available":true,"data":null}},"time_used":465,"timings":{"blocked":-1,"dns":125,"connect":20,"send":0,"wait":166,"receive":20,"ssl":134},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/picture/0a54c32.png","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:25.463Z","timestamp":1784296105463,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/picture/0a54c32.png HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:25 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 13 Jul 2026 09:55:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a54b62f-6dd\"\r\nexpires: Sat, 15 Aug 2026 06:27:02 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1757,"size_decoded":2081,"mime_type":"image/png","magic":"PNG image data, 120 x 122, 8-bit colormap, non-interlaced","md5":"c7967aeaf10ba38352e0f0a501ed1804","sha1":"5848b2b2a43808df2a6debf66e427d433ddb34ba","sha256":"d509f7aac4be786757640fa73276546a391b6bca49cc4d552ab7cc6032d8fe06","sha512":"e2deda3dd0f8d40d3f0b07e206165c801c8c28db1d0bb200cf2121268e50d585d30542710ad830a6fccdfc2a5fec023e30ecda1d701708051193f695611a7c90","ssdeep":"","tlshash":"bf310baf7e604a15ee2181c046e050cf59ade76c18b04d0477bb0f37673ba27595d5d8","first_seen":"2023-09-12T08:15:12Z","last_seen":"2026-07-17T13:53:29.494197Z","times_seen":9,"resource_available":false,"data":null}},"time_used":413,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":413,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/dist/55587a0.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:23.129Z","timestamp":1784296103129,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /dist/55587a0.js HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ndate: Fri, 17 Jul 2026 13:48:23 GMT\r\ncontent-type: text/html\r\ncontent-length: 479\r\netag: \"6a54b62f-1df\"\r\nserver: nginx\r\nx-cache-status: MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":479,"size_decoded":656,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"57dd7bfa6c07bfe5eeada45d4bdd78ec","sha1":"395c6ad5c3ae0e8ea47281f5007c369551b32ad7","sha256":"c870990950ca5802e260be6786d1e6a148b1acdfeed4fa9bb6acce744488c0b5","sha512":"c455d00381bde372d6016e7b01eb8682dcbc2fbb032ef522f01f0ea1cd85abeb962aeb8de621b49b138b614b14285686a2c432b4214630f23fda2ed19bf4b9d6","ssdeep":"","tlshash":"27f0dc93d243040e220c45702fb2702450877ddbcb9a0d028897e1bfccd5a698363bad","first_seen":"2023-04-28T05:56:14Z","last_seen":"2026-07-17T13:53:29.483624Z","times_seen":3618,"resource_available":true,"data":null}},"time_used":350,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":350,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/dist/f879a2d.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:23.130Z","timestamp":1784296103130,"http_version":"HTTP/2","security_state":"secure","security_info":null,"request":{"raw":"GET /dist/f879a2d.js HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ndate: Fri, 17 Jul 2026 13:48:23 GMT\r\ncontent-type: text/html\r\ncontent-length: 479\r\netag: \"6a54b62f-1df\"\r\nserver: nginx\r\nx-cache-status: MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T15:40:28.095252Z","times_seen":17318195,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/picture/xing.png","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:23.394Z","timestamp":1784296103394,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/picture/xing.png HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:23 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 13 Jul 2026 14:04:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a54f06d-18ea0\"\r\nexpires: Sat, 15 Aug 2026 06:27:02 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":102048,"size_decoded":101498,"mime_type":"image/png","magic":"PNG image data, 468 x 395, 8-bit/color RGBA, non-interlaced","md5":"f0d891591747b149744c05e667345755","sha1":"5872d11ad75466cc74c582933e7a8859d1040795","sha256":"7457ba2031370e6a0234365bf5e9a07e6103c8f4e8b6ea77c8d07fc601277e23","sha512":"dd304d503c605bf24dfd1985c27432ac14e40e77ec20c9677e89ded4d65e34331f101fce512fd299da49e04eeaf5b7c9a392da1dd764616ab98a05a64e4e02c7","ssdeep":"1536:1LpQPl7iQZ8QnKyVEWKMwdLgp7XzdKgXMlWHv1uK9BnRGXMQmesr/OtVrknEk:5pWlOQWQnKyVEWKMwdEhzjthQVq0lknZ","tlshash":"87a31238544b11a3199f3c2a7e73649ad08b5ee237db92f431b787f28849c491c8676f","first_seen":"2026-07-17T13:49:02.38266Z","last_seen":"2026-07-17T13:56:00.862284Z","times_seen":4,"resource_available":false,"data":null}},"time_used":167,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":167,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/picture/1d8b65b.png","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:23.411Z","timestamp":1784296103411,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/picture/1d8b65b.png HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:23 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 13 Jul 2026 09:55:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a54b62f-1f11\"\r\nexpires: Sat, 15 Aug 2026 06:27:03 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7953,"size_decoded":7946,"mime_type":"image/png","magic":"PNG image data, 1920 x 214, 8-bit colormap, non-interlaced","md5":"cd98c40287bf5d5090fa7b90c09c19da","sha1":"9c0f632da8688e883912b0e96d26f267d787a541","sha256":"ad0e2d6ada17266f257ab5f1dc7948e4e6b2789d6a70c2fea1c3a3c11d29bcfe","sha512":"e69f41107c436c5ace6d028861bf791e07dfacd2febd81bb59f89ca0362ac41a76ee98c35f41f0678132e8cc54ec54519092f27f0229c600744c5f05772d8a37","ssdeep":"96:oB9YpDEzO7PngYxcCsKHogWA21ybXM/clNSCfBxZKX9jfzn+sWstzYTnVTU1pClu:U6gY7IwtXWcLRfwtjftanVTgpCtCSa0k","tlshash":"d7f1aeaf6b51bd7be56fe47a0f4617538115a243823398e5947d840ec26188cacf8acb","first_seen":"2025-08-17T19:07:36.716028Z","last_seen":"2026-07-17T13:53:29.492111Z","times_seen":4,"resource_available":false,"data":null}},"time_used":334,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":334,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/js/102eb0d.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:23.421Z","timestamp":1784296103421,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/js/102eb0d.js HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:23 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 13 Jul 2026 09:55:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a54b62f-67b2\"\r\nexpires: Fri, 17 Jul 2026 19:37:13 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26546,"size_decoded":11846,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (26152), with no line terminators","md5":"628e017ed644c5d8f602added414f430","sha1":"b53d07cac48bfe44837cada9d29e9fab0418ba39","sha256":"68e88c5034dd078c434218e5be16c2894809f907459519e08a3cee1a1850a226","sha512":"685c1c8079885db9a8afbfc0178f7131e04f1244f7ea9878613b8724b94ba4ee06ae389a8f9b936976fce75397ee06cea4845d6ece08a208eeaece988a9373c9","ssdeep":"384:YPvMCLEjIkUzvS8GMpQrBItzvfWYYCdiVEG8KniftxvaEFIuYx5Upl:dEOavlIiJz5LiUD","tlshash":"53c229773082f9fe0e1e5076511b25388db91eadc849b842b67cfc44e6f8a78561f25c","first_seen":"2026-07-14T03:50:10.793982Z","last_seen":"2026-07-17T13:53:29.484188Z","times_seen":3,"resource_available":true,"data":null}},"time_used":343,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":343,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/dist/css/c896625.css","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:25.445Z","timestamp":1784296105445,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /dist/css/c896625.css HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ndate: Fri, 17 Jul 2026 13:48:25 GMT\r\ncontent-type: text/html\r\ncontent-length: 479\r\netag: \"6a54b62f-1df\"\r\nserver: nginx\r\nx-cache-status: MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":479,"size_decoded":656,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"57dd7bfa6c07bfe5eeada45d4bdd78ec","sha1":"395c6ad5c3ae0e8ea47281f5007c369551b32ad7","sha256":"c870990950ca5802e260be6786d1e6a148b1acdfeed4fa9bb6acce744488c0b5","sha512":"c455d00381bde372d6016e7b01eb8682dcbc2fbb032ef522f01f0ea1cd85abeb962aeb8de621b49b138b614b14285686a2c432b4214630f23fda2ed19bf4b9d6","ssdeep":"","tlshash":"27f0dc93d243040e220c45702fb2702450877ddbcb9a0d028897e1bfccd5a698363bad","first_seen":"2023-04-28T05:56:14Z","last_seen":"2026-07-17T13:53:29.483624Z","times_seen":3618,"resource_available":true,"data":null}},"time_used":770,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":769,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/css/24b70c7.css","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:25.453Z","timestamp":1784296105453,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/css/24b70c7.css HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:25 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 13 Jul 2026 09:55:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a54b62f-561c\"\r\nexpires: Fri, 17 Jul 2026 19:37:12 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":22044,"size_decoded":3095,"mime_type":"text/css","magic":"ASCII text, with very long lines (22044), with no line terminators","md5":"61b21047631d3fc7b663542ccb4dfb22","sha1":"2eeb073bd39b81809e8b7c9f20dd3940709d70dc","sha256":"82d67816d199d567f2b11b8b7a425be1c07b544a4dfbb62d222257fdb00bfb79","sha512":"a1385ee3bac1b17829f1276ee4f0057318a5b98d6643bcebd9ebd1ed57dc2aa0e86832db471426ae8712ec2a9f1283008397dd486300931d1a396cc4dd23b82d","ssdeep":"192:jO2AnJrDfKg2UfNW/IkhA2gLls/GphbJ6WCFlmLLXPdW:PoJrDfm8NW/FHMls/GphbJ6WCFIfdW","tlshash":"b0a2323272dca119b277da1170247ee568145b93d34653b8fa31383dcca7887397eb8a","first_seen":"2026-07-14T03:50:10.786677Z","last_seen":"2026-07-17T13:53:29.490826Z","times_seen":3,"resource_available":false,"data":null}},"time_used":344,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":344,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/css/640e107.css","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:23.142Z","timestamp":1784296103142,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/css/640e107.css HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:23 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 13 Jul 2026 09:55:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a54b62f-1d5d7\"\r\nexpires: Fri, 17 Jul 2026 19:37:12 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":120279,"size_decoded":14277,"mime_type":"text/css","magic":"ASCII text, with very long lines (65365)","md5":"8e209c1644eeba3b2a7b681f7cbd9111","sha1":"b4f96966be6a14324b8f444e984f8033776668f8","sha256":"f6933074375887d09b65315fb3b383f89ddfdc336c80a8dedb5a994b3cdb4480","sha512":"088e36a2c2b9a5acc701cdbe89c51566e8d6668c1ba5e2394bbb5d69a43deab876f482939f82d02debb7ff51d5a568f5be83e8c0a883b125aca14b9414ac050a","ssdeep":"1536:uuN6Qfd3PwawneMfl7yM2pkZKPhwh1nAukdDO3Xyr5Ir5eP0dTdIctV28Y7SrW3N:7kZewh1nAukdDO3Xyr5Ir5eP0dTKBNH","tlshash":"a1c3f7da8a97129952238e6787cc5e544f2cc7b394610ded7245380e8b82f9d33db72b","first_seen":"2026-07-14T03:50:10.836283Z","last_seen":"2026-07-17T13:53:29.481262Z","times_seen":3,"resource_available":false,"data":null}},"time_used":268,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":268,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/js/7fb6e02.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:23.425Z","timestamp":1784296103425,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/js/7fb6e02.js HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:23 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 13 Jul 2026 09:55:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a54b62f-828c1\"\r\nexpires: Fri, 17 Jul 2026 19:37:14 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T15:40:28.095252Z","times_seen":17318195,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/dist/css/640e107.css","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:25.442Z","timestamp":1784296105442,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /dist/css/640e107.css HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ndate: Fri, 17 Jul 2026 13:48:25 GMT\r\ncontent-type: text/html\r\ncontent-length: 479\r\netag: \"6a54b62f-1df\"\r\nserver: nginx\r\nx-cache-status: MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":479,"size_decoded":656,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"57dd7bfa6c07bfe5eeada45d4bdd78ec","sha1":"395c6ad5c3ae0e8ea47281f5007c369551b32ad7","sha256":"c870990950ca5802e260be6786d1e6a148b1acdfeed4fa9bb6acce744488c0b5","sha512":"c455d00381bde372d6016e7b01eb8682dcbc2fbb032ef522f01f0ea1cd85abeb962aeb8de621b49b138b614b14285686a2c432b4214630f23fda2ed19bf4b9d6","ssdeep":"","tlshash":"27f0dc93d243040e220c45702fb2702450877ddbcb9a0d028897e1bfccd5a698363bad","first_seen":"2023-04-28T05:56:14Z","last_seen":"2026-07-17T13:53:29.483624Z","times_seen":3618,"resource_available":true,"data":null}},"time_used":773,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":772,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/picture/1d8b65b.png","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:25.466Z","timestamp":1784296105466,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/picture/1d8b65b.png HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:25 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 13 Jul 2026 09:55:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a54b62f-1f11\"\r\nexpires: Sat, 15 Aug 2026 06:27:03 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7953,"size_decoded":7946,"mime_type":"image/png","magic":"PNG image data, 1920 x 214, 8-bit colormap, non-interlaced","md5":"cd98c40287bf5d5090fa7b90c09c19da","sha1":"9c0f632da8688e883912b0e96d26f267d787a541","sha256":"ad0e2d6ada17266f257ab5f1dc7948e4e6b2789d6a70c2fea1c3a3c11d29bcfe","sha512":"e69f41107c436c5ace6d028861bf791e07dfacd2febd81bb59f89ca0362ac41a76ee98c35f41f0678132e8cc54ec54519092f27f0229c600744c5f05772d8a37","ssdeep":"96:oB9YpDEzO7PngYxcCsKHogWA21ybXM/clNSCfBxZKX9jfzn+sWstzYTnVTU1pClu:U6gY7IwtXWcLRfwtjftanVTgpCtCSa0k","tlshash":"d7f1aeaf6b51bd7be56fe47a0f4617538115a243823398e5947d840ec26188cacf8acb","first_seen":"2025-08-17T19:07:36.716028Z","last_seen":"2026-07-17T13:53:29.492111Z","times_seen":4,"resource_available":false,"data":null}},"time_used":409,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":409,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/picture/202303161407135f6fe459fdc14c.png","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:25.726Z","timestamp":1784296105726,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/picture/202303161407135f6fe459fdc14c.png HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:25 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 13 Jul 2026 09:55:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a54b62f-3d0e7\"\r\nexpires: Sat, 15 Aug 2026 06:27:03 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":250087,"size_decoded":238467,"mime_type":"image/png","magic":"PNG image data, 1741 x 1320, 8-bit/color RGBA, non-interlaced","md5":"1d9f92c8ed0efeb5e59931f1d8a48dfe","sha1":"fcca3bd795ceaec9734493d949a474fa96573cae","sha256":"d7be594f6ffe2bcfc19f2fbfacf75d08f898e469ada882159797f999e8bcced8","sha512":"19659f5efa9a46c78ab4228e680595fd2dd012be6df519fbc8cb4418e294f047987c279cf4ea08e8c7801fbffac5b23bc6b88c0f87878c137ac8cc799947e258","ssdeep":"6144:UU/Drb6tLSAsO5q16Ru6t+zLXtO7nGHZ1DfTJ7LGo2IPJ1g10k5Er2sv:13Cks06tGhvTJ7aIPJ1gufPv","tlshash":"4934010f02b2e9a6ec1f453d5ccb0f5b5eb798e621fd60b5e5023e7e8290d145b4809b","first_seen":"2025-08-17T19:07:36.703502Z","last_seen":"2026-07-17T13:53:29.487038Z","times_seen":6,"resource_available":false,"data":null}},"time_used":390,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":390,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-17T13:48:24.574Z","timestamp":1784296104574,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:25 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 15 Jul 2026 08:35:10 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a57463e-9d6c\"\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Google Tag Manager","description":"Google Tag Manager is a tag management system (TMS) that allows you to quickly and easily update measurement codes and related code fragments collectively known as tags on your website or mobile app.","website":"https://www.google.com/tagmanager","common_platform_enumeration":"","icon":"Google Tag Manager.svg","categories":["Tag managers"]},{"name":"Nuxt.js","description":"Nuxt is a Vue framework for developing modern web applications.","website":"https://nuxt.com","common_platform_enumeration":"","icon":"Nuxt.js.svg","categories":["JavaScript frameworks","Web frameworks","Web servers","Static site generator"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]},{"name":"jQuery:1.10.2","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40300,"size_decoded":12514,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1194)","md5":"9fd4cda65e253a650019d13a8c8984a5","sha1":"4c58dc389ee76485b2b009c8bd3cbdf33ffc9ef7","sha256":"729833c22ec59f0c7b9abf2e82376556dc0d08b59e164a7c2acba8ae7f46605b","sha512":"29a39014d16c472ba6ebc496c962a936b2b7af7c613084cd1d34e9fe2ab4566b54d71183e8ed679ec0022e5e2411a7a6c9e0363f0891df38772171c168f8a7d9","ssdeep":"384:m1EvR2mZaRMTG6nRMTG6qRMTG6URMTG6pRMTG6RVjtxvYEFiJrBp8K/iItzvoWYe:Y6t6m6c6j6fXw0kv6KvuKEHq1","tlshash":"f403c8322c5658631363d2f015b92f9becdaeb4fd80941b4756c6991afc7f60e8bb480","first_seen":"2026-07-17T13:49:02.40909Z","last_seen":"2026-07-17T13:53:29.489563Z","times_seen":2,"resource_available":true,"data":null}},"time_used":830,"timings":{"blocked":0,"dns":3,"connect":134,"send":0,"wait":551,"receive":0,"ssl":141},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/js/lowerie.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:23.095Z","timestamp":1784296103095,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/js/lowerie.js HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:23 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 601\r\nlast-modified: Mon, 13 Jul 2026 09:55:59 GMT\r\netag: \"6a54b62f-259\"\r\nexpires: Fri, 17 Jul 2026 15:20:03 GMT\r\ncache-control: max-age=43200\r\nserver: nginx\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":601,"size_decoded":928,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"58513e6d3d2fa092c6a862bf7b4eb4d4","sha1":"b9d6223641a5255218d0c0b2517f43eaa2fd3527","sha256":"c1652bfab331ccd5b6a6ae38abf50b2f738c3c0bc8314a75b559bb2d603b06a9","sha512":"1dadb346e38d08d024b715865c772cb15611970a9288f73c1d92b5656ad15252a3329067e5f93ed13450b41cbef15f4c02c07bf2286abd72a5656c9a039d39ae","ssdeep":"","tlshash":"50f0ac2614b1157e0d2f154e7a259e5dfa303429a4175a00f56a89cdada2e43882fcec","first_seen":"2026-07-14T03:50:10.783141Z","last_seen":"2026-07-17T13:53:29.490308Z","times_seen":3,"resource_available":true,"data":null}},"time_used":140,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":140,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/js/55587a0.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:23.419Z","timestamp":1784296103419,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/js/55587a0.js HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:23 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 13 Jul 2026 09:55:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a54b62f-186c\"\r\nexpires: Fri, 17 Jul 2026 19:37:13 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6252,"size_decoded":3027,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (6252), with no line terminators","md5":"c94535cda1a21147c82218a6c358d69f","sha1":"832c41ae0ed3fe99876ec9150fcd4d2ce758a75e","sha256":"767f446c90ce6e57c8b942fc55e857e199842cc060c8bc0c6ae6c1dc5ed73d3b","sha512":"385b53c21e40060f94ffc0a7a74f1e6c7705819752d0f936def2739777bbcafed37e0a221ef7674d869595c08e14cfc54f2150e4d5eeae313dc6b685e1c4af8d","ssdeep":"192:EqqD+lbScS/lwplf7TzSI0VlbScS/lwpdT4OGQAcPmHf681:K+lk/lwjf7XSI4lk/lwDHDA+mT","tlshash":"69d1d86b37ecfaa792710551487be46fba2838513d15c080db99d77d683cdc19423bb2","first_seen":"2026-07-14T03:50:10.837739Z","last_seen":"2026-07-17T13:53:29.482503Z","times_seen":3,"resource_available":true,"data":null}},"time_used":329,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/dist/bf3d6f4.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:25.446Z","timestamp":1784296105446,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /dist/bf3d6f4.js HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ndate: Fri, 17 Jul 2026 13:48:25 GMT\r\ncontent-type: text/html\r\ncontent-length: 479\r\netag: \"6a54b62f-1df\"\r\nserver: nginx\r\nx-cache-status: MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":479,"size_decoded":656,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"57dd7bfa6c07bfe5eeada45d4bdd78ec","sha1":"395c6ad5c3ae0e8ea47281f5007c369551b32ad7","sha256":"c870990950ca5802e260be6786d1e6a148b1acdfeed4fa9bb6acce744488c0b5","sha512":"c455d00381bde372d6016e7b01eb8682dcbc2fbb032ef522f01f0ea1cd85abeb962aeb8de621b49b138b614b14285686a2c432b4214630f23fda2ed19bf4b9d6","ssdeep":"","tlshash":"27f0dc93d243040e220c45702fb2702450877ddbcb9a0d028897e1bfccd5a698363bad","first_seen":"2023-04-28T05:56:14Z","last_seen":"2026-07-17T13:53:29.483624Z","times_seen":3618,"resource_available":true,"data":null}},"time_used":769,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":768,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/js/f879a2d.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:25.731Z","timestamp":1784296105731,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/js/f879a2d.js HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:25 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 13 Jul 2026 09:55:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a54b62f-36f15\"\r\nexpires: Fri, 17 Jul 2026 19:37:14 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":225045,"size_decoded":79178,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65485)","md5":"975a638f84662bb8458fd037bb2ab334","sha1":"11e673b4df51890b4b9d60bc8fb14bfb72a5893a","sha256":"4fed1ab25ec43f53e40a596ebe9d5271d7dcf42cf2b505bdbe1df1aef058b017","sha512":"2b6cce5e858b480fd625c5283837b509e9201c426583eb9227e933d6c01c7bd5b701c61bb52a38b546d02cbcfb36565067299e974e3818e0d7968fe38719e912","ssdeep":"3072:1XuT8wbxbQ2eTykHSKnbvuvRJ0cRBecuJ0rE3qY5wX:4T8PbbvanecuJ0QjwX","tlshash":"b124c3cdf695b0b113e720b4406f550bf27ab855b84a81d0e266e4d1bcbc98ea127f3d","first_seen":"2026-07-14T03:50:10.801602Z","last_seen":"2026-07-17T13:53:29.488402Z","times_seen":3,"resource_available":true,"data":null}},"time_used":385,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":385,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/dist/css/1c7257c.css","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:26.433Z","timestamp":1784296106433,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /dist/css/1c7257c.css HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ndate: Fri, 17 Jul 2026 13:48:26 GMT\r\ncontent-type: text/html\r\ncontent-length: 479\r\netag: \"6a54b62f-1df\"\r\nserver: nginx\r\nx-cache-status: MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":479,"size_decoded":656,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"57dd7bfa6c07bfe5eeada45d4bdd78ec","sha1":"395c6ad5c3ae0e8ea47281f5007c369551b32ad7","sha256":"c870990950ca5802e260be6786d1e6a148b1acdfeed4fa9bb6acce744488c0b5","sha512":"c455d00381bde372d6016e7b01eb8682dcbc2fbb032ef522f01f0ea1cd85abeb962aeb8de621b49b138b614b14285686a2c432b4214630f23fda2ed19bf4b9d6","ssdeep":"","tlshash":"27f0dc93d243040e220c45702fb2702450877ddbcb9a0d028897e1bfccd5a698363bad","first_seen":"2023-04-28T05:56:14Z","last_seen":"2026-07-17T13:53:29.483624Z","times_seen":3618,"resource_available":true,"data":null}},"time_used":353,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":353,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/static/js/102eb0d.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:25.730Z","timestamp":1784296105730,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /static/js/102eb0d.js HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:48:25 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 13 Jul 2026 09:55:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a54b62f-67b2\"\r\nexpires: Fri, 17 Jul 2026 19:37:13 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26546,"size_decoded":11846,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (26152), with no line terminators","md5":"628e017ed644c5d8f602added414f430","sha1":"b53d07cac48bfe44837cada9d29e9fab0418ba39","sha256":"68e88c5034dd078c434218e5be16c2894809f907459519e08a3cee1a1850a226","sha512":"685c1c8079885db9a8afbfc0178f7131e04f1244f7ea9878613b8724b94ba4ee06ae389a8f9b936976fce75397ee06cea4845d6ece08a208eeaece988a9373c9","ssdeep":"384:YPvMCLEjIkUzvS8GMpQrBItzvfWYYCdiVEG8KniftxvaEFIuYx5Upl:dEOavlIiJz5LiUD","tlshash":"53c229773082f9fe0e1e5076511b25388db91eadc849b842b67cfc44e6f8a78561f25c","first_seen":"2026-07-14T03:50:10.793982Z","last_seen":"2026-07-17T13:53:29.484188Z","times_seen":3,"resource_available":true,"data":null}},"time_used":387,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":387,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/dist/5d09266.js","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:26.442Z","timestamp":1784296106442,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /dist/5d09266.js HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ndate: Fri, 17 Jul 2026 13:48:26 GMT\r\ncontent-type: text/html\r\ncontent-length: 479\r\netag: \"6a54b62f-1df\"\r\nserver: nginx\r\nx-cache-status: MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":479,"size_decoded":656,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"57dd7bfa6c07bfe5eeada45d4bdd78ec","sha1":"395c6ad5c3ae0e8ea47281f5007c369551b32ad7","sha256":"c870990950ca5802e260be6786d1e6a148b1acdfeed4fa9bb6acce744488c0b5","sha512":"c455d00381bde372d6016e7b01eb8682dcbc2fbb032ef522f01f0ea1cd85abeb962aeb8de621b49b138b614b14285686a2c432b4214630f23fda2ed19bf4b9d6","ssdeep":"","tlshash":"27f0dc93d243040e220c45702fb2702450877ddbcb9a0d028897e1bfccd5a698363bad","first_seen":"2023-04-28T05:56:14Z","last_seen":"2026-07-17T13:53:29.483624Z","times_seen":3618,"resource_available":true,"data":null}},"time_used":342,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":342,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ztosk.eh.xznkjzx.cn/favicon.ico","fqdn":"ztosk.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.127","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ztosk.eh.xznkjzx.cn/","date":"2026-07-17T13:48:26.796Z","timestamp":1784296106796,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ztosk.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:31:49 GMT","end":"Tue, 13 Oct 2026 11:31:48 GMT"},"fingerprint":{"sha1":"84:62:7D:D4:BC:6C:95:77:E4:1B:6A:D2:D2:A7:6A:60:B9:91:11:B8","sha256":"DC:ED:F1:7F:14:46:E9:90:1B:E1:22:3B:46:29:B3:9F:FE:F5:D6:3D:0D:20:AD:0A:60:BA:2F:A7:A8:31:82:A5"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: ztosk.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ztosk.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ndate: Fri, 17 Jul 2026 13:48:27 GMT\r\ncontent-type: text/html\r\ncontent-length: 479\r\netag: \"6a54b62f-1df\"\r\nserver: nginx\r\nx-cache-status: MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":479,"size_decoded":656,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"57dd7bfa6c07bfe5eeada45d4bdd78ec","sha1":"395c6ad5c3ae0e8ea47281f5007c369551b32ad7","sha256":"c870990950ca5802e260be6786d1e6a148b1acdfeed4fa9bb6acce744488c0b5","sha512":"c455d00381bde372d6016e7b01eb8682dcbc2fbb032ef522f01f0ea1cd85abeb962aeb8de621b49b138b614b14285686a2c432b4214630f23fda2ed19bf4b9d6","ssdeep":"","tlshash":"27f0dc93d243040e220c45702fb2702450877ddbcb9a0d028897e1bfccd5a698363bad","first_seen":"2023-04-28T05:56:14Z","last_seen":"2026-07-17T13:53:29.483624Z","times_seen":3618,"resource_available":true,"data":null}},"time_used":348,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":348,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"ztosk.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}