{"report_id":"0cb9e133-717c-41f8-8e93-f597a05c899e","version":6,"status":"done","tags":[],"date":"2026-02-03T21:56:07Z","url":{"schema":"https","addr":"imtoken.download-zh-cn.com/","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":0,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"title":"imToken | Ethereum \u0026 Bitcoin Wallet","dom":{"size":2667,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (882)","md5":"512aa8b730bbaa7b6fc89e5039977ab9","sha1":"6baa8b59edf8656fad09a2577ea14bd0523c6fbe","sha256":"49c2a924699e8f70525d413494208957dac2145ecd8c60d55e66049a9577a873","sha512":"10eddaa22c882637b223283a2f4f092cfbe1816b32cadb0c1f336d7a9ff7178f7c3f378e98e95842943c268cdb69be13297732591898cbfa41b46e4ac2beea41","ssdeep":"","tlshash":"4751a7ba81b4292d312f76f1aa75fa9010bf9086f6461055b17f63b9c7c7a48f803468","dom_hash":"domhash6d374e3c04ba7e2a873e493eb34d1b0b","first_seen":"2025-10-27T00:41:35.427192Z","last_seen":"2026-03-15T11:24:36.464648Z","times_seen":25,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":0,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-10T21:56:07Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"d3hb14vkzrxvla.cloudfront.net","ip":{"addr":"54.192.209.83","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2008-04-25","domain_rank":0,"first_seen":"2020-12-06T19:44:30Z","last_seen":"2026-01-28T19:14:29.261052Z","alert_count":0,"request_count":2,"received_data":10723,"sent_data":1445,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}]},{"fqdn":"token.im","ip":{"addr":"104.20.45.246","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":79762,"first_seen":"2017-03-15T06:46:09Z","last_seen":"2026-02-03T21:53:25.716454Z","alert_count":0,"request_count":1,"received_data":1133,"sent_data":450,"comment":"","tags":null,"fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"hm.baidu.com","ip":{"addr":"111.45.11.83","port":443,"asn":9808,"as":"China Mobile Communications Group Co., Ltd.","country":"China","country_code":"CN"},"domain_registered":"1999-10-11","domain_rank":54491,"first_seen":"2012-05-26T08:38:45Z","last_seen":"2026-02-02T01:44:03.24111Z","alert_count":0,"request_count":2,"received_data":30932,"sent_data":1106,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"v2-cdn-dev.token.im","ip":{"addr":"34.120.113.83","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2023-05-10T08:23:38Z","last_seen":"2026-02-03T21:53:25.772287Z","alert_count":0,"request_count":2,"received_data":1749,"sent_data":1016,"comment":"","tags":null,"fingerprints":null},{"fqdn":"biz.token.im","ip":{"addr":"172.66.151.95","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":7306860,"first_seen":"2020-12-03T07:25:11Z","last_seen":"2026-02-03T21:53:25.790538Z","alert_count":0,"request_count":2,"received_data":3555,"sent_data":1096,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"sp0.baidu.com","ip":{"addr":"103.235.46.102","port":443,"asn":55967,"as":"Beijing Baidu Netcom Science and Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"domain_registered":"1999-10-11","domain_rank":220073,"first_seen":"2014-12-05T23:12:12Z","last_seen":"2026-01-28T13:03:28.603145Z","alert_count":0,"request_count":2,"received_data":232,"sent_data":1008,"comment":"","tags":null,"fingerprints":null},{"fqdn":"www.googletagmanager.com","ip":{"addr":"142.250.178.40","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2011-11-11","domain_rank":283,"first_seen":"2012-10-04T01:07:32Z","last_seen":"2026-02-01T22:20:39.584991Z","alert_count":0,"request_count":1,"received_data":520851,"sent_data":447,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"imtoken.download-zh-cn.com","ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"domain_registered":"2025-12-28","domain_rank":0,"first_seen":"2026-02-03T21:56:10.315045Z","last_seen":"2026-02-03T21:56:10.315045Z","alert_count":264,"request_count":66,"received_data":3966381,"sent_data":33012,"comment":"","tags":null,"fingerprints":[{"name":"scrollreveal","description":"","website":"https://scrollrevealjs.org","common_platform_enumeration":"","icon":"scrollreveal.svg","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ant Design","description":"Ant Design is a UI library that can be used with data flow solutions and application frameworks in any React ecosystem.","website":"https://ant.design","common_platform_enumeration":"","icon":"Ant Design.svg","categories":["UI frameworks"]}]},{"fqdn":"beacon-v2.helpscout.net","ip":{"addr":"108.157.214.29","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2010-03-28","domain_rank":82670,"first_seen":"2018-04-06T09:27:19Z","last_seen":"2026-01-28T18:35:06.051236Z","alert_count":0,"request_count":6,"received_data":659515,"sent_data":2690,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}]},{"fqdn":"zz.bdstatic.com","ip":{"addr":"157.255.63.48","port":443,"asn":136958,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"domain_registered":"2011-12-26","domain_rank":365334,"first_seen":"2017-01-30T07:45:48Z","last_seen":"2026-01-28T11:48:08.206921Z","alert_count":0,"request_count":1,"received_data":767,"sent_data":433,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/js(1)","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"4838d23605f229289248e6886603f6bb","sha1":"a1f687f1b8a34ffece1bda3968fbf801d070c6f7","sha256":"593c3e4141ff7656dc365e6727ab202c0abe27cb1b5b8cbc9a464de4057dbe0f","sha512":"e433edc912a6660b7ab2ffa6e54d1b288076377866eb485d29f8f42ea1326fdbde24df234b8ad2f04d02827b74c578f4ead727c0af61c0148e4eb42dc1a802b5","ssdeep":"6144:fgIe7ma2bulKYX61u99Yye5HDmHYmyBFzvnszmO6jQWllEKPad4XEPPkM:JC8bu7q1mcrnszWcWawEL","tlshash":"7fb409ce73c63426539af478502f02cba9bb29e2b45dc89ab1c9ccf01d7459a4167f78","size":514330,"data":"","first_seen":"2026-02-03T21:53:29.924555Z","last_seen":"2026-02-03T21:56:12.340522Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"beacon-v2.helpscout.net/","fqdn":"beacon-v2.helpscout.net","domain":"helpscout.net","tld":"net"},"ip":{"addr":"108.157.214.29","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"1b30489ca0695aea768bf0259aa878f6","sha1":"e415612270a735b160154c81e132b9b1f0395532","sha256":"8581137db257306a5557e2ad3214bf74681dc6657129d7f5be0b3f4cb4b47ec2","sha512":"94f4d7a719d30a88774fc7f1e976799b654003f2a58f8f116a031fed89383d55dd32a69c4743d4d1cc126b0de9aa7272b31bf4be84c1ccb384f18c3823baeec6","ssdeep":"","tlshash":"2ce0600d3c00c53123a30c729377d83c61a292401033c103e4caccb6b8bcce94c6b28c","size":372,"data":"","first_seen":"2026-02-03T12:17:35.8926Z","last_seen":"2026-02-05T11:52:23.132354Z","times_seen":17,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/main.b7bf113c.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"3484accc83cb4145538452f23086b089","sha1":"6c0f379a81c7270983d79c93423b549775237eb9","sha256":"4a63c402b7403531a5955d3305bd1af363cf805ddc7b5cce3cf0821b9761e3e1","sha512":"a7cdaedb55dc07b80306d6b87873c7fb15051ff19e413c1d7c06d7aa7f460d28424c2dbd4f9e97d294647888bd61f50b23392eb7a8221f7badbd0ee90d41d56b","ssdeep":"768:QAwOGkUUnTxnWmjUju069uBAnRjCVaM8c3XaHf53ZXpMAhcZ7xRcSxdfS:3TxfL1kn3E","tlshash":"6de24ccc35d2b0ed2243eae9177f55d9ab3e3520783a6480bacde0da676258cc153f58","size":32141,"data":"","first_seen":"2025-12-19T23:03:06.922666Z","last_seen":"2026-02-03T21:56:12.317924Z","times_seen":86,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"1c5c9160600df2d96d69a4ea16cec7ed","sha1":"3cf678c9135cc952ba6970ef545035bb757a443f","sha256":"a3520fe88e248d2b6c9c6db93309a037ef969fe297208e5bd7e49a55bb32c808","sha512":"2a298a8c2552c6a6c6f8d3f7327d2e9abfa87a0dbb27e9e528a8539b416155c0860f54f46464dfe7e5d49c7906a9eacdac7e5181b86ef15a83276a8f4fee0546","ssdeep":"","tlshash":"078004d531c35040475331d400571cd4503444f014444d544040d4511c55030d1154dc","size":37,"data":"","first_seen":"2023-04-11T21:49:14Z","last_seen":"2026-08-16T04:53:48.997285Z","times_seen":121780,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/webpack-22eaaa575d3c455933b4.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"2019297a9ccffe0e261600bad1b1f98a","sha1":"a7af96e8e11cadb4f053e78cc91cd7c531f1e877","sha256":"75fa1c4760ad6194a99710872e3612002c84c4df8339a57be0cb4aad1bde794a","sha512":"931b78e601e346f1ae773b8321cdf332b8dcc1fc2345d76f2a187c4c331f30c9f328ef72435b7302293d28b5ab1742685e5d89ce174c0af9c73ede3a9afff1a4","ssdeep":"","tlshash":"193131d536a4fcac53821d5d083f7006f2291d65127cf5c19384e8b2bc6488e9166eaa","size":1539,"data":"","first_seen":"2023-03-07T12:08:00Z","last_seen":"2026-08-14T08:59:26.835946Z","times_seen":459,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/saved_resource","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"35c8379a35d476df500cdf2e03731745","sha1":"235f1aa1560b5dda87b63da5afb88c398dee793d","sha256":"09bac1de8d8cece93bdf86794fa8214de5761f145bedd04fb8d1742720b7f5ce","sha512":"8ec5c0ac5d2e29e29950834e4ea6b42b4a4ce3e5f177d0a4efe3fddc25ad55675493993853e13e3cecfb52b51e28c736fb4ef41b5547792e208116153689ade3","ssdeep":"","tlshash":"99e0f84d2c40843123a21872a367c83c616282400033c102e4cac876a8bcce91c6b28c","size":372,"data":"","first_seen":"2025-12-19T23:03:06.957818Z","last_seen":"2026-02-03T21:56:12.259616Z","times_seen":86,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/analysis.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"a85cf8fc10ee3b671f9f380a2b1ae564","sha1":"789efdfc7309f07bebf74bc079856cd27e96d0e4","sha256":"f76c97305b98aa082d6ce0b70c6118383849611fee941de9736af6e594f1b8e1","sha512":"f7ef90c5b5f52b7402d7819ff6e06f09b734908c3ee303c9304e7101e164ba4059fa08c2d1a231fd8fb7f3836d29d6a0091ca66999db52efb2849c66a4051a5d","ssdeep":"","tlshash":"8431534f3475153866a792fe153fc2087122500e218aba0359dec5008eb0ffa1527acc","size":1591,"data":"","first_seen":"2024-01-06T17:59:56Z","last_seen":"2026-07-19T01:13:04.45864Z","times_seen":40,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zz.bdstatic.com/linksubmit/push.js","fqdn":"zz.bdstatic.com","domain":"bdstatic.com","tld":"com"},"ip":{"addr":"157.255.63.48","port":443,"asn":136958,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"f9fc52ab67f035b8baf5d558714cc94d","sha1":"37062a6fb1ef410d496137d44275738ae743c747","sha256":"c31f2003f1c93ac1e34b09f376d97a65da6e110bf451cf1e0e50a7946c5e7212","sha512":"ebb0415852fbb5b964094e2e55a28b90f701dff1977c8b98c6f24d65d09067dc0c417d01492ca28a4be6747816d7c0bfac87b73a33725aee047a5d2f7ab83182","ssdeep":"","tlshash":"11e0cde86054c01c0dcb107135bb324ce7771d675a645545c04d9445396cb1f8247fe9","size":308,"data":"","first_seen":"2023-03-07T01:18:58Z","last_seen":"2026-08-16T14:56:56.428989Z","times_seen":23562,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"beacon-v2.helpscout.net/static/js/main.b7bf113c.js","fqdn":"beacon-v2.helpscout.net","domain":"helpscout.net","tld":"net"},"ip":{"addr":"108.157.214.29","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"3484accc83cb4145538452f23086b089","sha1":"6c0f379a81c7270983d79c93423b549775237eb9","sha256":"4a63c402b7403531a5955d3305bd1af363cf805ddc7b5cce3cf0821b9761e3e1","sha512":"a7cdaedb55dc07b80306d6b87873c7fb15051ff19e413c1d7c06d7aa7f460d28424c2dbd4f9e97d294647888bd61f50b23392eb7a8221f7badbd0ee90d41d56b","ssdeep":"768:QAwOGkUUnTxnWmjUju069uBAnRjCVaM8c3XaHf53ZXpMAhcZ7xRcSxdfS:3TxfL1kn3E","tlshash":"6de24ccc35d2b0ed2243eae9177f55d9ab3e3520783a6480bacde0da676258cc153f58","size":32141,"data":"","first_seen":"2025-12-19T23:03:06.922666Z","last_seen":"2026-02-03T21:56:12.317924Z","times_seen":86,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/18d5e521d23679fb08f7e64c32b15892a9f9a54d.9a025b638775ae6d73eb.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"31b6299a3bc25c18fd67a1848d7a0c12","sha1":"d716902f6eca564678360b5005d781a056048425","sha256":"bb7a2df20c59e3376f96f1b7881ccf62ac05e01804f1f7bb7e224e4dbcc54974","sha512":"fcc6cf37e64a58ed2e892d109fd178c72a0f868bc730cf19f612c605a3c2fe237283ebdbcf1f9019a2339d1c59af803c37776996bb24cefea29d1ac060ba87e8","ssdeep":"3072:6ldDQws4MG8XZWSmd45PrI50/eEFUtnvvSJteL6KH+mZ4bse/cZh647jZ8BQhK6x:+sbG8l/eZ51KgExe12CBWxEj9FB","tlshash":"1864639fe7350ab608fa41cd8dd82bfed8d20b1101e5d47bc2fa59863b0457ee632a15","size":318900,"data":"","first_seen":"2025-12-04T19:44:06.844388Z","last_seen":"2026-02-03T21:56:12.338808Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/help-zh.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"43df80fe9e8e8118cf36e9828164382a","sha1":"fd182988c2973872554ba5c0349861edced3f756","sha256":"88eba2594e1436de05ec9d83e84c1130918b7b6610eface1fa32c8e8c34a63ac","sha512":"719fad0eac3fa79167881ac5e61247da96b93df3da5d3c5fb7b97e4d5b73c79c5913d1a0f473c8ef9c94580f68f345ea979f422b134be96339935be2a6bd7f48","ssdeep":"","tlshash":"fe01bde93597742486a7e0d9925fcf0d3721611952080486878fd9c4f438daa9b0f99c","size":730,"data":"","first_seen":"2024-01-06T17:59:56Z","last_seen":"2026-07-19T01:13:04.546334Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/framework.a0cc4416b9424a5588b2.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"f52502ac9007133582fe44e8c7b70136","sha1":"6f017871e79d3b5e08aab7db5080e287fc2212c5","sha256":"275ca0ad51cab700a7c66736740557494b815a03fc464577b9c0fdfaf9c41441","sha512":"cec19cb62a3e74b2d9be8d0049597049d6b0d53754c2d6f24d5d422b59a16998fbb33ecfd5cfe53af0f1437f98056517e44e2a16adae3e1865a1fab6609d01ff","ssdeep":"1536:U4v3hV6X5JRGNeG4XFmkXdKwDSuSdDp7FktuGhR8XvCi0AHlk:nfhV6TZ1YwKt7gRwCi0AHlk","tlshash":"e7c3f8d93992f5626bf311b7109f1813733d161b280c4960a212fddeb9bd05ea12bf9e","size":129218,"data":"","first_seen":"2023-09-20T16:39:30Z","last_seen":"2026-08-10T16:24:43.912261Z","times_seen":301,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/scrollreveal.min.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"126cb7c432914f6c726ff146110dcb75","sha1":"e5358bdb7769288dc7c2dc10508e98387e85b6e2","sha256":"fd08659fe0f20fd14dcf4c3c5acdde64de96028174f59b0b3dc776b62be789b9","sha512":"005fd83d6e18b49ad8bc8e46c853e03eb34808c7913aa6df836e6f57a4f41a1256c901b78697c85e6001ddc6c5870dc46f1f3cb500fe74fe69f9ddddc980e4ae","ssdeep":"192:zjBEC60RtRcCT+Ytnvm1uvb/E3aQ6ZvxrTZ6fNrb:zNE312Ntnvm1MbEIZvZTZ6fNrb","tlshash":"cd12d68f3e1274339b5349d5e2df064f773849da2a0b9484b2b4d0bab8b101d6243f6d","size":9095,"data":"","first_seen":"2023-03-07T01:07:32Z","last_seen":"2026-08-12T18:57:22.419399Z","times_seen":1590,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/_ssgManifest.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"abee47769bf307639ace4945f9cfd4ff","sha1":"c0a0dc51ee8a2852baf5ff30c33b1478ff302585","sha256":"653f3e53e89b4f8548ff86c19e92bb3c6b84b6be7485a320b1e00893ed877479","sha512":"2b074799106698df69a28fcd8255c3cfd1ccf40fd4c1bf5d463c42e63b32856f801e066706fbd960a0da4ebe645c070c398dcf01bd722dc4fa592266361ae81a","ssdeep":"","tlshash":"d4a001a0903cdc60aa63dd1c126013168fa05062651d28938afd2054c0341410300d50","size":76,"data":"","first_seen":"2023-03-07T01:03:45Z","last_seen":"2026-08-16T21:53:07.412667Z","times_seen":16985,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.google-analytics.com/gtm/js?id=GTM-MNBPZXP\u0026cid=272943273.1770155747","fqdn":"www.google-analytics.com","domain":"google-analytics.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"f24128d0c9cba7be2916c693427a3483","sha1":"1b6397d496ea896ebc2018b01b995cee4f166029","sha256":"58173de4697da1a218f04c3a783a733bab4e769ceabc37cd42da9dc3e036a7e8","sha512":"c4950733b44e258bbc817ce6396f002caec1e11a6413fd0038c9baef2d5f1d992b1fd0ec52515aba52faedb52c28b996a7fc063f28a0f45f3aab5e2f91bf5be5","ssdeep":"96:A1VdZYqhPnjpWx4/eTe8qSMbqaQd6VL2Jyt9LdJoyayCVPVD5wdBfQPfCHiUr3:AXdZYqNjpU4yPqSMbqaQGL2QfdDayCZC","tlshash":"a6a1dc9939fb50210233b1bd1bafa918b23895236208dd61b98c9364bf94437d7f1fc9","size":4691,"data":"","first_seen":"2023-04-11T21:07:53Z","last_seen":"2026-06-07T08:18:38.899011Z","times_seen":919823,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"c7f0a9523b7de25a7d60a4a8c9ccc0ad","sha1":"e709bdea4a8c967ef4d298c03d6a0b8393ab818a","sha256":"123b31af82abd2ff789ad4dba176d250d785b578d6f7a07f0ed601a95c45a258","sha512":"c0969b8e42a30fcf678a91eb514628dca70feaca28f07d23c25d5ab4218fca9e95c774c836dfe7e0342d3d0f5403aaa95e6a8dac40b565646c02175dd693ecc6","ssdeep":"","tlshash":"44d095ddb1d748f805d73dc16877100cc14a0d4925515f504f2754c23c678b71123d5f","size":275,"data":"","first_seen":"2026-02-03T21:56:12.357734Z","last_seen":"2026-02-03T21:56:12.357734Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=G-3GR90RW2M5","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.178.40","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"54ff4f05795133820f77c69f6cd9018d","sha1":"6171bed23d345bc568b14a3926e07a03d4306a90","sha256":"f183c6cbe1e2cb9dee86f4071baa0bb34f04140b0d9546747e4038a53f09ac0d","sha512":"b6cb0b46e87d23076f2467a38eca31d42fe67d4e6d3bebabea23288ccb854a3d57ec6f88f4840309c84098877484726b869746d3c666c20eb96446091aaa1a37","ssdeep":"6144:1dbh3hDZonfqFMPYaoCsxJGp9OttaGurc8o3OI/85+TN8ZHYA99O3B:rbh3hD6nfy0YaoCsxgp9Ogrc8k8Z4PR","tlshash":"efb4f8de73d63426979af478502f02cba87b25a2b45dc8aab1c9ccf01d3459b4127f78","size":520247,"data":"","first_seen":"2026-02-03T21:54:29.80001Z","last_seen":"2026-02-03T21:56:12.317033Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/push.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"f9fc52ab67f035b8baf5d558714cc94d","sha1":"37062a6fb1ef410d496137d44275738ae743c747","sha256":"c31f2003f1c93ac1e34b09f376d97a65da6e110bf451cf1e0e50a7946c5e7212","sha512":"ebb0415852fbb5b964094e2e55a28b90f701dff1977c8b98c6f24d65d09067dc0c417d01492ca28a4be6747816d7c0bfac87b73a33725aee047a5d2f7ab83182","ssdeep":"","tlshash":"11e0cde86054c01c0dcb107135bb324ce7771d675a645545c04d9445396cb1f8247fe9","size":308,"data":"","first_seen":"2023-03-07T01:18:58Z","last_seen":"2026-08-16T14:56:56.428989Z","times_seen":23562,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/commons.67bd593aa58696eea502.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"98c4fb667ef7f5bf6208a2d2f7b393a6","sha1":"895649104eb3e3327398d6f372df516a6f14e2f5","sha256":"9848f488aa8d97d99729efc50708122ced683c15b5b31bae5e885ae16bd1ef7f","sha512":"5b7efc635f6b9fba655b3d7b98d4b0f3d2be2625eddbc3aad5780fc9edb68932ebd3df49c7b87b509db5928721869912300cad1a11b8b034dd10cfe0ad5a0f13","ssdeep":"384:hqEXFft9Q3C8zlDSafL9561DRzHuSrxp0A2W8o1sO2oXD9zs:/1ft9Q3Rzl3TaFzHH0Ho1Zps","tlshash":"44724ecab1c7b1165393f5b4002f150af62f98a5384f89a9e566e5d2bc7884dc037fb8","size":17104,"data":"","first_seen":"2025-09-02T09:27:03.846152Z","last_seen":"2026-05-28T07:03:01.222829Z","times_seen":33,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/common.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"6e3a1c78dab0b3ddb0989d8d8baabe1c","sha1":"131a9b8fa10512bd7f79256a29ef0c84e4276ce4","sha256":"49b7e11fb9631037c45268b643a34bcd8653ce179387e400b5cbe2bc78868361","sha512":"c27ffd888a52678ed30eafdded3372efb9ef1eab65abf36dce2920f39acc4a58b5af67f66381314271f4a134981fb5e16c0e2e1264e82f0effa889c0025fc81c","ssdeep":"","tlshash":"c981bb1e79e131b1ab8b38bc55df72487935424bc00c8c123caedad49f711b495a6ece","size":3967,"data":"","first_seen":"2023-03-08T19:36:36Z","last_seen":"2026-07-19T01:13:04.494025Z","times_seen":91,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/hm.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"35faf71043064b770b377fdd3a9ee1fe","sha1":"85cf8ac10d2d5050cb1aa27e11132c3b55e15a86","sha256":"803da9480352067a451f0cdc908136e9446c9bb5271f6605461ca9c83a8d697c","sha512":"64ab377bacb7cf203857e3309f5fa37889835df2783c9ea797a35cd0924e57505a7e5a85995e732ee3a7b3669de33b7e587492f4233e99f5af6c8f158e3d124a","ssdeep":"384:GJSoLMJJTRl6s1JXFVCFI/TayvuodsZPIGm8XaR1JRwvutq1tGdc7M04gRw6:G4VJfHgMdvussZPIx82Rwvutcto07v","tlshash":"20d2c9e9b282713293a324a5153f324af07b5a54bd4968a4f11994c07d38fbb027bfdd","size":29950,"data":"","first_seen":"2026-02-03T21:53:29.98696Z","last_seen":"2026-02-03T21:56:12.30803Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/484c840239a025432effd6ecc373d498fa764368_CSS.748f7f460fe4ac62566f.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"558b16677112d754ba376553b26114de","sha1":"8c550409be00fc9e01d344247c225f989a3520f3","sha256":"aa3042432401df744e341ad07e6f06893f8099bd46d7b8bc152fc582fa2e4bf9","sha512":"1771cc5e3831942a6dc5e3f441a34b5073d569dcc925721110bc4525d1e05e900fc8f8894b6f0917e8d57b8d52a125afdde5dc5b21e93cd15580224f7045dcf2","ssdeep":"","tlshash":"1ea002ab10017c9aa8fc42882363b7f43848010c1f00ccf81b199071b071d4fada01d7","size":70,"data":"","first_seen":"2023-04-16T18:26:22Z","last_seen":"2026-08-10T04:20:51.536202Z","times_seen":116,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/1a46e30aa4e663319e6b6e5a9f6ad18086ba23be.21e0e7f2f40adffeea4e.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"e5da55f4dde64f21878dea30883bb4f9","sha1":"6ee27f80ff98c55839b7d2ea266e91ef1c14b0c2","sha256":"2e22db0edb336ade7ac6b9d7743346806123cbf42095921ce6cc395bccb864f8","sha512":"a3b9c49be1c9f7c669868d89ecb98d9717bb5b4db6cb970cde78b7452cdc37241f6e92a407482d41dc83e2db17090febf0365f9fa316f7bac2a955d6e58a72bc","ssdeep":"768:TlfughpEQ9T+kaEwzdJx+u21CxyNNUtCe:Zdpt+kaEoF+Ng","tlshash":"21d2d7e8b192f0a547e622b4803f120af27b5964a44dc881f376dcd2ad7494f9137f7a","size":29238,"data":"","first_seen":"2025-09-02T09:27:03.787752Z","last_seen":"2026-05-28T07:03:01.229068Z","times_seen":33,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/sandbox%20eval%20code","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"","is_inline":false,"md5":"92b651082ce234f66bb544e678befda3","sha1":"14c21c55ddce43b6f677caadf51d4ab98c6a3df8","sha256":"25d57d1d97abeb84531d3d3e5754dd5cb19a2c115edfa7cfc7af8247084faded","sha512":"b4fcbc037e0a3d91db2a624921e96b878e9e18dd998ad5649d77d7d053faf28b09c8725a0542aef702310bf85f3037b70985c274db8acabd021efb171d41f361","ssdeep":"","tlshash":"34c08ca3e74026ae2a1166b2b810e003a2866b015aa78402b00a003b1441fe21aaa1a8","size":147,"data":"","first_seen":"2023-04-11T21:07:53Z","last_seen":"2026-06-07T08:18:38.896325Z","times_seen":921522,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.google-analytics.com/analytics.js","fqdn":"www.google-analytics.com","domain":"google-analytics.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"f24128d0c9cba7be2916c693427a3483","sha1":"1b6397d496ea896ebc2018b01b995cee4f166029","sha256":"58173de4697da1a218f04c3a783a733bab4e769ceabc37cd42da9dc3e036a7e8","sha512":"c4950733b44e258bbc817ce6396f002caec1e11a6413fd0038c9baef2d5f1d992b1fd0ec52515aba52faedb52c28b996a7fc063f28a0f45f3aab5e2f91bf5be5","ssdeep":"96:A1VdZYqhPnjpWx4/eTe8qSMbqaQd6VL2Jyt9LdJoyayCVPVD5wdBfQPfCHiUr3:AXdZYqNjpU4yPqSMbqaQGL2QfdDayCZC","tlshash":"a6a1dc9939fb50210233b1bd1bafa918b23895236208dd61b98c9364bf94437d7f1fc9","size":4691,"data":"","first_seen":"2023-04-11T21:07:53Z","last_seen":"2026-06-07T08:18:38.899011Z","times_seen":919823,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"beacon-v2.helpscout.net/static/js/full-beacon-init.4d2f7d8b.chunk.js","fqdn":"beacon-v2.helpscout.net","domain":"helpscout.net","tld":"net"},"ip":{"addr":"108.157.214.29","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"8e9eda004077291b9ac912db1ce74e0d","sha1":"32262aedcdeb0e6e78229b68208d6dd1290bf873","sha256":"802d1239722089eca5f5ab1fa3282973df2230c3647baceb4ba72cfb16349172","sha512":"12f9d093397b874b0f7d01c1d3d94d33912b346b2cb3d0d8dc8b2bb30d19c820e8a84e0169dde08c126973c51c9ab4ed594eaa5653c1f346dcbfa6aa9f4217fc","ssdeep":"6144:TiwRkDj9IesSRYfSq2dcuJjEL5Dn88W0j4/oG3ILC2Gih7ObKneiUcA18huxd/Fc:Tia8jf/+fSqmcuJjq788W0j+YLC2GXA","tlshash":"7ea4f9c9f1f2f0664b8794b9403fec0bb2362c84780ca150f295e9d5bda159b9137fa9","size":450924,"data":"","first_seen":"2025-12-20T00:01:22.921543Z","last_seen":"2026-02-03T21:56:12.287612Z","times_seen":14,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"1c5c9160600df2d96d69a4ea16cec7ed","sha1":"3cf678c9135cc952ba6970ef545035bb757a443f","sha256":"a3520fe88e248d2b6c9c6db93309a037ef969fe297208e5bd7e49a55bb32c808","sha512":"2a298a8c2552c6a6c6f8d3f7327d2e9abfa87a0dbb27e9e528a8539b416155c0860f54f46464dfe7e5d49c7906a9eacdac7e5181b86ef15a83276a8f4fee0546","ssdeep":"","tlshash":"078004d531c35040475331d400571cd4503444f014444d544040d4511c55030d1154dc","size":37,"data":"","first_seen":"2023-04-11T21:49:14Z","last_seen":"2026-08-16T04:53:48.997285Z","times_seen":121780,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/402257e71ad0734f137dd61e5df6994e10da8ec4_CSS.4d62413f4da81be1e932.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"99e6d6dc6704694222e663251c1f8deb","sha1":"18bf9e68b1130063beb6211506cce99a08797bd0","sha256":"856ab159a9a6cbdc7beb72fc35086e839adb48361d197135a92809e95b875345","sha512":"7a99a2b8f36380fe58cba2e061a7e7487f011def3b2c2bb3e77630344675a780b7513bcc2cc9c04681aff13f312f0a17e1dcfc195d45037a06df886dd423041b","ssdeep":"","tlshash":"69a0026710117caaa8fc02882363a7b03848000c1f00ccfc1b159071b071d0faaa01c7","size":69,"data":"","first_seen":"2023-03-10T14:03:12Z","last_seen":"2026-08-10T04:20:51.504835Z","times_seen":232,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/baiduPush.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"358c43b519ff13120afdd573aa87b324","sha1":"9e4d79a78b7e53a865e3ef7fb092edd8b79ec777","sha256":"0367b50483ad48e93a97dcc891c4657fd944a5e26df217299858dd8723e76597","sha512":"a147a4fa91fcc4125c0c0f18a61a63981c6637f04d39f17744586a4f759db83b00207ded5c867d0fdea2fe84f259a2521ffdf1f36826127c0165d6752510eccf","ssdeep":"","tlshash":"ffd0222e3ca99530375a10be403fda18f1a2202c216ae613c48dec565c30eeb181ebd8","size":211,"data":"","first_seen":"2024-01-06T17:59:57Z","last_seen":"2026-07-19T01:13:04.485464Z","times_seen":44,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/484c840239a025432effd6ecc373d498fa764368.b3b45ad2ad3506f50517.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"840abd773a54976d200439d66e716037","sha1":"9635203a1e195fd4560ffb03a83ed026a67a7a52","sha256":"24d6bed085bf5baf0efe01514d999931327884d42a650aba146b567b4e5171c7","sha512":"3fe563da939040f38c7d579729dac4f900b0f23b5e7098ba6dd51505fdfb3f6c2abf5b231f3135ca31d2a3da43c4b51d16cbc34c94e78568ebec758d2933c643","ssdeep":"1536:ob1tAYCvF9OWnpxoxYDquqy/D0hcmkIZqAXDyjWT:BIDfT","tlshash":"1553d7a871d1f4b552e350a6402f150af3762d6c842db880f3b1c8f4be7a65e5627f3a","size":65681,"data":"","first_seen":"2025-09-03T21:52:23.20755Z","last_seen":"2026-05-28T07:03:01.230041Z","times_seen":30,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/402257e71ad0734f137dd61e5df6994e10da8ec4.ab19d6bbf72133073b8c.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"c2787458a3dc4e39d324a0f5463a9ecf","sha1":"99d61d21cce29d4709d12a2c1981bb7293e762f5","sha256":"9c95235116bac82f0457f9f0a7e0afc91bff84b2a710b056ddde41967a4bad72","sha512":"a17831e756833382e741bb693b75e5c5067fa02c3c781c3179518f57d14221a092adffd33b5fcf34cfdd33e2c63606b6649b8d3325ce83f9806d5cb951feea09","ssdeep":"6144:v6aKhcvX5wD1PGyDOCcnblC9m8+kWhALp+FAGx:vS25wRDOCoblCdWiLp+FAGx","tlshash":"066407dc7291f06242e722b5406f150af33a596ca89ed850f672c8e5bcb559e4233f3e","size":325418,"data":"","first_seen":"2026-01-23T17:42:42.642744Z","last_seen":"2026-02-03T21:56:12.32929Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"beacon-v2.helpscout.net/static/js/main.4f7d1305.js","fqdn":"beacon-v2.helpscout.net","domain":"helpscout.net","tld":"net"},"ip":{"addr":"108.157.214.29","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"bd3f521cfcb5f9c95db33445618822c2","sha1":"dd573f2e327d3feaa2bc0f0b5f4e54b059714861","sha256":"a9ad7031e8735114940bccdee06a6325250c5a7f0112ddf69ddae8da54a6b96e","sha512":"1ad5fe3a8d5aae5f88b349ff18ddb9a5d21f72df1452ea33ca0adfccce4fc1913b17b2b9498235473582fac4554395a735fab33d429080209df2149614daef0c","ssdeep":"768:RAwOGkUUnTxnWmjUju069uBAnRjCVaM8c30aHCE3ZXpMAhcZ7xR7dfS:4T0C41kn7E","tlshash":"34e24ccc35d270ed2243eae9177f55d9ab3e3420783a6480bacde4da676258cc153f58","size":32141,"data":"","first_seen":"2026-02-03T12:17:35.920686Z","last_seen":"2026-02-05T11:52:23.086814Z","times_seen":17,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"beacon-v2.helpscout.net/static/js/vendor.0c72b11a.js","fqdn":"beacon-v2.helpscout.net","domain":"helpscout.net","tld":"net"},"ip":{"addr":"108.157.214.29","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"7be16d9ed5dc8181531357bd0e9f4070","sha1":"ecc2c65a6c3db7948fbff8321a8d7a7d5cb5fd0c","sha256":"0fe0adf6f2a4ea84ddd49a4dd137ec2098a33946427ffa65bfabdbb4f990107b","sha512":"6a662151afb07214ca56077536a407e29e31c28289579b89fb50e3bed5dc38331776569dcc6e16e1536b628028e87916e5e624d6ef4ed7f1ca4e9aaac4096c1e","ssdeep":"768:N77zTT43DLhgmBGQOyMuCX5eLWk+Z0meb9fruMLuPNjOHtNeIviK9+sZkKtBREOe:Nrn8ZgaxkLeFNXwrrilTB9vaNm5ahb","tlshash":"1f63f9e975d1f06153ea20f5407f150bf33a592a784d80e0b224ecea6cb454e96a7fbc","size":69544,"data":"","first_seen":"2025-09-18T07:35:52.046276Z","last_seen":"2026-05-21T11:26:26.239851Z","times_seen":1119,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/styles.d8f657d81e4dcac3db68.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"39741a975745c9d481e25954a78b83a0","sha1":"b03486711023d71448017fd695598fff7bfef3c1","sha256":"655fcc989ea55f220697b3ba1487787e7376847a15b05abd716f32822b12d845","sha512":"0981eaa6ba4698c7bbe84ead41ea58486601c01d21096b8d6b566a1aa436cb60396a42036096f6d2f76928d96a2bbca93b7495b44f02ce3be02b88b70507605c","ssdeep":"","tlshash":"a1e0254839a03866a8e721e4225b31d81caa161a35fcfc9817f5819adb3268e145395d","size":371,"data":"","first_seen":"2025-12-04T19:44:06.882724Z","last_seen":"2026-05-28T07:03:01.252606Z","times_seen":14,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/vendor.0c72b11a.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"7be16d9ed5dc8181531357bd0e9f4070","sha1":"ecc2c65a6c3db7948fbff8321a8d7a7d5cb5fd0c","sha256":"0fe0adf6f2a4ea84ddd49a4dd137ec2098a33946427ffa65bfabdbb4f990107b","sha512":"6a662151afb07214ca56077536a407e29e31c28289579b89fb50e3bed5dc38331776569dcc6e16e1536b628028e87916e5e624d6ef4ed7f1ca4e9aaac4096c1e","ssdeep":"768:N77zTT43DLhgmBGQOyMuCX5eLWk+Z0meb9fruMLuPNjOHtNeIviK9+sZkKtBREOe:Nrn8ZgaxkLeFNXwrrilTB9vaNm5ahb","tlshash":"1f63f9e975d1f06153ea20f5407f150bf33a592a784d80e0b224ecea6cb454e96a7fbc","size":69544,"data":"","first_seen":"2025-09-18T07:35:52.046276Z","last_seen":"2026-05-21T11:26:26.239851Z","times_seen":1119,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/index-ec5e2ec6181f1cc46345.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"663fcec87eaaaffd2ee1280ada483d00","sha1":"57e5904987def28503f6e0ddb564321259bf964b","sha256":"aff0f7a0ff25c53058e24288e7e6297f8cbe7601ddf50ea6adaa2c749aedce86","sha512":"9f5a48efe9325a54cbed88ca9bc5ec15426c446c778cad72c383ecc259863f2809da9a05af3b393a3566333d9a628eb5fe65dfbd60bd3f94309e86ddfe646437","ssdeep":"768:+DIxS1xb6kn87MlOqC42ArjFxG2R+Con0MUmUFFBLExbfZJvP9ex6vkn0qvn/:ESYJl9u2RzmUFF1Mu//","tlshash":"5333c6c9b192f0aa03b731f1402f150ef3bb5a69e85cc850e660d8e1adb959d8727f1d","size":51456,"data":"","first_seen":"2025-12-04T19:44:06.862211Z","last_seen":"2026-02-03T21:56:12.310074Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/_app-01504cfd9d0cb0b715ae.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"f43979f46b2d4a1560f6c618ec25861f","sha1":"6bed58b7cb53967d70b9ec07b51a2eb8777739f4","sha256":"d63897515fa26d1650741a74d13579df27b42f3fc6f904d6a29311e06be65aa1","sha512":"38f3357ea0d4f20b44b6ec6e7d8f765ea04c6d353753afbda3153ef5a4c1d5c7b68db35e40212b9b0976410203e3bcaf9c1f7ca2716d05296eb94c83671a7cab","ssdeep":"192:sfgqUN0gq4laaj60tkwbK7TH26CpPMpQ4Uj0ERRJA2Aaaj60tMoXaKUpEo24HDyt:YpPWatAdKv26CGpxy0NRatAiK0Eo2KY","tlshash":"b772929df1d2f0a113e764f1802f050af3ba6969b088d4c0d759e4f5adb599e8223f2c","size":16494,"data":"","first_seen":"2025-10-04T00:21:30.911009Z","last_seen":"2026-05-28T07:03:01.259274Z","times_seen":28,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/analytics.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"f7707e932a846eeac5cb7f64004b9a5b","sha1":"1fb03bf73f9f0dc69c18eb67ed1bb4e589961f75","sha256":"f1a61277e3f902f50ab42015d8b07218db9b7601bb0967e54a52bfdcb4fa7e81","sha512":"122e1f1ede0b0962fedc78d2add5e6d4cbcd575a54ce35319f752d3ba10c1c8f919fd1ddcbdec8430e34d27688495a1255bf45f2c2891974f4fea09723d45a2c","ssdeep":"768:wwbeaWc7/IZDws2wt+BfN658GL+t+qghDXWz5o5cJDeVVgCqaDuY6N5jEi5BZsy:FbeaWcjI6TBfW7i5SLY5o5cJrBoi5h","tlshash":"b533f9f977463466c3a2b1e4403f100790baadd5f449d8a4b58ae6d06d38e6b01fbf78","size":52310,"data":"","first_seen":"2025-07-22T18:03:00.39653Z","last_seen":"2026-08-16T18:56:01.619296Z","times_seen":19392,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"beacon-v2.helpscout.net/static/js/vendor.0c72b11a.js","fqdn":"beacon-v2.helpscout.net","domain":"helpscout.net","tld":"net"},"ip":{"addr":"108.157.214.29","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"7be16d9ed5dc8181531357bd0e9f4070","sha1":"ecc2c65a6c3db7948fbff8321a8d7a7d5cb5fd0c","sha256":"0fe0adf6f2a4ea84ddd49a4dd137ec2098a33946427ffa65bfabdbb4f990107b","sha512":"6a662151afb07214ca56077536a407e29e31c28289579b89fb50e3bed5dc38331776569dcc6e16e1536b628028e87916e5e624d6ef4ed7f1ca4e9aaac4096c1e","ssdeep":"768:N77zTT43DLhgmBGQOyMuCX5eLWk+Z0meb9fruMLuPNjOHtNeIviK9+sZkKtBREOe:Nrn8ZgaxkLeFNXwrrilTB9vaNm5ahb","tlshash":"1f63f9e975d1f06153ea20f5407f150bf33a592a784d80e0b224ecea6cb454e96a7fbc","size":69544,"data":"","first_seen":"2025-09-18T07:35:52.046276Z","last_seen":"2026-05-21T11:26:26.239851Z","times_seen":1119,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/aec7d165.15f05aecd792e476c6d7.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"87176dcffa419147a6f9c4e1ba9a72e6","sha1":"59835a44be3f43788c2662906fda25ad8505f299","sha256":"81d1c0630f70d1831ac13e2e4f212b532052be907ceded265f49bb8ae934a54d","sha512":"26890c42b28d16e4d7690d68c203ee438c0f7ab487d5e40c2a798a5b2a84c5f6f754cc22a4e9c7121a6e4c8b08969fbe3faa7798a35ea1c0acbec960a3f3535f","ssdeep":"3072:9OPs5At4sA10x5rTzcck1I2cbwHYS8cbRmMrye3LgbxKGyJHgJxmjwKeYHAXAOhe:9OHjUHYeHJw9XZG3XqDUFmkMtEFcA","tlshash":"feb46628c51482bc9dba5ba88d325075a65e91ff71e14325e36eccb073610dcf7aacc9","size":494383,"data":"","first_seen":"2024-03-29T05:20:17Z","last_seen":"2026-08-10T16:24:43.870231Z","times_seen":277,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hm.baidu.com/hm.js?f4b3788b2247dd149fb7fdffe8aece79","fqdn":"hm.baidu.com","domain":"baidu.com","tld":"com"},"ip":{"addr":"111.45.11.83","port":443,"asn":9808,"as":"China Mobile Communications Group Co., Ltd.","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"8e41f30d8cb732fc60c9fbcf13cf874d","sha1":"6027b088bc037da6d646697d4bf3b5d7bcd537e2","sha256":"7be89aaa93c369e68443737a2d3caaba3bef0bda50493af7c58d99265eea98af","sha512":"51b6398d320370da30d09dea7ff7e3df106ade6e9e7c7084a1032e17897c44a79c4b8228d113415491f63d8e93cca27e06d81318d00190373f7c59b0b5d603d5","ssdeep":"384:FJSoLMJJTRl6s1JXFVCFI/TayvuodsZPIGm8XaR1JRwvutq1tGdc7M04gRw6:F4VJfHgMdvussZPIx82Rwvutcto07v","tlshash":"8fd2c9e9b282713293a324a5153f324af07b5a54bd4968a4f11994c07d38fbb027bfdd","size":29950,"data":"","first_seen":"2026-02-03T21:56:12.284642Z","last_seen":"2026-02-03T21:56:12.284642Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/main-e70ab4779d2e95190f36.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"f2c725befb341f99a588d03a4b0b2fe9","sha1":"147080197c95da1480b18fe2a424c2d183babded","sha256":"49ae8e1e712f826916dbfff38a51aec707c97b6d30bf809fa07d23fd0948ae4a","sha512":"4cb81c85b790bde27b6edea313c78a9676a6521091e0b3981ef49485f90d7b39bad5bd9ecc810795bfeb89d094c744b66f2f32c99de51d3ceab0899b964a31ba","ssdeep":"384:grKISudmqwdxhwU+ZhI3IqsgCAXKJlK90IQ8+bwylQoZNFgx3Ys:wKIzmqaTwU++IqEAXiyslpqxIs","tlshash":"e8b2d7ddb6c5f07207e32075a03f620bb37b3958645d8410a3a5d9e67c7a94e9223f6c","size":23952,"data":"","first_seen":"2025-10-04T00:21:30.848976Z","last_seen":"2026-05-28T07:03:01.289386Z","times_seen":28,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/_buildManifest.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"07a49ad02a4ed431f44e732f441396cb","sha1":"1605200f711379d512a2256d23b6ce8be0a78bb9","sha256":"929842b82359675c4dcbc2e8d7229f6d8b4563790e08de1c991f69ed1695b73c","sha512":"bf8403c46ba5e6a8a3fa76e82734b39623ab5ff50b1c1209d5683d847688634d799e4d8c46ce737b3058b4f983589387b213144582d1fdcff8704264d1b13093","ssdeep":"48:ncI/yTlUpccOJ3MX4xrrFgQrbPOEGhn3gGVzmTps+2XjnrGxr7Drv9kkxnCjM6ZK:cUyTlGcrJFrbWMCkceyYnCy","tlshash":"64919c421e33bf412ee3fc856cbc6f3e85e054b1e9f5026382ad482ec9805359f7a695","size":4317,"data":"","first_seen":"2026-02-03T21:53:30.162306Z","last_seen":"2026-02-03T21:56:12.315478Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/sandbox%20eval%20code","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"","is_inline":false,"md5":"92b651082ce234f66bb544e678befda3","sha1":"14c21c55ddce43b6f677caadf51d4ab98c6a3df8","sha256":"25d57d1d97abeb84531d3d3e5754dd5cb19a2c115edfa7cfc7af8247084faded","sha512":"b4fcbc037e0a3d91db2a624921e96b878e9e18dd998ad5649d77d7d053faf28b09c8725a0542aef702310bf85f3037b70985c274db8acabd021efb171d41f361","ssdeep":"","tlshash":"34c08ca3e74026ae2a1166b2b810e003a2866b015aa78402b00a003b1441fe21aaa1a8","size":147,"data":"","first_seen":"2023-04-11T21:07:53Z","last_seen":"2026-06-07T08:18:38.896325Z","times_seen":921522,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/29107295.970b1056bd19a488ef12.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"a1e962b600086da551ba9e675c910727","sha1":"f72303514953e642839cb8273a1bbd1060ff9912","sha256":"86765b533af2746597311b54ddebdbbfd67a31d937c7e3327258a9b9d9b50b83","sha512":"a17d338e20ec7c45a0ed1b8bd6a68f129630028a668af91ba21770d1e1f71a9ba51ad8366c20b932e5ea51b3fbb5cc76b41651a9c90b399c56595b263eeba7bf","ssdeep":"1536:/hdVA1ObQbCbmExG502EoIWYwICTJSIHg:F7/mE8502EPWYwICT/A","tlshash":"3e733ec83ec2f016576760b1007f048bf13eaeb269ad9554d0a1e4ec7cb851ee6b7e19","size":73852,"data":"","first_seen":"2023-09-25T06:21:41Z","last_seen":"2026-05-28T07:03:01.288515Z","times_seen":47,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/vcd15cbe7772f49c399c6a5babf22c1241717689176015","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"ec18af6d41f6f278b6aed3bdabffa7bc","sha1":"62c9e2cab76b888829f3c5335e91c320b22329ae","sha256":"8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f","sha512":"669b0e9a545057acbdd3b4c8d1d2811eaf4c776f679da1083e591ff38ae7684467abacef5af3d4aabd9fb7c335692dbca0def63ddac2cd28d8e14e95680c3511","ssdeep":"384:XriNpnjyMkg8XMtExRN1w29JIOzahXtO2nJ65:GijgSWuanfJ65","tlshash":"8d92d7def645723613f76076913f220b733b35a528068459812adbc22c3d98f6267f6e","size":19948,"data":"","first_seen":"2024-06-07T09:21:23Z","last_seen":"2026-08-16T17:12:28.900221Z","times_seen":337650,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":[{"md5":"1144466469bd15a4e42b9488db84c748","sha1":"2cfcc1fac45ad1622bfa7efb6d636169eb211670","sha256":"fe93e5320aa2c68628b6d1527df5c89dedad5d8aca7072de2e2db8c5d40eddda","sha512":"d6e6ea6670539494afd404384e64bbb93b09b22bb411b62d4a8f3761021d3a9081fe9138ab0edc2e572fd083d17e5300839f8c27611afa641b2f2325854effa5","ssdeep":"","tlshash":"b9d08cc885f029a0a29111c81fe03a090f00cb8753860c09328dd2108fc069a8c870be","size":198,"data":"","first_seen":"2023-03-07T01:31:26Z","last_seen":"2026-06-06T16:49:50.097554Z","times_seen":1166,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"console":null},"http":[{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-03T21:55:43.651Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:44 GMT\r\ncontent-type: text/html\r\nlast-modified: Sun, 28 Dec 2025 18:04:33 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69517131-50df\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"scrollreveal","description":"","website":"https://scrollrevealjs.org","common_platform_enumeration":"","icon":"scrollreveal.svg","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ant Design","description":"Ant Design is a UI library that can be used with data flow solutions and application frameworks in any React ecosystem.","website":"https://ant.design","common_platform_enumeration":"","icon":"Ant Design.svg","categories":["UI frameworks"]}],"data":{"size":20703,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (13700)","md5":"a181f7094b1fc2b9bb9109da78870959","sha1":"4aee75a7ecb22aa1757cce01797358fd9fc56ea4","sha256":"0d39ad14d1feba3b5b1ec399aef2050c7b2a5d829175053ce891f58b61cb2d10","sha512":"dce97e874fa1cb58725fd4d0a009e88ba8274cb2a1edb44f083f824f1855dda3562cbc7fa8cb5693c70f64293f2e05794e5d696f91d78778fddfd9ecf3d0a5ae","ssdeep":"192:3wDJmOpeLMYshc67AfT4RkVOOjBz0dsIQUgarku3pRhvVoMQqM0n7J2CXcIF2vfR:gDJmQvAfT0guX74UM07UCsIF2v56q","tlshash":"4792617388c2aaf71303adc9e473bf1d91e78329d9a19c0591fa96ca67d1fd80e17409","first_seen":"2026-02-03T21:53:30.062229Z","last_seen":"2026-02-03T21:56:12.242319Z","times_seen":3,"resource_available":false,"data":null}},"time_used":1706,"timings":{"blocked":684,"dns":15,"connect":333,"send":0,"wait":333,"receive":0,"ssl":338},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/saved_resource","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.038Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/saved_resource HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 372\r\nlast-modified: Wed, 24 Dec 2025 06:43:21 GMT\r\netag: \"694b8b89-174\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":372,"size_decoded":0,"mime_type":"application/octet-stream","magic":"ASCII text, with very long lines (372), with no line terminators","md5":"35c8379a35d476df500cdf2e03731745","sha1":"235f1aa1560b5dda87b63da5afb88c398dee793d","sha256":"09bac1de8d8cece93bdf86794fa8214de5761f145bedd04fb8d1742720b7f5ce","sha512":"8ec5c0ac5d2e29e29950834e4ea6b42b4a4ce3e5f177d0a4efe3fddc25ad55675493993853e13e3cecfb52b51e28c736fb4ef41b5547792e208116153689ade3","ssdeep":"","tlshash":"99e0f84d2c40843123a21872a367c83c616282400033c102e4cac876a8bcce91c6b28c","first_seen":"2025-12-19T23:03:06.957818Z","last_seen":"2026-02-03T21:56:12.259616Z","times_seen":86,"resource_available":true,"data":null}},"time_used":2004,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":999,"receive":1005,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/aec7d165.15f05aecd792e476c6d7.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.073Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/aec7d165.15f05aecd792e476c6d7.js.%E4%B8%8B%E8%BD%BD HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 494383\r\nlast-modified: Wed, 24 Dec 2025 06:43:13 GMT\r\netag: \"694b8b81-78b2f\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":494383,"size_decoded":0,"mime_type":"application/octet-stream","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"87176dcffa419147a6f9c4e1ba9a72e6","sha1":"59835a44be3f43788c2662906fda25ad8505f299","sha256":"81d1c0630f70d1831ac13e2e4f212b532052be907ceded265f49bb8ae934a54d","sha512":"26890c42b28d16e4d7690d68c203ee438c0f7ab487d5e40c2a798a5b2a84c5f6f754cc22a4e9c7121a6e4c8b08969fbe3faa7798a35ea1c0acbec960a3f3535f","ssdeep":"3072:9OPs5At4sA10x5rTzcck1I2cbwHYS8cbRmMrye3LgbxKGyJHgJxmjwKeYHAXAOhe:9OHjUHYeHJw9XZG3XqDUFmkMtEFcA","tlshash":"feb46628c51482bc9dba5ba88d325075a65e91ff71e14325e36eccb073610dcf7aacc9","first_seen":"2024-03-29T05:20:17Z","last_seen":"2026-08-10T16:24:43.870231Z","times_seen":277,"resource_available":true,"data":null}},"time_used":2342,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":985,"receive":1357,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/partner-etherscan.svg","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.096Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/partner-etherscan.svg HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 24 Dec 2025 06:43:20 GMT\r\nvary: Accept-Encoding\r\netag: W/\"694b8b88-2bff\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11263,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c2396dfee53ab9d34632f6fedd15c47e","sha1":"f2e7cc706a3486b0e8c27ec8ad71a97d671707d4","sha256":"d9c83c68c73cab3ade09c13bd2d323325648c652b28cc92a535b2db8068a92b3","sha512":"c432dd748aed17122a33133a3ea814f445b7529741805857c8b1a5ab8c363baf7cdc50e78ceb36ae4e1e9c258f1d8d11cdcccc9f94a7bcbb906952ab942f581c","ssdeep":"192:U8ENPeQpwC/8tvEY74rBx5IZoLwUqcCvwGPWwBjaQTVgixW05O7oK:TAmQpwC6sD5v39ujaQLW4GoK","tlshash":"023281cc773a46f8bc45f5bec70644ba7802aeaa78414958c3b42d5c2c4482c9dbddeb","first_seen":"2023-05-10T10:24:22Z","last_seen":"2026-08-13T23:12:23.619512Z","times_seen":1625,"resource_available":false,"data":null}},"time_used":970,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":970,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/partner-walletconnect.svg","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.097Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/partner-walletconnect.svg HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 24 Dec 2025 06:43:21 GMT\r\nvary: Accept-Encoding\r\netag: W/\"694b8b89-26df\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9951,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"31d494216fb084b7082d4a54a453d75d","sha1":"35853344398fcac7b1b531728806ebf5c01ea439","sha256":"d2ebea36ed0eeaec252edb040f075fb4b342fc3a68650e685387d87aaf33a513","sha512":"07fbe0a9a9e30fd72f31d0a5583c98b6410c905020a2c939a35ef49cb58ba356131f0db73865bf1a9583552445fcc8d2fc0bbc0ae5ba48a180f538f9e7563f87","ssdeep":"192:0twRHkLSifTOOIBCt6vrlFR8VUthiQYXqJcULuQo9ox38:0+VkLdfgECra+hEqW42oZ8","tlshash":"3f22af3536d61c9ec5e6eb8c60aa31824e038b5fa2cc4226f55cb7903a57f0c5d3d65e","first_seen":"2024-02-27T11:11:03Z","last_seen":"2026-08-13T23:12:23.606468Z","times_seen":375,"resource_available":false,"data":null}},"time_used":969,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":969,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/subscribe.svg","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.118Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/subscribe.svg HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 576\r\nlast-modified: Wed, 24 Dec 2025 06:43:22 GMT\r\netag: \"694b8b8a-240\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":576,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"78f86cd737a9a0fcbfc9f23b1478550f","sha1":"4b36dbf9b0d3e338565618d31c6f7aee0a073d85","sha256":"5f2206d50773ff3d50037d78573b8b661efb7acc84c1412427b6472f15ef578a","sha512":"5c414940624f563fd5675b7f880226889f83dc1ab5731f79e17e940fb3daaa6d5eb5b9462b5ab321c7a37e1000a15f610533abef32a5a3792982f7314af7a48d","ssdeep":"","tlshash":"c5f0215454ec444885184615c7d6fad5242fa1434315025cf35c655f3f344b75c6e3de","first_seen":"2023-05-07T16:57:14Z","last_seen":"2026-08-10T16:24:43.907086Z","times_seen":1159,"resource_available":false,"data":null}},"time_used":2269,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":949,"receive":1320,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hm.baidu.com/hm.js?f4b3788b2247dd149fb7fdffe8aece79","fqdn":"hm.baidu.com","domain":"baidu.com","tld":"com"},"ip":{"addr":"111.45.11.83","port":443,"asn":9808,"as":"China Mobile Communications Group Co., Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:47.094Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"baidu.com","organization":"Beijing Baidu Netcom Science Technology Co., Ltd"},"issuer":{"commonName":"GlobalSign RSA OV SSL CA 2018","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 09 Jul 2025 07:01:02 GMT","end":"Mon, 10 Aug 2026 07:01:01 GMT"},"fingerprint":{"sha1":"21:BF:66:0D:67:BE:7A:7F:49:48:05:30:F4:7F:09:F2:30:36:CA:63","sha256":"0D:82:2C:9A:90:5A:EF:E9:8F:37:12:C0:E0:26:30:EE:95:33:2C:45:5F:E7:74:5D:F0:8D:BC:79:F4:B0:A1:49"}}},"request":{"raw":"GET /hm.js?f4b3788b2247dd149fb7fdffe8aece79 HTTP/1.1\r\nHost: hm.baidu.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nCache-Control: max-age=0, must-revalidate\r\nContent-Encoding: gzip\r\nContent-Length: 11344\r\nContent-Type: application/javascript\r\nDate: Tue, 03 Feb 2026 21:55:47 GMT\r\nEtag: e876871185fc238ce990f527a6abe72f\r\nP3p: CP=\"CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR\"\r\nServer: apache\r\nSet-Cookie: HMACCOUNT=C8D6051B5AC48F10; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT\r\nStrict-Transport-Security: max-age=172800\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":29950,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (674)","md5":"8e41f30d8cb732fc60c9fbcf13cf874d","sha1":"6027b088bc037da6d646697d4bf3b5d7bcd537e2","sha256":"7be89aaa93c369e68443737a2d3caaba3bef0bda50493af7c58d99265eea98af","sha512":"51b6398d320370da30d09dea7ff7e3df106ade6e9e7c7084a1032e17897c44a79c4b8228d113415491f63d8e93cca27e06d81318d00190373f7c59b0b5d603d5","ssdeep":"384:FJSoLMJJTRl6s1JXFVCFI/TayvuodsZPIGm8XaR1JRwvutq1tGdc7M04gRw6:F4VJfHgMdvussZPIx82Rwvutcto07v","tlshash":"8fd2c9e9b282713293a324a5153f324af07b5a54bd4968a4f11994c07d38fbb027bfdd","first_seen":"2026-02-03T21:56:12.284642Z","last_seen":"2026-02-03T21:56:12.284642Z","times_seen":1,"resource_available":true,"data":null}},"time_used":439,"timings":{"blocked":174,"dns":0,"connect":0,"send":0,"wait":264,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"beacon-v2.helpscout.net/static/js/full-beacon-init.4d2f7d8b.chunk.js","fqdn":"beacon-v2.helpscout.net","domain":"helpscout.net","tld":"net"},"ip":{"addr":"108.157.214.29","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:47.190Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.helpscout.net","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Thu, 06 Mar 2025 00:00:00 GMT","end":"Fri, 03 Apr 2026 23:59:59 GMT"},"fingerprint":{"sha1":"13:DB:4C:AE:C2:EF:23:C5:95:76:77:E7:70:21:28:E3:46:E4:F2:1E","sha256":"95:AE:AF:20:4C:C0:EA:E7:FF:CA:03:0F:C4:66:5D:C6:D6:64:20:9E:28:52:44:DB:EB:C1:E2:48:D0:A1:93:CD"}}},"request":{"raw":"GET /static/js/full-beacon-init.4d2f7d8b.chunk.js HTTP/1.1\r\nHost: beacon-v2.helpscout.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: application/javascript\r\ncontent-length: 128005\r\nlast-modified: Fri, 19 Dec 2025 12:42:46 GMT\r\nx-amz-server-side-encryption: AES256\r\ncontent-encoding: gzip\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ndate: Tue, 03 Feb 2026 21:53:02 GMT\r\ncache-control: max-age=315360000, s-maxage=7200, public\r\netag: \"08d4f10b042b8f14fd56428ca0cf48b6\"\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 e2bc8da8a8d03748525187195f797d86.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN56-P1\r\nx-amz-cf-id: X5Id773Fgr5_ygOOhDw7DTK3WNp4mUmjc8rzBvKQH2lCSuuN7rTcpw==\r\nage: 166\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000\r\nvary: accept-encoding, Origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}],"data":{"size":450924,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"8e9eda004077291b9ac912db1ce74e0d","sha1":"32262aedcdeb0e6e78229b68208d6dd1290bf873","sha256":"802d1239722089eca5f5ab1fa3282973df2230c3647baceb4ba72cfb16349172","sha512":"12f9d093397b874b0f7d01c1d3d94d33912b346b2cb3d0d8dc8b2bb30d19c820e8a84e0169dde08c126973c51c9ab4ed594eaa5653c1f346dcbfa6aa9f4217fc","ssdeep":"6144:TiwRkDj9IesSRYfSq2dcuJjEL5Dn88W0j4/oG3ILC2Gih7ObKneiUcA18huxd/Fc:Tia8jf/+fSqmcuJjq788W0j+YLC2GXA","tlshash":"7ea4f9c9f1f2f0664b8794b9403fec0bb2362c84780ca150f295e9d5bda159b9137fa9","first_seen":"2025-12-20T00:01:22.921543Z","last_seen":"2026-02-03T21:56:12.287612Z","times_seen":14,"resource_available":true,"data":null}},"time_used":23,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":10,"receive":13,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/banner-zh-CN.png","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.086Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/banner-zh-CN.png HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 24 Dec 2025 06:43:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"694b8b84-5b574\"\r\nexpires: Thu, 05 Mar 2026 21:55:45 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":374132,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 2000 x 2000, 8-bit/color RGBA, non-interlaced","md5":"478b32f8921118491a905cd0211dc23d","sha1":"f542080bba4dea9f3cd314c6ade23fd29ebe42b9","sha256":"83af90576b7ca1db29e19ae24b62b86741715838f66cc59b56317d2b2e6748da","sha512":"e159c79fd045f1ef717819c11af6f8e02cb3f987bb62201a6cde76d9cc24a4eee2d21a461355afab80633d9ca9b2afe5ec8495aef032d8fd0ae9101bd56c7ac7","ssdeep":"6144:we67KpR984XcTTowPV0SXC0ADXTt0A5/JNAHiAV+EVbLvTFc9zqPSPNJc6iJ3Npz:wT7S84Xc/HtK50Ap7arVvTicSk5dPG0d","tlshash":"e98423acd043cadaca00817221071f7a7bb059d5c604738fb372b69bbc5e19b7c5ae65","first_seen":"2025-07-02T21:10:40.156775Z","last_seen":"2026-08-13T23:21:55.098552Z","times_seen":70,"resource_available":false,"data":null}},"time_used":979,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":979,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/wallet.svg","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.087Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/wallet.svg HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 24 Dec 2025 06:43:22 GMT\r\nvary: Accept-Encoding\r\netag: W/\"694b8b8a-1fd7\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8151,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f4a8d60705c4da90ce91d4f8903c235c","sha1":"6ad45ab8c6cb2a8ea097c79c1eb197d4462a01a4","sha256":"fefe0ac8ca8b6c7a2999e3c7923ab67cced26355f9b5eab0bbc7140d578eff59","sha512":"8cf7c7286a422458b80d6e37bc3970afdbf012f69d7307497e7bd78ab526ce6cc800120d8f150dd54038ee3d60bc35710841c6836edca29085ab767fbcb7f0f6","ssdeep":"96:lXSa2PgQvn0Nn5dpwOOzd+f/Y9rQTBNMazWRtt4qsQm9i8g3eybccDjFYDeSp:1SPgLdWOi+/9lkBF357uDeQ","tlshash":"a3f1a6cc23096ef18d80c3f4ef2aa0f4a51751f99a64506ccb706e6e39155ae1c7b9c7","first_seen":"2024-04-26T06:55:29Z","last_seen":"2026-08-13T23:21:55.101739Z","times_seen":417,"resource_available":false,"data":null}},"time_used":979,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":979,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/feedback.svg","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.102Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/feedback.svg HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 881\r\nlast-modified: Wed, 24 Dec 2025 06:43:16 GMT\r\netag: \"694b8b84-371\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":881,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"58b754c0f9f2c13b0be845b7ada0602a","sha1":"765e62db886f66d31bbfff3c8f9616b93fd4418b","sha256":"d02703d5c4610bd9bb5ad07df5d714ade9d5dc84286f93adf6d95e1fdf8491d4","sha512":"4498c883e3f4f9f614cfd60084d44012f1c79f22c1b50cf2bf24513eb48571a23cad4dfa31381d7b7943f98c5f930f2ae90c5c12453bb9052271f1c13983ceda","ssdeep":"","tlshash":"5811ef59339c9edc77219b68d382b775326720e3270ee020d9712976ad1462d3d3b6ec","first_seen":"2023-05-10T10:24:22Z","last_seen":"2026-08-13T23:12:23.596428Z","times_seen":1281,"resource_available":false,"data":null}},"time_used":1962,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":960,"receive":1002,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/styles.0b4c5182.chunk.css","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:47.491Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/styles.0b4c5182.chunk.css HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://imtoken.download-zh-cn.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: Hm_lvt_f4b3788b2247dd149fb7fdffe8aece79=1770155746; Hm_lpvt_f4b3788b2247dd149fb7fdffe8aece79=1770155746; HMACCOUNT=748D89D7109A157E; _ga=GA1.2.272943273.1770155747; _gid=GA1.2.1584147989.1770155747\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:47 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 24 Dec 2025 06:43:22 GMT\r\nvary: Accept-Encoding\r\netag: W/\"694b8b8a-a7cc\"\r\nexpires: Wed, 04 Feb 2026 09:55:47 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":42956,"size_decoded":0,"mime_type":"text/css","magic":"assembler source, ASCII text, with very long lines (358)","md5":"1f1a4e37b89f0a06080c72d4f2c40be8","sha1":"c3e1d82130c3e6f7955ba1e5c239e93ca6691635","sha256":"53b093ba927f7e2fd709ec3b62175ee950075e4f8a7e56dcd3510187821032fe","sha512":"25b1f9f230015c18b8f94728d31ba5f693e51faa57353215e2b17cc2f979971f462bcb3f3714a6540eb85b855e17f08ff665f1c1b4181d0385574b30c6256283","ssdeep":"768:MOd04TWafebTP2X+lcsiWVW/cmaxN2OamTHiRVH4R7IWVSZIndlO3sLaMCUkWl+X:LboLKcpMC0YDfqqJdQa5cSVZaLcZ4p8a","tlshash":"171331422fe4252b3d1744e9764a7b08732d7107430fed787be26118cfd82ba4a6669f","first_seen":"2025-12-04T19:44:06.800215Z","last_seen":"2026-02-03T21:56:12.295993Z","times_seen":4,"resource_available":false,"data":null}},"time_used":335,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":335,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"v2-cdn-dev.token.im/orbit/token-im/stick-note-en.json?q=1770155748092","fqdn":"v2-cdn-dev.token.im","domain":"token.im","tld":"im"},"ip":{"addr":"34.120.113.83","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:48.107Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.token.im","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Fri, 06 Jun 2025 00:00:00 GMT","end":"Mon, 08 Jun 2026 23:59:59 GMT"},"fingerprint":{"sha1":"CD:6A:97:52:4E:A8:46:CE:4F:1D:42:72:6D:C1:19:46:04:DD:E7:0E","sha256":"54:95:F0:AB:F3:83:AB:3A:88:D5:EA:82:AD:9E:2E:8B:05:68:CD:B5:B7:F3:38:F0:F9:18:27:39:5D:38:08:1C"}}},"request":{"raw":"GET /orbit/token-im/stick-note-en.json?q=1770155748092 HTTP/1.1\r\nHost: v2-cdn-dev.token.im\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://imtoken.download-zh-cn.com/\r\nOrigin: https://imtoken.download-zh-cn.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: marco/3.2\r\ndate: Tue, 03 Feb 2026 21:55:48 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding\r\nx-source: U/200\r\nx-upyun-content-length: 416\r\netag: W/\"5a24b959af7a17ddfecba865b5157151\"\r\nlast-modified: Sat, 25 Sep 2021 16:31:49 GMT\r\nx-upyun-content-type: application/json\r\nx-request-id: 22d4444e3e030a9c5c28854266182df8; 8bba3890ee6a1d88c16cc16d1d0c66c8\r\naccess-control-allow-origin: *\r\ncontent-encoding: br\r\nvia: T.166.N, V.pcw-cn-hkg-163, T.133.H, M.gtt-de-fra3-133, 1.1 google\r\ncache-control: public,must-revalidate,max-age=300\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":416,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"5a24b959af7a17ddfecba865b5157151","sha1":"fc2c4e0f6486f62839e7cf9fe452a7b35808f832","sha256":"8e1253215d6ea3bab643dea4d4b98b692b55cf4dcb8701e953f52f9077f6a424","sha512":"5421227fc15e2b2e7ac558d046e7c49ae84062dc0032867ad98c0d5f032d4867b67a687cda3b2ae38bd88663f648cd465145f193afeca53cc7a0b3848c42d760","ssdeep":"","tlshash":"78e0abca1308bd0262d9b3b1694a751b999a1020fceec8688f68ca1818c142401c02cb","first_seen":"2023-12-10T14:23:56Z","last_seen":"2026-05-28T07:03:01.254093Z","times_seen":38,"resource_available":false,"data":null}},"time_used":203,"timings":{"blocked":54,"dns":0,"connect":12,"send":0,"wait":94,"receive":0,"ssl":38},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/_app-01504cfd9d0cb0b715ae.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.071Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/_app-01504cfd9d0cb0b715ae.js.%E4%B8%8B%E8%BD%BD HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 16494\r\nlast-modified: Wed, 24 Dec 2025 06:43:23 GMT\r\netag: \"694b8b8b-406e\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16494,"size_decoded":0,"mime_type":"application/octet-stream","magic":"JavaScript source, ASCII text, with very long lines (16494), with no line terminators","md5":"f43979f46b2d4a1560f6c618ec25861f","sha1":"6bed58b7cb53967d70b9ec07b51a2eb8777739f4","sha256":"d63897515fa26d1650741a74d13579df27b42f3fc6f904d6a29311e06be65aa1","sha512":"38f3357ea0d4f20b44b6ec6e7d8f765ea04c6d353753afbda3153ef5a4c1d5c7b68db35e40212b9b0976410203e3bcaf9c1f7ca2716d05296eb94c83671a7cab","ssdeep":"192:sfgqUN0gq4laaj60tkwbK7TH26CpPMpQ4Uj0ERRJA2Aaaj60tMoXaKUpEo24HDyt:YpPWatAdKv26CGpxy0NRatAiK0Eo2KY","tlshash":"b772929df1d2f0a113e764f1802f050af3ba6969b088d4c0d759e4f5adb599e8223f2c","first_seen":"2025-10-04T00:21:30.911009Z","last_seen":"2026-05-28T07:03:01.259274Z","times_seen":28,"resource_available":true,"data":null}},"time_used":1648,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":986,"receive":662,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/partner-slowmist.svg","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.100Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/partner-slowmist.svg HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 24 Dec 2025 06:43:20 GMT\r\nvary: Accept-Encoding\r\netag: W/\"694b8b88-23e7\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9191,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"cd1543d84d6df21421d32250cabff94b","sha1":"89d96677e7c5228a075a97cc92f965b6c34ed875","sha256":"68a63273a5b96f112d1d41a2d3a480d99b49a4f45468b05fa4b29582720f9f5d","sha512":"49ab7676cf5749c2d2df94e4627c749fbe2d97146782641e5ec84918bc23316a82801d799a15534a176c1a868dda8a7d5e71da0e9bc66f364e94be5c5a53f2b8","ssdeep":"192:WIwCjw3Sl0qzcBwEcL8DOunWttGf1o0ekdQALQyqKLxpA:pzYbq4gBuSe1Dd4vK9u","tlshash":"6112bfb7265dbc5a4ea44318603ca5469ced1a8b951cd77fefc820db0c63ca32e944ac","first_seen":"2024-02-27T11:11:03Z","last_seen":"2026-08-13T23:12:23.609575Z","times_seen":375,"resource_available":false,"data":null}},"time_used":965,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":965,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/_ssgManifest.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.121Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/_ssgManifest.js.%E4%B8%8B%E8%BD%BD HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 76\r\nlast-modified: Wed, 24 Dec 2025 06:43:23 GMT\r\netag: \"694b8b8b-4c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":76,"size_decoded":0,"mime_type":"application/octet-stream","magic":"ASCII text, with no line terminators","md5":"abee47769bf307639ace4945f9cfd4ff","sha1":"c0a0dc51ee8a2852baf5ff30c33b1478ff302585","sha256":"653f3e53e89b4f8548ff86c19e92bb3c6b84b6be7485a320b1e00893ed877479","sha512":"2b074799106698df69a28fcd8255c3cfd1ccf40fd4c1bf5d463c42e63b32856f801e066706fbd960a0da4ebe645c070c398dcf01bd722dc4fa592266361ae81a","ssdeep":"","tlshash":"d4a001a0903cdc60aa63dd1c126013168fa05062651d28938afd2054c0341410300d50","first_seen":"2023-03-07T01:03:45Z","last_seen":"2026-08-16T21:53:07.412667Z","times_seen":16985,"resource_available":true,"data":null}},"time_used":1941,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":944,"receive":997,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"beacon-v2.helpscout.net/static/js/vendor.0c72b11a.js","fqdn":"beacon-v2.helpscout.net","domain":"helpscout.net","tld":"net"},"ip":{"addr":"108.157.214.29","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:47.090Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.helpscout.net","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Thu, 06 Mar 2025 00:00:00 GMT","end":"Fri, 03 Apr 2026 23:59:59 GMT"},"fingerprint":{"sha1":"13:DB:4C:AE:C2:EF:23:C5:95:76:77:E7:70:21:28:E3:46:E4:F2:1E","sha256":"95:AE:AF:20:4C:C0:EA:E7:FF:CA:03:0F:C4:66:5D:C6:D6:64:20:9E:28:52:44:DB:EB:C1:E2:48:D0:A1:93:CD"}}},"request":{"raw":"GET /static/js/vendor.0c72b11a.js HTTP/1.1\r\nHost: beacon-v2.helpscout.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: application/javascript\r\ncontent-length: 24954\r\nlast-modified: Mon, 26 Jan 2026 16:33:55 GMT\r\nx-amz-server-side-encryption: AES256\r\ncontent-encoding: gzip\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ndate: Tue, 03 Feb 2026 21:28:24 GMT\r\ncache-control: max-age=315360000, s-maxage=7200, public\r\netag: \"a7b8a45d85678ecbd3f6ef21bd952b87\"\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 e2bc8da8a8d03748525187195f797d86.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN56-P1\r\nx-amz-cf-id: ulocPxbbZu3pKfFi8gSpJWQHzGhhfB6RwNrFSm1Vmf4Jgr1ub6rsnw==\r\nage: 1644\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000\r\nvary: accept-encoding, Origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":69544,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"7be16d9ed5dc8181531357bd0e9f4070","sha1":"ecc2c65a6c3db7948fbff8321a8d7a7d5cb5fd0c","sha256":"0fe0adf6f2a4ea84ddd49a4dd137ec2098a33946427ffa65bfabdbb4f990107b","sha512":"6a662151afb07214ca56077536a407e29e31c28289579b89fb50e3bed5dc38331776569dcc6e16e1536b628028e87916e5e624d6ef4ed7f1ca4e9aaac4096c1e","ssdeep":"768:N77zTT43DLhgmBGQOyMuCX5eLWk+Z0meb9fruMLuPNjOHtNeIviK9+sZkKtBREOe:Nrn8ZgaxkLeFNXwrrilTB9vaNm5ahb","tlshash":"1f63f9e975d1f06153ea20f5407f150bf33a592a784d80e0b224ecea6cb454e96a7fbc","first_seen":"2025-09-18T07:35:52.046276Z","last_seen":"2026-05-21T11:26:26.239851Z","times_seen":1119,"resource_available":true,"data":null}},"time_used":53,"timings":{"blocked":16,"dns":1,"connect":8,"send":0,"wait":9,"receive":1,"ssl":16},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"biz.token.im/v1/business","fqdn":"biz.token.im","domain":"token.im","tld":"im"},"ip":{"addr":"172.66.151.95","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:48.476Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.token.im","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Fri, 06 Jun 2025 00:00:00 GMT","end":"Mon, 08 Jun 2026 23:59:59 GMT"},"fingerprint":{"sha1":"CD:6A:97:52:4E:A8:46:CE:4F:1D:42:72:6D:C1:19:46:04:DD:E7:0E","sha256":"54:95:F0:AB:F3:83:AB:3A:88:D5:EA:82:AD:9E:2E:8B:05:68:CD:B5:B7:F3:38:F0:F9:18:27:39:5D:38:08:1C"}}},"request":{"raw":"POST /v1/business HTTP/1.1\r\nHost: biz.token.im\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/json\r\nContent-Length: 62\r\nOrigin: https://imtoken.download-zh-cn.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":62,"data":"{\"id\":1,\"jsonrpc\":\"2.0\",\"method\":\"market.getList\",\"params\":[]}"}},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 03 Feb 2026 21:55:48 GMT\r\ncontent-type: application/json; charset=utf-8\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD\r\naccess-control-expose-headers: \r\naccess-control-max-age: 7200\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\nx-download-options: noopen\r\nx-permitted-cross-domain-policies: none\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-json-rpc-method: market.getList\r\nx-json-rpc-method-count: 1\r\netag: W/\"b4b52b5382cc44d04c7b708404271917\"\r\ncache-control: max-age=0, private, must-revalidate\r\nx-request-id: 62d76bd2a682dfaacfe94987338514ce\r\nx-runtime: 0.023296\r\nvary: Origin\r\nx-from: gke-prod\r\nx-geoip-city-country-code: NO\r\nx-geoip-city-country-name: Norway\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvia: 1.1 google\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9c852cb3f89b783d-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1882,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"b9a9f80d6c64f504ec12ab4123469beb","sha1":"6cd7c03e59141c4ea82f2c965708dd2898a80af7","sha256":"b4b52b5382cc44d04c7b7084042719179302df73a95fd2bf4cf0dd610f02ed17","sha512":"2452a04fc77de4541fd573adf416eed7b77e490076b9da8718b42a15d0d0ffb347a668692156dbb8c18af81ad724867dc9bf821d2e917a1ff5f6ef2c6e15ebe3","ssdeep":"","tlshash":"6e419cfb232068b6c71025dc6da7384ee6619107898054ecb7bddca18c783dbd243522","first_seen":"2026-02-03T21:53:30.117037Z","last_seen":"2026-02-03T21:56:12.307107Z","times_seen":3,"resource_available":false,"data":null}},"time_used":322,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":322,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/hm.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.043Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/hm.js.%E4%B8%8B%E8%BD%BD HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 29950\r\nlast-modified: Wed, 24 Dec 2025 06:43:17 GMT\r\netag: \"694b8b85-74fe\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":29950,"size_decoded":0,"mime_type":"application/octet-stream","magic":"JavaScript source, ASCII text, with very long lines (674)","md5":"35faf71043064b770b377fdd3a9ee1fe","sha1":"85cf8ac10d2d5050cb1aa27e11132c3b55e15a86","sha256":"803da9480352067a451f0cdc908136e9446c9bb5271f6605461ca9c83a8d697c","sha512":"64ab377bacb7cf203857e3309f5fa37889835df2783c9ea797a35cd0924e57505a7e5a85995e732ee3a7b3669de33b7e587492f4233e99f5af6c8f158e3d124a","ssdeep":"384:GJSoLMJJTRl6s1JXFVCFI/TayvuodsZPIGm8XaR1JRwvutq1tGdc7M04gRw6:G4VJfHgMdvussZPIx82Rwvutcto07v","tlshash":"20d2c9e9b282713293a324a5153f324af07b5a54bd4968a4f11994c07d38fbb027bfdd","first_seen":"2026-02-03T21:53:29.98696Z","last_seen":"2026-02-03T21:56:12.30803Z","times_seen":3,"resource_available":true,"data":null}},"time_used":1330,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":997,"receive":333,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/scrollreveal.min.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.054Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/scrollreveal.min.js.%E4%B8%8B%E8%BD%BD HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 9095\r\nlast-modified: Wed, 24 Dec 2025 06:43:22 GMT\r\netag: \"694b8b8a-2387\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9095,"size_decoded":0,"mime_type":"application/octet-stream","magic":"JavaScript source, ASCII text, with very long lines (9095), with no line terminators","md5":"126cb7c432914f6c726ff146110dcb75","sha1":"e5358bdb7769288dc7c2dc10508e98387e85b6e2","sha256":"fd08659fe0f20fd14dcf4c3c5acdde64de96028174f59b0b3dc776b62be789b9","sha512":"005fd83d6e18b49ad8bc8e46c853e03eb34808c7913aa6df836e6f57a4f41a1256c901b78697c85e6001ddc6c5870dc46f1f3cb500fe74fe69f9ddddc980e4ae","ssdeep":"192:zjBEC60RtRcCT+Ytnvm1uvb/E3aQ6ZvxrTZ6fNrb:zNE312Ntnvm1MbEIZvZTZ6fNrb","tlshash":"cd12d68f3e1274339b5349d5e2df064f773849da2a0b9484b2b4d0bab8b101d6243f6d","first_seen":"2023-03-07T01:07:32Z","last_seen":"2026-08-12T18:57:22.419399Z","times_seen":1590,"resource_available":true,"data":null}},"time_used":2002,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":994,"receive":1008,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/index-ec5e2ec6181f1cc46345.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.081Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/index-ec5e2ec6181f1cc46345.js.%E4%B8%8B%E8%BD%BD HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 51456\r\nlast-modified: Wed, 24 Dec 2025 06:43:18 GMT\r\netag: \"694b8b86-c900\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":51456,"size_decoded":0,"mime_type":"application/octet-stream","magic":"JavaScript source, ASCII text, with very long lines (51456), with no line terminators","md5":"663fcec87eaaaffd2ee1280ada483d00","sha1":"57e5904987def28503f6e0ddb564321259bf964b","sha256":"aff0f7a0ff25c53058e24288e7e6297f8cbe7601ddf50ea6adaa2c749aedce86","sha512":"9f5a48efe9325a54cbed88ca9bc5ec15426c446c778cad72c383ecc259863f2809da9a05af3b393a3566333d9a628eb5fe65dfbd60bd3f94309e86ddfe646437","ssdeep":"768:+DIxS1xb6kn87MlOqC42ArjFxG2R+Con0MUmUFFBLExbfZJvP9ex6vkn0qvn/:ESYJl9u2RzmUFF1Mu//","tlshash":"5333c6c9b192f0aa03b731f1402f150ef3bb5a69e85cc850e660d8e1adb959d8727f1d","first_seen":"2025-12-04T19:44:06.862211Z","last_seen":"2026-02-03T21:56:12.310074Z","times_seen":4,"resource_available":true,"data":null}},"time_used":1650,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":981,"receive":669,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/484c840239a025432effd6ecc373d498fa764368_CSS.748f7f460fe4ac62566f.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.079Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/484c840239a025432effd6ecc373d498fa764368_CSS.748f7f460fe4ac62566f.js.%E4%B8%8B%E8%BD%BD HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 70\r\nlast-modified: Wed, 24 Dec 2025 06:43:11 GMT\r\netag: \"694b8b7f-46\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":70,"size_decoded":0,"mime_type":"application/octet-stream","magic":"ASCII text, with no line terminators","md5":"558b16677112d754ba376553b26114de","sha1":"8c550409be00fc9e01d344247c225f989a3520f3","sha256":"aa3042432401df744e341ad07e6f06893f8099bd46d7b8bc152fc582fa2e4bf9","sha512":"1771cc5e3831942a6dc5e3f441a34b5073d569dcc925721110bc4525d1e05e900fc8f8894b6f0917e8d57b8d52a125afdde5dc5b21e93cd15580224f7045dcf2","ssdeep":"","tlshash":"1ea002ab10017c9aa8fc42882363b7f43848010c1f00ccf81b199071b071d4fada01d7","first_seen":"2023-04-16T18:26:22Z","last_seen":"2026-08-10T04:20:51.536202Z","times_seen":116,"resource_available":true,"data":null}},"time_used":1649,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":982,"receive":667,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/partner-cosmos.svg","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.092Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/partner-cosmos.svg HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 24 Dec 2025 06:43:20 GMT\r\nvary: Accept-Encoding\r\netag: W/\"694b8b88-169e\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5790,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"24b422095f45e55762ce124560f2e32c","sha1":"03bc60748c888a58c7ccf555903a2c90d4f44ae1","sha256":"6d5e008c7a2f9daf1ecc2d5558657820ea5743c9d8f990351fe2122eb5441502","sha512":"e8d317b675e20a790264f0430042a6efd7c192a6e632db5e4ac3b78b5ac3c367a7566d27e9116cdc196ea1f8a64b31eeab24c9f4bba9280d992c2b3345396d8a","ssdeep":"96:U8wi56sbKbFTDWjm6iyinXKd7ycdZg4z3KA7zIJcckwHWtGH27T9B4k:U8rKhnWjRiLO7yw+tcckwmGH27TH4k","tlshash":"b7c1b7fc777562f4b842d1fecb2051f83a51aaebb8020924d3a80e0e9c8197c5d59dd7","first_seen":"2023-05-10T10:24:22Z","last_seen":"2026-08-13T23:12:23.605684Z","times_seen":1225,"resource_available":false,"data":null}},"time_used":977,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":977,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/help-zh.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.058Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/help-zh.js.%E4%B8%8B%E8%BD%BD HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 730\r\nlast-modified: Wed, 24 Dec 2025 06:43:17 GMT\r\netag: \"694b8b85-2da\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":730,"size_decoded":0,"mime_type":"application/octet-stream","magic":"JavaScript source, ASCII text, with very long lines (529)","md5":"43df80fe9e8e8118cf36e9828164382a","sha1":"fd182988c2973872554ba5c0349861edced3f756","sha256":"88eba2594e1436de05ec9d83e84c1130918b7b6610eface1fa32c8e8c34a63ac","sha512":"719fad0eac3fa79167881ac5e61247da96b93df3da5d3c5fb7b97e4d5b73c79c5913d1a0f473c8ef9c94580f68f345ea979f422b134be96339935be2a6bd7f48","ssdeep":"","tlshash":"fe01bde93597742486a7e0d9925fcf0d3721611952080486878fd9c4f438daa9b0f99c","first_seen":"2024-01-06T17:59:56Z","last_seen":"2026-07-19T01:13:04.546334Z","times_seen":23,"resource_available":true,"data":null}},"time_used":1324,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":992,"receive":332,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/402257e71ad0734f137dd61e5df6994e10da8ec4_CSS.41c0528f.chunk.css","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.062Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/402257e71ad0734f137dd61e5df6994e10da8ec4_CSS.41c0528f.chunk.css HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 24 Dec 2025 06:43:10 GMT\r\nvary: Accept-Encoding\r\netag: W/\"694b8b7e-48b91\"\r\nexpires: Wed, 04 Feb 2026 09:55:45 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":297873,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"47441f5bf4a8801a914a57bb79e4dea6","sha1":"84720709a126eac0d91914a999714ff207ade3ee","sha256":"46a64321a647b4f2f51946d8063d5c6f1686c0370c88e86dfd33b7f1c8b3364f","sha512":"820b64ab8b80b3a86c9c823e6a7a651aec9d7928be99d05fc047736bfba7489ddbdb7c6558682a643e8071cf012b3775f0a4bce41be4e02b1fce7973f1c93d2a","ssdeep":"6144:DXPX6XPXnXRX7XRXL2dkjrojnc+TGvYopZ2NGVOBh2zcyDQ2rl:22dkjrojnc+TGvYopZ2NGVOBh2zcyDQe","tlshash":"2254a7d97ae12508791f8329a3ab9b51a3286013930fecb972fd358cdfc5285519378f","first_seen":"2025-12-04T19:44:06.795472Z","last_seen":"2026-03-30T02:08:14.78638Z","times_seen":12,"resource_available":false,"data":null}},"time_used":991,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":991,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/main-e70ab4779d2e95190f36.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.065Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/main-e70ab4779d2e95190f36.js.%E4%B8%8B%E8%BD%BD HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 23952\r\nlast-modified: Wed, 24 Dec 2025 06:43:19 GMT\r\netag: \"694b8b87-5d90\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":23952,"size_decoded":0,"mime_type":"application/octet-stream","magic":"JavaScript source, ASCII text, with very long lines (23952), with no line terminators","md5":"f2c725befb341f99a588d03a4b0b2fe9","sha1":"147080197c95da1480b18fe2a424c2d183babded","sha256":"49ae8e1e712f826916dbfff38a51aec707c97b6d30bf809fa07d23fd0948ae4a","sha512":"4cb81c85b790bde27b6edea313c78a9676a6521091e0b3981ef49485f90d7b39bad5bd9ecc810795bfeb89d094c744b66f2f32c99de51d3ceab0899b964a31ba","ssdeep":"384:grKISudmqwdxhwU+ZhI3IqsgCAXKJlK90IQ8+bwylQoZNFgx3Ys:wKIzmqaTwU++IqEAXiyslpqxIs","tlshash":"e8b2d7ddb6c5f07207e32075a03f620bb37b3958645d8410a3a5d9e67c7a94e9223f6c","first_seen":"2025-10-04T00:21:30.848976Z","last_seen":"2026-05-28T07:03:01.289386Z","times_seen":28,"resource_available":true,"data":null}},"time_used":1321,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":989,"receive":332,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/imTokenLogo.svg","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.082Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/imTokenLogo.svg HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 24 Dec 2025 06:43:17 GMT\r\nvary: Accept-Encoding\r\netag: W/\"694b8b85-24de\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9438,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ff362ef3dd8481a8b6507fb545025cf8","sha1":"a728dfb3d393258924ce63dfbc3f638b59d3330a","sha256":"690e08204f91ce6958a804b11ee08546156e4b5dca35f0b1ce00dee6266156b2","sha512":"a25bd09b8e65b5188bc5efcaf54aa7a215217cd53f8e92337c06edc96cf82b3e116e7771ea3ed36ac51f42d869f018178f0429e15044e8a43cfe72126643124e","ssdeep":"192:LJYVRfONtbZ36T9/zp+beh4ciRBi6m/Z1BnMg+K4jnFJibZLI2R9TZx9R:sRfONtbZ36PPiRBivPBMgxKnFJlE","tlshash":"681286f13aa463f59503ebf8de2754746a2b38fabfc54ae7c190ac499422055cdc9cc2","first_seen":"2024-08-08T18:51:51Z","last_seen":"2026-08-16T06:28:48.686395Z","times_seen":2245,"resource_available":false,"data":null}},"time_used":980,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":980,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/twitter.svg","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.106Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/twitter.svg HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 599\r\nlast-modified: Wed, 24 Dec 2025 06:43:22 GMT\r\netag: \"694b8b8a-257\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":599,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"9dbc7890b4c52dff09e7203babc8369a","sha1":"3da674aa07c53f903cbc779b97f571f9c561f9e0","sha256":"c3d38f32d68b9dc80f5c549c9cdacc274539b890ea894fccad065d4808e23bfe","sha512":"b63f78778bcaab70433ea07ade2f2a1be2213198bd7d9fa1ed8cae7c89ad62407b6d1f9c42b4d2c505718b5713617be25e497f0dec0d5cdaa7b60a5cae2374ab","ssdeep":"","tlshash":"3cf0e1594a9e2ad4861fdfda9637117a701b78f11bb5c2ce81a0b65164a4cfd4c1cd20","first_seen":"2023-05-10T10:24:22Z","last_seen":"2026-08-10T16:24:43.871311Z","times_seen":1188,"resource_available":false,"data":null}},"time_used":2276,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":955,"receive":1321,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/_buildManifest.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.119Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/_buildManifest.js.%E4%B8%8B%E8%BD%BD HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 4317\r\nlast-modified: Wed, 24 Dec 2025 06:43:23 GMT\r\netag: \"694b8b8b-10dd\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4317,"size_decoded":0,"mime_type":"application/octet-stream","magic":"JavaScript source, ASCII text, with very long lines (4317), with no line terminators","md5":"07a49ad02a4ed431f44e732f441396cb","sha1":"1605200f711379d512a2256d23b6ce8be0a78bb9","sha256":"929842b82359675c4dcbc2e8d7229f6d8b4563790e08de1c991f69ed1695b73c","sha512":"bf8403c46ba5e6a8a3fa76e82734b39623ab5ff50b1c1209d5683d847688634d799e4d8c46ce737b3058b4f983589387b213144582d1fdcff8704264d1b13093","ssdeep":"48:ncI/yTlUpccOJ3MX4xrrFgQrbPOEGhn3gGVzmTps+2XjnrGxr7Drv9kkxnCjM6ZK:cUyTlGcrJFrbWMCkceyYnCy","tlshash":"64919c421e33bf412ee3fc856cbc6f3e85e054b1e9f5026382ad482ec9805359f7a695","first_seen":"2026-02-03T21:53:30.162306Z","last_seen":"2026-02-03T21:56:12.315478Z","times_seen":3,"resource_available":true,"data":null}},"time_used":1943,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":946,"receive":997,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sp0.baidu.com/9_Q4simg2RQJ8t7jm9iCKT-xh_/s.gif?l=https://imtoken.download-zh-cn.com/","fqdn":"sp0.baidu.com","domain":"baidu.com","tld":"com"},"ip":{"addr":"103.235.46.102","port":443,"asn":55967,"as":"Beijing Baidu Netcom Science and Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:46.378Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"baidu.com","organization":"Beijing Baidu Netcom Science Technology Co., Ltd"},"issuer":{"commonName":"GlobalSign RSA OV SSL CA 2018","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 09 Jul 2025 07:01:02 GMT","end":"Mon, 10 Aug 2026 07:01:01 GMT"},"fingerprint":{"sha1":"21:BF:66:0D:67:BE:7A:7F:49:48:05:30:F4:7F:09:F2:30:36:CA:63","sha256":"0D:82:2C:9A:90:5A:EF:E9:8F:37:12:C0:E0:26:30:EE:95:33:2C:45:5F:E7:74:5D:F0:8D:BC:79:F4:B0:A1:49"}}},"request":{"raw":"GET /9_Q4simg2RQJ8t7jm9iCKT-xh_/s.gif?l=https://imtoken.download-zh-cn.com/ HTTP/1.1\r\nHost: sp0.baidu.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Length: 0\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Tue, 03 Feb 2026 21:55:47 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T00:11:31.489385Z","times_seen":17927033,"resource_available":true,"data":null}},"time_used":1993,"timings":{"blocked":827,"dns":3,"connect":267,"send":0,"wait":336,"receive":0,"ssl":557},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=G-3GR90RW2M5","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.178.40","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:47.092Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google-analytics.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 12 Jan 2026 08:36:44 GMT","end":"Mon, 06 Apr 2026 08:36:43 GMT"},"fingerprint":{"sha1":"DE:82:C6:EB:34:C2:7C:A6:1C:CF:69:95:27:B7:90:E9:1C:75:9B:42","sha256":"AB:12:45:3E:B5:54:8A:85:27:E5:25:00:40:B8:A6:80:5A:52:FF:99:5B:4D:20:7A:F2:78:85:73:62:68:5F:87"}}},"request":{"raw":"GET /gtag/js?id=G-3GR90RW2M5 HTTP/1.1\r\nHost: www.googletagmanager.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: application/javascript; charset=UTF-8\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: Cache-Control\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Tue, 03 Feb 2026 21:55:47 GMT\r\nexpires: Tue, 03 Feb 2026 21:55:47 GMT\r\ncache-control: private, max-age=900\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncross-origin-resource-policy: cross-origin\r\nserver: Google Tag Manager\r\ncontent-length: 164714\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":520247,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (6033)","md5":"54ff4f05795133820f77c69f6cd9018d","sha1":"6171bed23d345bc568b14a3926e07a03d4306a90","sha256":"f183c6cbe1e2cb9dee86f4071baa0bb34f04140b0d9546747e4038a53f09ac0d","sha512":"b6cb0b46e87d23076f2467a38eca31d42fe67d4e6d3bebabea23288ccb854a3d57ec6f88f4840309c84098877484726b869746d3c666c20eb96446091aaa1a37","ssdeep":"6144:1dbh3hDZonfqFMPYaoCsxJGp9OttaGurc8o3OI/85+TN8ZHYA99O3B:rbh3hD6nfy0YaoCsxgp9Ogrc8k8Z4PR","tlshash":"efb4f8de73d63426979af478502f02cba87b25a2b45dc8aab1c9ccf01d3459b4127f78","first_seen":"2026-02-03T21:54:29.80001Z","last_seen":"2026-02-03T21:56:12.317033Z","times_seen":2,"resource_available":true,"data":null}},"time_used":416,"timings":{"blocked":143,"dns":0,"connect":15,"send":0,"wait":50,"receive":70,"ssl":134},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/main.b7bf113c.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.035Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/main.b7bf113c.js.%E4%B8%8B%E8%BD%BD HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 32141\r\nlast-modified: Wed, 24 Dec 2025 06:43:20 GMT\r\netag: \"694b8b88-7d8d\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":32141,"size_decoded":0,"mime_type":"application/octet-stream","magic":"JavaScript source, ASCII text, with very long lines (32026)","md5":"3484accc83cb4145538452f23086b089","sha1":"6c0f379a81c7270983d79c93423b549775237eb9","sha256":"4a63c402b7403531a5955d3305bd1af363cf805ddc7b5cce3cf0821b9761e3e1","sha512":"a7cdaedb55dc07b80306d6b87873c7fb15051ff19e413c1d7c06d7aa7f460d28424c2dbd4f9e97d294647888bd61f50b23392eb7a8221f7badbd0ee90d41d56b","ssdeep":"768:QAwOGkUUnTxnWmjUju069uBAnRjCVaM8c3XaHf53ZXpMAhcZ7xRcSxdfS:3TxfL1kn3E","tlshash":"6de24ccc35d2b0ed2243eae9177f55d9ab3e3520783a6480bacde0da676258cc153f58","first_seen":"2025-12-19T23:03:06.922666Z","last_seen":"2026-02-03T21:56:12.317924Z","times_seen":86,"resource_available":true,"data":null}},"time_used":1043,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":998,"receive":45,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/styles.0b4c5182.chunk.css","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.064Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/styles.0b4c5182.chunk.css HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 24 Dec 2025 06:43:22 GMT\r\nvary: Accept-Encoding\r\netag: W/\"694b8b8a-a7cc\"\r\nexpires: Wed, 04 Feb 2026 09:55:45 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":42956,"size_decoded":0,"mime_type":"text/css","magic":"assembler source, ASCII text, with very long lines (358)","md5":"1f1a4e37b89f0a06080c72d4f2c40be8","sha1":"c3e1d82130c3e6f7955ba1e5c239e93ca6691635","sha256":"53b093ba927f7e2fd709ec3b62175ee950075e4f8a7e56dcd3510187821032fe","sha512":"25b1f9f230015c18b8f94728d31ba5f693e51faa57353215e2b17cc2f979971f462bcb3f3714a6540eb85b855e17f08ff665f1c1b4181d0385574b30c6256283","ssdeep":"768:MOd04TWafebTP2X+lcsiWVW/cmaxN2OamTHiRVH4R7IWVSZIndlO3sLaMCUkWl+X:LboLKcpMC0YDfqqJdQa5cSVZaLcZ4p8a","tlshash":"171331422fe4252b3d1744e9764a7b08732d7107430fed787be26118cfd82ba4a6669f","first_seen":"2025-12-04T19:44:06.800215Z","last_seen":"2026-02-03T21:56:12.295993Z","times_seen":4,"resource_available":false,"data":null}},"time_used":990,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":990,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/29107295.970b1056bd19a488ef12.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.072Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/29107295.970b1056bd19a488ef12.js.%E4%B8%8B%E8%BD%BD HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 73852\r\nlast-modified: Wed, 24 Dec 2025 06:43:08 GMT\r\netag: \"694b8b7c-1207c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":73852,"size_decoded":0,"mime_type":"application/octet-stream","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"a1e962b600086da551ba9e675c910727","sha1":"f72303514953e642839cb8273a1bbd1060ff9912","sha256":"86765b533af2746597311b54ddebdbbfd67a31d937c7e3327258a9b9d9b50b83","sha512":"a17d338e20ec7c45a0ed1b8bd6a68f129630028a668af91ba21770d1e1f71a9ba51ad8366c20b932e5ea51b3fbb5cc76b41651a9c90b399c56595b263eeba7bf","ssdeep":"1536:/hdVA1ObQbCbmExG502EoIWYwICTJSIHg:F7/mE8502EPWYwICT/A","tlshash":"3e733ec83ec2f016576760b1007f048bf13eaeb269ad9554d0a1e4ec7cb851ee6b7e19","first_seen":"2023-09-25T06:21:41Z","last_seen":"2026-05-28T07:03:01.288515Z","times_seen":47,"resource_available":true,"data":null}},"time_used":1981,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":986,"receive":995,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/402257e71ad0734f137dd61e5df6994e10da8ec4_CSS.4d62413f4da81be1e932.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.076Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/402257e71ad0734f137dd61e5df6994e10da8ec4_CSS.4d62413f4da81be1e932.js.%E4%B8%8B%E8%BD%BD HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 69\r\nlast-modified: Wed, 24 Dec 2025 06:43:10 GMT\r\netag: \"694b8b7e-45\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":69,"size_decoded":0,"mime_type":"application/octet-stream","magic":"ASCII text, with no line terminators","md5":"99e6d6dc6704694222e663251c1f8deb","sha1":"18bf9e68b1130063beb6211506cce99a08797bd0","sha256":"856ab159a9a6cbdc7beb72fc35086e839adb48361d197135a92809e95b875345","sha512":"7a99a2b8f36380fe58cba2e061a7e7487f011def3b2c2bb3e77630344675a780b7513bcc2cc9c04681aff13f312f0a17e1dcfc195d45037a06df886dd423041b","ssdeep":"","tlshash":"69a0026710117caaa8fc02882363a7b03848000c1f00ccfc1b159071b071d0faaa01c7","first_seen":"2023-03-10T14:03:12Z","last_seen":"2026-08-10T04:20:51.504835Z","times_seen":232,"resource_available":true,"data":null}},"time_used":1648,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":983,"receive":665,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/partner-tron.svg","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.090Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/partner-tron.svg HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 24 Dec 2025 06:43:20 GMT\r\nvary: Accept-Encoding\r\netag: W/\"694b8b88-858\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2136,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e11bee06a36f6d006e620a6c4e045830","sha1":"ac3a3b4e97ee37985df1bcedc9b9dcf5e0ee0790","sha256":"5c11fa983a117bc1f7010afdf17f629910d01544f0b5e15c41c9013b1eda9a45","sha512":"3ca523722436ccd8c1e2b65275b294f7ac99fd237394c61b5d8807c7b57bbceff72514910911a911e10d410316544eafc7b5094e3e7af59c6173c026a315dbed","ssdeep":"","tlshash":"a44142e87eb78092ec03435f8b0678396050d4e101c192149b913e2ea8e6d1facadecb","first_seen":"2025-07-02T21:10:40.158602Z","last_seen":"2026-07-19T16:28:08.119471Z","times_seen":70,"resource_available":false,"data":null}},"time_used":977,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":977,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/402257e71ad0734f137dd61e5df6994e10da8ec4_CSS.41c0528f.chunk.css","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:47.486Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/402257e71ad0734f137dd61e5df6994e10da8ec4_CSS.41c0528f.chunk.css HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://imtoken.download-zh-cn.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: Hm_lvt_f4b3788b2247dd149fb7fdffe8aece79=1770155746; Hm_lpvt_f4b3788b2247dd149fb7fdffe8aece79=1770155746; HMACCOUNT=748D89D7109A157E; _ga=GA1.2.272943273.1770155747; _gid=GA1.2.1584147989.1770155747\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:47 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 24 Dec 2025 06:43:10 GMT\r\nvary: Accept-Encoding\r\netag: W/\"694b8b7e-48b91\"\r\nexpires: Wed, 04 Feb 2026 09:55:47 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":297873,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"47441f5bf4a8801a914a57bb79e4dea6","sha1":"84720709a126eac0d91914a999714ff207ade3ee","sha256":"46a64321a647b4f2f51946d8063d5c6f1686c0370c88e86dfd33b7f1c8b3364f","sha512":"820b64ab8b80b3a86c9c823e6a7a651aec9d7928be99d05fc047736bfba7489ddbdb7c6558682a643e8071cf012b3775f0a4bce41be4e02b1fce7973f1c93d2a","ssdeep":"6144:DXPX6XPXnXRX7XRXL2dkjrojnc+TGvYopZ2NGVOBh2zcyDQ2rl:22dkjrojnc+TGvYopZ2NGVOBh2zcyDQe","tlshash":"2254a7d97ae12508791f8329a3ab9b51a3286013930fecb972fd358cdfc5285519378f","first_seen":"2025-12-04T19:44:06.795472Z","last_seen":"2026-03-30T02:08:14.78638Z","times_seen":12,"resource_available":false,"data":null}},"time_used":338,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":338,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"beacon-v2.helpscout.net/static/js/main.4f7d1305.js","fqdn":"beacon-v2.helpscout.net","domain":"helpscout.net","tld":"net"},"ip":{"addr":"108.157.214.29","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:56:02.472Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.helpscout.net","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Thu, 06 Mar 2025 00:00:00 GMT","end":"Fri, 03 Apr 2026 23:59:59 GMT"},"fingerprint":{"sha1":"13:DB:4C:AE:C2:EF:23:C5:95:76:77:E7:70:21:28:E3:46:E4:F2:1E","sha256":"95:AE:AF:20:4C:C0:EA:E7:FF:CA:03:0F:C4:66:5D:C6:D6:64:20:9E:28:52:44:DB:EB:C1:E2:48:D0:A1:93:CD"}}},"request":{"raw":"GET /static/js/main.4f7d1305.js HTTP/1.1\r\nHost: beacon-v2.helpscout.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: application/javascript\r\ncontent-length: 12458\r\nlast-modified: Tue, 03 Feb 2026 09:31:17 GMT\r\nx-amz-server-side-encryption: AES256\r\ncontent-encoding: gzip\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ndate: Tue, 03 Feb 2026 21:31:49 GMT\r\ncache-control: max-age=315360000, s-maxage=7200, public\r\netag: \"be349022d3bc8742636d5bcc297cdaa0\"\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 e2bc8da8a8d03748525187195f797d86.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN56-P1\r\nx-amz-cf-id: YTSoUt8x4V0AfPw10qqUMQyvQI0cnkhOctuXWSitH7vk9s0wzNYmRQ==\r\nage: 1454\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000\r\nvary: accept-encoding, Origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":32141,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (32026)","md5":"bd3f521cfcb5f9c95db33445618822c2","sha1":"dd573f2e327d3feaa2bc0f0b5f4e54b059714861","sha256":"a9ad7031e8735114940bccdee06a6325250c5a7f0112ddf69ddae8da54a6b96e","sha512":"1ad5fe3a8d5aae5f88b349ff18ddb9a5d21f72df1452ea33ca0adfccce4fc1913b17b2b9498235473582fac4554395a735fab33d429080209df2149614daef0c","ssdeep":"768:RAwOGkUUnTxnWmjUju069uBAnRjCVaM8c30aHCE3ZXpMAhcZ7xR7dfS:4T0C41kn7E","tlshash":"34e24ccc35d270ed2243eae9177f55d9ab3e3420783a6480bacde4da676258cc153f58","first_seen":"2026-02-03T12:17:35.920686Z","last_seen":"2026-02-05T11:52:23.086814Z","times_seen":17,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/vendor.0c72b11a.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.032Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/vendor.0c72b11a.js.%E4%B8%8B%E8%BD%BD HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 69544\r\nlast-modified: Wed, 24 Dec 2025 06:43:22 GMT\r\netag: \"694b8b8a-10fa8\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":69544,"size_decoded":0,"mime_type":"application/octet-stream","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"7be16d9ed5dc8181531357bd0e9f4070","sha1":"ecc2c65a6c3db7948fbff8321a8d7a7d5cb5fd0c","sha256":"0fe0adf6f2a4ea84ddd49a4dd137ec2098a33946427ffa65bfabdbb4f990107b","sha512":"6a662151afb07214ca56077536a407e29e31c28289579b89fb50e3bed5dc38331776569dcc6e16e1536b628028e87916e5e624d6ef4ed7f1ca4e9aaac4096c1e","ssdeep":"768:N77zTT43DLhgmBGQOyMuCX5eLWk+Z0meb9fruMLuPNjOHtNeIviK9+sZkKtBREOe:Nrn8ZgaxkLeFNXwrrilTB9vaNm5ahb","tlshash":"1f63f9e975d1f06153ea20f5407f150bf33a592a784d80e0b224ecea6cb454e96a7fbc","first_seen":"2025-09-18T07:35:52.046276Z","last_seen":"2026-05-21T11:26:26.239851Z","times_seen":1119,"resource_available":true,"data":null}},"time_used":669,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":334,"receive":335,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/analysis.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.051Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/analysis.js.%E4%B8%8B%E8%BD%BD HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 1591\r\nlast-modified: Wed, 24 Dec 2025 06:43:13 GMT\r\netag: \"694b8b81-637\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1591,"size_decoded":0,"mime_type":"application/octet-stream","magic":"JavaScript source, ASCII text","md5":"a85cf8fc10ee3b671f9f380a2b1ae564","sha1":"789efdfc7309f07bebf74bc079856cd27e96d0e4","sha256":"f76c97305b98aa082d6ce0b70c6118383849611fee941de9736af6e594f1b8e1","sha512":"f7ef90c5b5f52b7402d7819ff6e06f09b734908c3ee303c9304e7101e164ba4059fa08c2d1a231fd8fb7f3836d29d6a0091ca66999db52efb2849c66a4051a5d","ssdeep":"","tlshash":"8431534f3475153866a792fe153fc2087122500e218aba0359dec5008eb0ffa1527acc","first_seen":"2024-01-06T17:59:56Z","last_seen":"2026-07-19T01:13:04.45864Z","times_seen":40,"resource_available":true,"data":null}},"time_used":2002,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":995,"receive":1007,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/484c840239a025432effd6ecc373d498fa764368_CSS.9a8fc300.chunk.css","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.063Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/484c840239a025432effd6ecc373d498fa764368_CSS.9a8fc300.chunk.css HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 24 Dec 2025 06:43:11 GMT\r\nvary: Accept-Encoding\r\netag: W/\"694b8b7f-1a344\"\r\nexpires: Wed, 04 Feb 2026 09:55:45 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":107332,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"09820633dbc0da351f54b3c0ebe944ef","sha1":"9ddb9a24d4b422e127497f6ea9de9b8eb911e7bf","sha256":"a8d75286367eeeda2e353fd4025bd5ad53f5a064750682fa7bd583c97a1d0858","sha512":"06435063826c8e9ccd18235a9648cd2aad49530dc69f6e2df0abce23d5b2fda08f9bb99dc27c2b4db9b9c8e1ff7f4b894890950acc6f1b52a528a897caa1ca42","ssdeep":"768:AYFqnl00UyYSqRC64crouEuDjpAsEGX0OwD2qktAo+o34kuL0esE2oualBX46WoR:NFqnl0NyYSqANqSrEg","tlshash":"58a3792a3b6205096231dba977c57b556234e113a16efca7fafd7c00ef46d4688c2e07","first_seen":"2025-10-04T00:21:30.853604Z","last_seen":"2026-05-28T07:03:01.245342Z","times_seen":31,"resource_available":false,"data":null}},"time_used":991,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":991,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/business.svg","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.103Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/business.svg HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 834\r\nlast-modified: Wed, 24 Dec 2025 06:43:16 GMT\r\netag: \"694b8b84-342\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":834,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"5edce84229c2295c6fc6b49a18afcda9","sha1":"8e93ee77317b040d252bea7e41da9a405d76642f","sha256":"f3752af7aab239ede54fdd4f23390750ad0d7719e2a60b63ab35166965b6b9c2","sha512":"5dbcccf0a1050cee5f3eb7347d1fa7d37e531856b9abbccee538ffa6ef787bbcd833e0c0105281b16bf877dfd14aa873f4056cc7c2587650d14b3e7865eea666","ssdeep":"","tlshash":"0601af65a34d193cb31393a4d6063770222a5c611716b21486722cb694f710dbabb9ea","first_seen":"2023-05-10T10:24:22Z","last_seen":"2026-08-13T23:12:23.597615Z","times_seen":1283,"resource_available":false,"data":null}},"time_used":1960,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":959,"receive":1001,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zz.bdstatic.com/linksubmit/push.js","fqdn":"zz.bdstatic.com","domain":"bdstatic.com","tld":"com"},"ip":{"addr":"157.255.63.48","port":443,"asn":136958,"as":"China Unicom Guangdong IP network","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:47.096Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"baidu.com","organization":"Beijing Baidu Netcom Science Technology Co., Ltd"},"issuer":{"commonName":"GlobalSign RSA OV SSL CA 2018","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 09 Jul 2025 07:01:02 GMT","end":"Mon, 10 Aug 2026 07:01:01 GMT"},"fingerprint":{"sha1":"21:BF:66:0D:67:BE:7A:7F:49:48:05:30:F4:7F:09:F2:30:36:CA:63","sha256":"0D:82:2C:9A:90:5A:EF:E9:8F:37:12:C0:E0:26:30:EE:95:33:2C:45:5F:E7:74:5D:F0:8D:BC:79:F4:B0:A1:49"}}},"request":{"raw":"GET /linksubmit/push.js HTTP/1.1\r\nHost: zz.bdstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: JSP3/2.0.14\r\ndate: Tue, 03 Feb 2026 21:56:01 GMT\r\ncontent-type: application/x-javascript\r\nlast-modified: Sun, 21 Dec 2025 18:13:20 GMT\r\netag: \"694838c0-134\"\r\ncache-control: max-age=86400\r\ncontent-encoding: br\r\nage: 60893\r\naccept-ranges: bytes\r\ntracecode: 27215861170194744330020312\r\nohc-global-saved-time: Tue, 03 Feb 2026 04:45:21 GMT\r\nohc-cache-hit: gz5un58 [2], bduncache60 [2]\r\nohc-response-time: 1 0 0 0 0 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":308,"size_decoded":0,"mime_type":"application/x-javascript","magic":"ASCII text, with very long lines (308), with no line terminators","md5":"f9fc52ab67f035b8baf5d558714cc94d","sha1":"37062a6fb1ef410d496137d44275738ae743c747","sha256":"c31f2003f1c93ac1e34b09f376d97a65da6e110bf451cf1e0e50a7946c5e7212","sha512":"ebb0415852fbb5b964094e2e55a28b90f701dff1977c8b98c6f24d65d09067dc0c417d01492ca28a4be6747816d7c0bfac87b73a33725aee047a5d2f7ab83182","ssdeep":"","tlshash":"11e0cde86054c01c0dcb107135bb324ce7771d675a645545c04d9445396cb1f8247fe9","first_seen":"2023-03-07T01:18:58Z","last_seen":"2026-08-16T14:56:56.428989Z","times_seen":23562,"resource_available":true,"data":null}},"time_used":29661,"timings":{"blocked":14696,"dns":3,"connect":301,"send":0,"wait":262,"receive":-1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"d3hb14vkzrxvla.cloudfront.net/v1/d8b2691c-875e-4db2-b3a9-f3ce3f7d3651","fqdn":"d3hb14vkzrxvla.cloudfront.net","domain":"d3hb14vkzrxvla.cloudfront.net","tld":"cloudfront.net"},"ip":{"addr":"54.192.209.83","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:47.634Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.cloudfront.net","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Mon, 05 May 2025 00:00:00 GMT","end":"Thu, 23 Apr 2026 23:59:59 GMT"},"fingerprint":{"sha1":"8F:00:F1:34:A7:1E:27:1C:CF:CD:A6:53:8B:C4:82:B0:68:BC:C8:72","sha256":"60:38:9D:24:9E:41:8F:23:AC:D9:14:5C:A3:47:7E:AF:07:DB:9F:2D:6A:8C:0D:08:E9:24:8A:8E:49:A9:4D:28"}}},"request":{"raw":"GET /v1/d8b2691c-875e-4db2-b3a9-f3ce3f7d3651 HTTP/1.1\r\nHost: d3hb14vkzrxvla.cloudfront.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\ncorrelationId: 9264a8be-0345-4b3b-bc43-a959ee9c2f14\r\nHelpscout-Origin: Beacon-Embed\r\nHelpscout-Release: 2.2.292\r\nBeacon-Device-ID: 24a946f8-6be1-426c-8063-e4908fd369be\r\nBeacon-Device-Instance-ID: d757c7b8-5d0e-431c-baa4-4c09a863f284\r\nOrigin: https://imtoken.download-zh-cn.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: application/json\r\naccess-control-allow-origin: https://imtoken.download-zh-cn.com\r\naccess-control-expose-headers: Resource-ID\r\naccess-control-allow-credentials: true\r\ncache-control: max-age=300\r\ndate: Tue, 03 Feb 2026 21:55:47 GMT\r\nx-envoy-upstream-service-time: 3\r\nserver: istio-envoy\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Origin,Access-Control-Request-Method\r\nx-cache: Miss from cloudfront\r\nvia: 1.1 42f63300fbd68ad2da1e182d0d6d6948.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P3\r\nx-amz-cf-id: t5LcodGF3PM2GCTl3T7Dv8JLeqrdhfzFX1-q9vXkT1Et2Cugrq4n0g==\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":9300,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"a9cef5898ecc1ce04d4b3b0184c43c32","sha1":"9d4c0e7fc1a4a88373314d12cb70983b9e044aa2","sha256":"3fc579be91f907d568133bfe56a869869415be7628049e0518ec9961163a4d99","sha512":"671b9f511847dcbd65aa183bbd94cd6e08c47ecb9a83d26a4205129ba1a5d08f16092e2c8b52ea8ff176d3bb1b8c06f89b3cb68e848d72d8fb0c469345a27f1e","ssdeep":"192:wboPOEAVEVGFRVAJqF2UGis8yF0xxzgPt2jY9EOTPsLsFp4Vad0Mj:wboPOJWGFEJqF5s8yFGKg4EekqpGamQ","tlshash":"3a12e8104238ed7d870667ea2521b51f513852b250d4b87dcf0a09bd0bdadcecb96f17","first_seen":"2026-02-03T21:53:30.132898Z","last_seen":"2026-02-04T00:10:51.731694Z","times_seen":4,"resource_available":false,"data":null}},"time_used":122,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":122,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/push.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.048Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/push.js.%E4%B8%8B%E8%BD%BD HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 308\r\nlast-modified: Wed, 24 Dec 2025 06:43:21 GMT\r\netag: \"694b8b89-134\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":308,"size_decoded":0,"mime_type":"application/octet-stream","magic":"ASCII text, with very long lines (308), with no line terminators","md5":"f9fc52ab67f035b8baf5d558714cc94d","sha1":"37062a6fb1ef410d496137d44275738ae743c747","sha256":"c31f2003f1c93ac1e34b09f376d97a65da6e110bf451cf1e0e50a7946c5e7212","sha512":"ebb0415852fbb5b964094e2e55a28b90f701dff1977c8b98c6f24d65d09067dc0c417d01492ca28a4be6747816d7c0bfac87b73a33725aee047a5d2f7ab83182","ssdeep":"","tlshash":"11e0cde86054c01c0dcb107135bb324ce7771d675a645545c04d9445396cb1f8247fe9","first_seen":"2023-03-07T01:18:58Z","last_seen":"2026-08-16T14:56:56.428989Z","times_seen":23562,"resource_available":true,"data":null}},"time_used":1327,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":995,"receive":332,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/alarm.svg","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.085Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/alarm.svg HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 533\r\nlast-modified: Wed, 24 Dec 2025 06:43:13 GMT\r\netag: \"694b8b81-215\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":533,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b20df3089e50c545541d8ee900863574","sha1":"451b3f7e7fd362deed7642033c480082bcb0674a","sha256":"7c9ca78247b00b98096dc68fc15527fa07e332c5c87c7834e1511786a490af68","sha512":"40eb69a60fe3c221e70659a54d99e80089e6e8ea47994b7460dfb1ca0d03207570de0a7bb03ae32706a2e1c10a9fb791e8216a57bafe0c516f0f48eed0ea6a7f","ssdeep":"","tlshash":"bff05994538c9ebcb6224f24db1172b6207b31373b9d9258d863a43a216411d683f9fc","first_seen":"2023-05-07T16:57:14Z","last_seen":"2026-08-13T23:12:23.614534Z","times_seen":2103,"resource_available":false,"data":null}},"time_used":1983,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":980,"receive":1003,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"d3hb14vkzrxvla.cloudfront.net/v1/d8b2691c-875e-4db2-b3a9-f3ce3f7d3651","fqdn":"d3hb14vkzrxvla.cloudfront.net","domain":"d3hb14vkzrxvla.cloudfront.net","tld":"cloudfront.net"},"ip":{"addr":"54.192.209.83","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:47.458Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.cloudfront.net","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Mon, 05 May 2025 00:00:00 GMT","end":"Thu, 23 Apr 2026 23:59:59 GMT"},"fingerprint":{"sha1":"8F:00:F1:34:A7:1E:27:1C:CF:CD:A6:53:8B:C4:82:B0:68:BC:C8:72","sha256":"60:38:9D:24:9E:41:8F:23:AC:D9:14:5C:A3:47:7E:AF:07:DB:9F:2D:6A:8C:0D:08:E9:24:8A:8E:49:A9:4D:28"}}},"request":{"raw":"OPTIONS /v1/d8b2691c-875e-4db2-b3a9-f3ce3f7d3651 HTTP/1.1\r\nHost: d3hb14vkzrxvla.cloudfront.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: beacon-device-id,beacon-device-instance-id,correlationid,helpscout-origin,helpscout-release\r\nReferer: https://imtoken.download-zh-cn.com/\r\nOrigin: https://imtoken.download-zh-cn.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-length: 0\r\naccess-control-allow-origin: https://imtoken.download-zh-cn.com\r\naccess-control-allow-methods: GET\r\naccess-control-allow-headers: beacon-device-id, beacon-device-instance-id, correlationid, helpscout-origin, helpscout-release\r\naccess-control-allow-credentials: true\r\nallow: GET, HEAD, POST, PUT, DELETE, OPTIONS, TRACE, PATCH\r\ndate: Tue, 03 Feb 2026 21:55:47 GMT\r\nx-envoy-upstream-service-time: 3\r\nserver: istio-envoy\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Origin,Access-Control-Request-Method\r\nx-cache: Miss from cloudfront\r\nvia: 1.1 42f63300fbd68ad2da1e182d0d6d6948.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P3\r\nx-amz-cf-id: QJTnwknbrPsGJy15zUZENFRU-bdS4fNlySbeAMMYJH-8bxY2hh6TQw==\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T00:11:31.489385Z","times_seen":17927033,"resource_available":true,"data":null}},"time_used":175,"timings":{"blocked":16,"dns":15,"connect":1,"send":0,"wait":123,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v2-cdn-dev.token.im/orbit/token-im/configuration.json?q=1770155748094","fqdn":"v2-cdn-dev.token.im","domain":"token.im","tld":"im"},"ip":{"addr":"34.120.113.83","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:48.109Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.token.im","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Fri, 06 Jun 2025 00:00:00 GMT","end":"Mon, 08 Jun 2026 23:59:59 GMT"},"fingerprint":{"sha1":"CD:6A:97:52:4E:A8:46:CE:4F:1D:42:72:6D:C1:19:46:04:DD:E7:0E","sha256":"54:95:F0:AB:F3:83:AB:3A:88:D5:EA:82:AD:9E:2E:8B:05:68:CD:B5:B7:F3:38:F0:F9:18:27:39:5D:38:08:1C"}}},"request":{"raw":"GET /orbit/token-im/configuration.json?q=1770155748094 HTTP/1.1\r\nHost: v2-cdn-dev.token.im\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://imtoken.download-zh-cn.com/\r\nOrigin: https://imtoken.download-zh-cn.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: marco/3.2\r\ndate: Tue, 03 Feb 2026 21:55:48 GMT\r\ncontent-type: application/json\r\ncontent-length: 59\r\nx-source: U/304\r\nx-upyun-content-length: 59\r\netag: \"ab406015f2bf896f16748f384293b868\"\r\nlast-modified: Mon, 22 Dec 2025 10:25:11 GMT\r\nx-upyun-content-type: application/json\r\nx-request-id: d18ea9ef213cb16579ab397de5b99314; 474c41ed5f48c45455885bb893616041\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nvia: T.167.H, V.pcw-cn-hkg-167, T.133.H, M.gtt-de-fra3-133, 1.1 google\r\ncache-control: public,must-revalidate,max-age=300\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":59,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"ab406015f2bf896f16748f384293b868","sha1":"977d942f3d13ab912189788fb530180025e02dc3","sha256":"573fafce693a29349a2dfb6f8613a84c0b4e18d4e091ba9ab44711e46085c298","sha512":"36426b30117d7380de76eb0038bd592cf5646d8f4030bf5592870e24107ee880f57a0ae7ac85ed29313d0947cf724fba0f5deacde04b4fc68f41b201518b8adb","ssdeep":"","tlshash":"59a0021a421868bd84a6e400873d5e0324798d7211066c24b11a016eacbb0251201c27","first_seen":"2026-01-23T17:42:42.682945Z","last_seen":"2026-05-28T07:03:01.282299Z","times_seen":13,"resource_available":false,"data":null}},"time_used":222,"timings":{"blocked":68,"dns":1,"connect":32,"send":0,"wait":84,"receive":0,"ssl":32},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"beacon-v2.helpscout.net/","fqdn":"beacon-v2.helpscout.net","domain":"helpscout.net","tld":"net"},"ip":{"addr":"108.157.214.29","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:56:02.429Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.helpscout.net","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Thu, 06 Mar 2025 00:00:00 GMT","end":"Fri, 03 Apr 2026 23:59:59 GMT"},"fingerprint":{"sha1":"13:DB:4C:AE:C2:EF:23:C5:95:76:77:E7:70:21:28:E3:46:E4:F2:1E","sha256":"95:AE:AF:20:4C:C0:EA:E7:FF:CA:03:0F:C4:66:5D:C6:D6:64:20:9E:28:52:44:DB:EB:C1:E2:48:D0:A1:93:CD"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: beacon-v2.helpscout.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: application/javascript\r\ncontent-length: 287\r\nlast-modified: Tue, 03 Feb 2026 09:31:16 GMT\r\nx-amz-server-side-encryption: AES256\r\ncontent-encoding: gzip\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ndate: Tue, 03 Feb 2026 21:55:44 GMT\r\ncache-control: max-age=120, s-maxage=120, public\r\netag: \"6117b4c0fb6b1237af0b3baf5745e036\"\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 e2bc8da8a8d03748525187195f797d86.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN56-P1\r\nx-amz-cf-id: q7q3WDwCk2CqdiS2vMyWZgqot5nC98rYJyrnCW1M1JV1BBZURM0Gew==\r\nage: 18\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000\r\nvary: accept-encoding, Origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}],"data":{"size":372,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (372), with no line terminators","md5":"1b30489ca0695aea768bf0259aa878f6","sha1":"e415612270a735b160154c81e132b9b1f0395532","sha256":"8581137db257306a5557e2ad3214bf74681dc6657129d7f5be0b3f4cb4b47ec2","sha512":"94f4d7a719d30a88774fc7f1e976799b654003f2a58f8f116a031fed89383d55dd32a69c4743d4d1cc126b0de9aa7272b31bf4be84c1ccb384f18c3823baeec6","ssdeep":"","tlshash":"2ce0600d3c00c53123a30c729377d83c61a292401033c103e4caccb6b8bcce94c6b28c","first_seen":"2026-02-03T12:17:35.8926Z","last_seen":"2026-02-05T11:52:23.132354Z","times_seen":17,"resource_available":true,"data":null}},"time_used":13,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/402257e71ad0734f137dd61e5df6994e10da8ec4.ab19d6bbf72133073b8c.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.074Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/402257e71ad0734f137dd61e5df6994e10da8ec4.ab19d6bbf72133073b8c.js.%E4%B8%8B%E8%BD%BD HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 325418\r\nlast-modified: Wed, 24 Dec 2025 06:43:09 GMT\r\netag: \"694b8b7d-4f72a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":325418,"size_decoded":0,"mime_type":"application/octet-stream","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"c2787458a3dc4e39d324a0f5463a9ecf","sha1":"99d61d21cce29d4709d12a2c1981bb7293e762f5","sha256":"9c95235116bac82f0457f9f0a7e0afc91bff84b2a710b056ddde41967a4bad72","sha512":"a17831e756833382e741bb693b75e5c5067fa02c3c781c3179518f57d14221a092adffd33b5fcf34cfdd33e2c63606b6649b8d3325ce83f9806d5cb951feea09","ssdeep":"6144:v6aKhcvX5wD1PGyDOCcnblC9m8+kWhALp+FAGx:vS25wRDOCoblCdWiLp+FAGx","tlshash":"066407dc7291f06242e722b5406f150af33a596ca89ed850f672c8e5bcb559e4233f3e","first_seen":"2026-01-23T17:42:42.642744Z","last_seen":"2026-02-03T21:56:12.32929Z","times_seen":4,"resource_available":true,"data":null}},"time_used":2351,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":984,"receive":1367,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/arrow-down.svg","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.083Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/arrow-down.svg HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 207\r\nlast-modified: Wed, 24 Dec 2025 06:43:14 GMT\r\netag: \"694b8b82-cf\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":207,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"120e5756289bdf45cd9f51442b1224c9","sha1":"a53737a735a6502ace15f6fcaa404f7c42abd483","sha256":"f22a34371e6b2d446921f8542f85b81a4673d4ea2aa5f6bb759037b36037632f","sha512":"f49b1fd7502f0934e972ad635159cb5c487611f75db00c246e9d70895f815204fa699e4890b274f641d560501b19a8657374712b519bc37a3a2ac1512e57877a","ssdeep":"","tlshash":"bed0223bb32ccc1cb5124528e3ba367150f3109308cd2654d8332131ae054afbb2bae8","first_seen":"2023-05-10T10:24:22Z","last_seen":"2026-08-16T06:28:48.602027Z","times_seen":2789,"resource_available":false,"data":null}},"time_used":1983,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":980,"receive":1003,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/partner-ethereum.svg","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.089Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/partner-ethereum.svg HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 24 Dec 2025 06:43:20 GMT\r\nvary: Accept-Encoding\r\netag: W/\"694b8b88-25d0\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9680,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"bd8f57a32cd521ec6f4d6faf2932bfd8","sha1":"f31988b4e991a56351f6f833775f3fc277a3f0a1","sha256":"9e5ed3658d4df3fb2782c7714d3db670600b9b59572df69100a22ebcd18bb7fd","sha512":"53647d6f897cb39f2f6d05111ec3d63af410283235d9ec5196340f3931facf35a6b4c2cd14200ae999a8f55c1a9f89feeac689e588fb50f5e869665c13a28c2b","ssdeep":"192:oFyM0Jy+wEq+/E6YE07UOdihOahHBggiUNGIeyZLSSqKXF0:mCwEvc6YEgwhOjgUIeEMKXO","tlshash":"ca12b6dc6f3385fcb8c5a1fedb1554a835549cee780686a9d3782d046c42928dd0a8e3","first_seen":"2023-05-10T10:24:22Z","last_seen":"2026-08-13T23:12:23.601303Z","times_seen":1221,"resource_available":false,"data":null}},"time_used":978,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":978,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/imkey.svg","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.088Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/imkey.svg HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 24 Dec 2025 06:43:17 GMT\r\nvary: Accept-Encoding\r\netag: W/\"694b8b85-3423\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13347,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"a3fd6cd4340f73f2f44388e97964f3eb","sha1":"694e8d4a2dfdd16c8f3444e77fe5d58c8ff1e907","sha256":"ef070fb21fd2892969662d3f1d08792aef524bd34a1c437a8e4129c3f99bbf69","sha512":"4962daa17f6fad3aa449210f0ad381083b9a8c524dd539c592feb3cc3fc96d08f8b26ac24296634c2d3a5c557eb56086e45bcd1bb1a42937f22d7ac5d698a294","ssdeep":"192:WFDb/y/y3W0o7HYkS53bOz9cJnJ+ujFNg8znwtjuo+jco8aBP:cbPmYX53bZPNnzwtjuo+jcoL","tlshash":"925279dc2f1867e894c053daaf2a50fdac2bd0ee6688d514c6042f1d788947ebc775ca","first_seen":"2023-05-10T10:24:22Z","last_seen":"2026-08-13T23:21:55.103488Z","times_seen":1723,"resource_available":false,"data":null}},"time_used":978,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":978,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/partner-consensys.svg","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.095Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/partner-consensys.svg HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 24 Dec 2025 06:43:20 GMT\r\nvary: Accept-Encoding\r\netag: W/\"694b8b88-c180\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":49536,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e6c8c3635e46cc20c06379fb68fa638c","sha1":"8b1ecdf3c884347449e8eb40802a78e8d8c8e258","sha256":"7d39b719ac59dba8e899accd2c2cdcbcc4cfccdb8ac7a05f74d8c866373034d4","sha512":"9306f5982803f40f8981f5685d2087d53b955961d7fdc3760047e9fbfa96bbb128137aa9787a3cab9d0118d3104d07b206dc539cd86a657c150d7eb4703b2031","ssdeep":"768:rG7JFv8hva55P71WPJ9WsUAKFhTw7bAvk2goGW0AUK7dfj9sae7:rS8izPIPM3wPAvktoGdy7e7","tlshash":"b72351d0377686e8b845b2fdcb3ea5e238226cdd35018999d3b02c19ac8167d4d9ced7","first_seen":"2023-05-10T10:24:22Z","last_seen":"2026-08-13T23:12:23.617459Z","times_seen":1622,"resource_available":false,"data":null}},"time_used":976,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":976,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/medium.svg","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.107Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/medium.svg HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 224\r\nlast-modified: Wed, 24 Dec 2025 06:43:20 GMT\r\netag: \"694b8b88-e0\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":224,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6a49621075d683c755db86def96ca77f","sha1":"738d6ed4c702623f09a65afeeba6688d229f3f42","sha256":"077943f1b01d0d63a8becbaa9f8a8af2aee71f368081f6a43576ce1e0da56049","sha512":"ba11c88f67891ba18ee2687f3556b8329f97c17d39560f6b71d18f388bf1a16f0cd82b9e12b00a293a955351445d485234da4b434dda9c22094065069b39463e","ssdeep":"","tlshash":"00d023e8c44c08048f3cc649df2f3d2e107561d3075c441fe0802200fc45aa2380c47c","first_seen":"2023-05-10T10:24:22Z","last_seen":"2026-08-10T16:24:43.879499Z","times_seen":1184,"resource_available":false,"data":null}},"time_used":2274,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":953,"receive":1321,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/js","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.029Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/js HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: text/html\r\ncontent-length: 138\r\netag: \"694b7fd7-8a\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":138,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"7389d931c86b3d7bb6b8af46d8c4172b","sha1":"8d2a4760aa0b47984d11cd1a66448719177fb791","sha256":"301bd9f16f94feedfae7a946a14bac38cb73c43efe6117bc5586835af03d7d6f","sha512":"dd6d1511e4fcd5bc09d821ffe091fb5946ac9654c48664aed504e479e9ac20c1cad44b6df90f42190d47e28f5f96bfb09d24056df6b950243d68ee8100a9a889","ssdeep":"","tlshash":"d9c09b5d755366449913155167c33641d196837f689a84510941c593f0cf69ac4c73a9","first_seen":"2023-03-13T12:56:15Z","last_seen":"2026-08-16T23:53:41.411055Z","times_seen":319684,"resource_available":true,"data":null}},"time_used":333,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":333,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/common.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.060Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/common.js.%E4%B8%8B%E8%BD%BD HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 3967\r\nlast-modified: Wed, 24 Dec 2025 06:43:16 GMT\r\netag: \"694b8b84-f7f\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3967,"size_decoded":0,"mime_type":"application/octet-stream","magic":"JavaScript source, ASCII text","md5":"6e3a1c78dab0b3ddb0989d8d8baabe1c","sha1":"131a9b8fa10512bd7f79256a29ef0c84e4276ce4","sha256":"49b7e11fb9631037c45268b643a34bcd8653ce179387e400b5cbe2bc78868361","sha512":"c27ffd888a52678ed30eafdded3372efb9ef1eab65abf36dce2920f39acc4a58b5af67f66381314271f4a134981fb5e16c0e2e1264e82f0effa889c0025fc81c","ssdeep":"","tlshash":"c981bb1e79e131b1ab8b38bc55df72487935424bc00c8c123caedad49f711b495a6ece","first_seen":"2023-03-08T19:36:36Z","last_seen":"2026-07-19T01:13:04.494025Z","times_seen":91,"resource_available":true,"data":null}},"time_used":1324,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":992,"receive":332,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/webpack-22eaaa575d3c455933b4.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.067Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/webpack-22eaaa575d3c455933b4.js.%E4%B8%8B%E8%BD%BD HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 1539\r\nlast-modified: Wed, 24 Dec 2025 06:43:22 GMT\r\netag: \"694b8b8a-603\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1539,"size_decoded":0,"mime_type":"application/octet-stream","magic":"JavaScript source, ASCII text, with very long lines (1539), with no line terminators","md5":"2019297a9ccffe0e261600bad1b1f98a","sha1":"a7af96e8e11cadb4f053e78cc91cd7c531f1e877","sha256":"75fa1c4760ad6194a99710872e3612002c84c4df8339a57be0cb4aad1bde794a","sha512":"931b78e601e346f1ae773b8321cdf332b8dcc1fc2345d76f2a187c4c331f30c9f328ef72435b7302293d28b5ab1742685e5d89ce174c0af9c73ede3a9afff1a4","ssdeep":"","tlshash":"193131d536a4fcac53821d5d083f7006f2291d65127cf5c19384e8b2bc6488e9166eaa","first_seen":"2023-03-07T12:08:00Z","last_seen":"2026-08-14T08:59:26.835946Z","times_seen":459,"resource_available":true,"data":null}},"time_used":1321,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":989,"receive":332,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/484c840239a025432effd6ecc373d498fa764368.b3b45ad2ad3506f50517.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.078Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/484c840239a025432effd6ecc373d498fa764368.b3b45ad2ad3506f50517.js.%E4%B8%8B%E8%BD%BD HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 65681\r\nlast-modified: Wed, 24 Dec 2025 06:43:11 GMT\r\netag: \"694b8b7f-10091\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":65681,"size_decoded":0,"mime_type":"application/octet-stream","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"840abd773a54976d200439d66e716037","sha1":"9635203a1e195fd4560ffb03a83ed026a67a7a52","sha256":"24d6bed085bf5baf0efe01514d999931327884d42a650aba146b567b4e5171c7","sha512":"3fe563da939040f38c7d579729dac4f900b0f23b5e7098ba6dd51505fdfb3f6c2abf5b231f3135ca31d2a3da43c4b51d16cbc34c94e78568ebec758d2933c643","ssdeep":"1536:ob1tAYCvF9OWnpxoxYDquqy/D0hcmkIZqAXDyjWT:BIDfT","tlshash":"1553d7a871d1f4b552e350a6402f150af3762d6c842db880f3b1c8f4be7a65e5627f3a","first_seen":"2025-09-03T21:52:23.20755Z","last_seen":"2026-05-28T07:03:01.230041Z","times_seen":30,"resource_available":true,"data":null}},"time_used":1980,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":983,"receive":997,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/partner-zksync.svg","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.099Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/partner-zksync.svg HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 24 Dec 2025 06:43:21 GMT\r\nvary: Accept-Encoding\r\netag: W/\"694b8b89-23dd\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9181,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"79339f66e253ea5e708b4af9facb4672","sha1":"6f7aab96e1157aeec0a5d39e56ec8fd2659e82f3","sha256":"9515d5390c2b251edfc6fda424794eb12f08dc8e7960b46d75b216191bae6db8","sha512":"554a4d90024dc3974a75c31e3c7c71efd8732e6b7fb1d074e36940cc28d73c223270daa54b444e5d140a7ad8345ff36501e555947ff222fb039705e01124668f","ssdeep":"192:l0DrQbApthACK4nIt2mwdUB9bGUfXg5+SmBcNSsrmRApgPHHctttttttt:2wYAT4n42fKvbGUfXg5+SmB2riApgPna","tlshash":"a8128d74e10d1c5cd44cd9485edee8a94c298b87a1c9c99ae34491fea4178c22baa73d","first_seen":"2024-02-27T11:11:03Z","last_seen":"2026-08-13T23:12:23.6088Z","times_seen":374,"resource_available":false,"data":null}},"time_used":968,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":968,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/vcd15cbe7772f49c399c6a5babf22c1241717689176015","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.123Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/vcd15cbe7772f49c399c6a5babf22c1241717689176015 HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 19948\r\nlast-modified: Wed, 24 Dec 2025 06:43:22 GMT\r\netag: \"694b8b8a-4dec\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19948,"size_decoded":0,"mime_type":"application/octet-stream","magic":"JavaScript source, ASCII text, with very long lines (19948), with no line terminators","md5":"ec18af6d41f6f278b6aed3bdabffa7bc","sha1":"62c9e2cab76b888829f3c5335e91c320b22329ae","sha256":"8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f","sha512":"669b0e9a545057acbdd3b4c8d1d2811eaf4c776f679da1083e591ff38ae7684467abacef5af3d4aabd9fb7c335692dbca0def63ddac2cd28d8e14e95680c3511","ssdeep":"384:XriNpnjyMkg8XMtExRN1w29JIOzahXtO2nJ65:GijgSWuanfJ65","tlshash":"8d92d7def645723613f76076913f220b733b35a528068459812adbc22c3d98f6267f6e","first_seen":"2024-06-07T09:21:23Z","last_seen":"2026-08-16T17:12:28.900221Z","times_seen":337650,"resource_available":true,"data":null}},"time_used":1940,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":943,"receive":997,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/18d5e521d23679fb08f7e64c32b15892a9f9a54d.9a025b638775ae6d73eb.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.070Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/18d5e521d23679fb08f7e64c32b15892a9f9a54d.9a025b638775ae6d73eb.js.%E4%B8%8B%E8%BD%BD HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 318900\r\nlast-modified: Wed, 24 Dec 2025 06:43:07 GMT\r\netag: \"694b8b7b-4ddb4\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":318900,"size_decoded":0,"mime_type":"application/octet-stream","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"31b6299a3bc25c18fd67a1848d7a0c12","sha1":"d716902f6eca564678360b5005d781a056048425","sha256":"bb7a2df20c59e3376f96f1b7881ccf62ac05e01804f1f7bb7e224e4dbcc54974","sha512":"fcc6cf37e64a58ed2e892d109fd178c72a0f868bc730cf19f612c605a3c2fe237283ebdbcf1f9019a2339d1c59af803c37776996bb24cefea29d1ac060ba87e8","ssdeep":"3072:6ldDQws4MG8XZWSmd45PrI50/eEFUtnvvSJteL6KH+mZ4bse/cZh647jZ8BQhK6x:+sbG8l/eZ51KgExe12CBWxEj9FB","tlshash":"1864639fe7350ab608fa41cd8dd82bfed8d20b1101e5d47bc2fa59863b0457ee632a15","first_seen":"2025-12-04T19:44:06.844388Z","last_seen":"2026-02-03T21:56:12.338808Z","times_seen":4,"resource_available":true,"data":null}},"time_used":2334,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":987,"receive":1347,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/styles.d8f657d81e4dcac3db68.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.080Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/styles.d8f657d81e4dcac3db68.js.%E4%B8%8B%E8%BD%BD HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 371\r\nlast-modified: Wed, 24 Dec 2025 06:43:22 GMT\r\netag: \"694b8b8a-173\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":371,"size_decoded":0,"mime_type":"application/octet-stream","magic":"ASCII text, with very long lines (371), with no line terminators","md5":"39741a975745c9d481e25954a78b83a0","sha1":"b03486711023d71448017fd695598fff7bfef3c1","sha256":"655fcc989ea55f220697b3ba1487787e7376847a15b05abd716f32822b12d845","sha512":"0981eaa6ba4698c7bbe84ead41ea58486601c01d21096b8d6b566a1aa436cb60396a42036096f6d2f76928d96a2bbca93b7495b44f02ce3be02b88b70507605c","ssdeep":"","tlshash":"a1e0254839a03866a8e721e4225b31d81caa161a35fcfc9817f5819adb3268e145395d","first_seen":"2025-12-04T19:44:06.882724Z","last_seen":"2026-05-28T07:03:01.252606Z","times_seen":14,"resource_available":true,"data":null}},"time_used":1648,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":981,"receive":667,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"biz.token.im/v1/business","fqdn":"biz.token.im","domain":"token.im","tld":"im"},"ip":{"addr":"172.66.151.95","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:48.133Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.token.im","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Fri, 06 Jun 2025 00:00:00 GMT","end":"Mon, 08 Jun 2026 23:59:59 GMT"},"fingerprint":{"sha1":"CD:6A:97:52:4E:A8:46:CE:4F:1D:42:72:6D:C1:19:46:04:DD:E7:0E","sha256":"54:95:F0:AB:F3:83:AB:3A:88:D5:EA:82:AD:9E:2E:8B:05:68:CD:B5:B7:F3:38:F0:F9:18:27:39:5D:38:08:1C"}}},"request":{"raw":"OPTIONS /v1/business HTTP/1.1\r\nHost: biz.token.im\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://imtoken.download-zh-cn.com/\r\nOrigin: https://imtoken.download-zh-cn.com\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 03 Feb 2026 21:55:48 GMT\r\ncontent-length: 0\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD\r\naccess-control-expose-headers: \r\naccess-control-max-age: 7200\r\naccess-control-allow-headers: content-type\r\nx-frame-options: SAMEORIGIN\r\nx-from: gke-prod\r\nx-xss-protection: 1; mode=block\r\nx-geoip-city-country-code: NO\r\nx-geoip-city-country-name: Norway\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nvia: 1.1 google\r\ncf-cache-status: DYNAMIC\r\nserver: cloudflare\r\ncf-ray: 9c852cb20aa5783d-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T00:11:31.489385Z","times_seen":17927033,"resource_available":true,"data":null}},"time_used":375,"timings":{"blocked":34,"dns":2,"connect":7,"send":0,"wait":305,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/cdn-cgi/rum?","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:56:02.440Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"POST /cdn-cgi/rum? HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\ncontent-type: application/json\r\nContent-Length: 1047\r\nOrigin: https://imtoken.download-zh-cn.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nCookie: Hm_lvt_f4b3788b2247dd149fb7fdffe8aece79=1770155746; Hm_lpvt_f4b3788b2247dd149fb7fdffe8aece79=1770155746; HMACCOUNT=748D89D7109A157E; _ga=GA1.1.272943273.1770155747; _gid=GA1.2.1584147989.1770155747; _ga_3GR90RW2M5=GS2.1.s1770155747$o1$g0$t1770155747$j60$l0$h0; _ga_8LRTK3N2EM=GS2.1.s1770155747$o1$g0$t1770155747$j60$l0$h0; locale=zh-CN\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":1047,"data":"{\"memory\":{},\"resources\":[],\"referrer\":\"\",\"eventType\":1,\"firstPaint\":0,\"firstContentfulPaint\":2734,\"startTime\":1770155743628,\"versions\":{\"fl\":\"2024.11.0\",\"js\":\"2024.6.1\",\"timings\":2},\"pageloadId\":\"74fbc75f-cf8b-414b-8e96-b59a2b8d8dad\",\"location\":\"https://imtoken.download-zh-cn.com/\",\"nt\":\"navigate\",\"timingsV2\":{\"unloadEventStart\":0,\"unloadEventEnd\":0,\"domInteractive\":2733,\"domContentLoadedEventStart\":3559,\"domContentLoadedEventEnd\":3566,\"domComplete\":18789,\"loadEventStart\":18789,\"loadEventEnd\":18790,\"type\":\"navigate\",\"redirectCount\":0,\"initiatorType\":\"navigation\",\"nextHopProtocol\":\"h2\",\"workerStart\":0,\"redirectStart\":0,\"redirectEnd\":0,\"fetchStart\":1,\"domainLookupStart\":15,\"domainLookupEnd\":31,\"connectStart\":31,\"connectEnd\":705,\"secureConnectionStart\":366,\"requestStart\":705,\"responseStart\":1039,\"responseEnd\":1039,\"transferSize\":6817,\"encodedBodySize\":6375,\"decodedBodySize\":20703,\"name\":\"https://imtoken.download-zh-cn.com/\",\"entryType\":\"navigation\",\"startTime\":0,\"duration\":18790},\"siteToken\":\"5142e2eb2e49468ba4a92d37d3a89dd3\",\"st\":2}"}},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:56:02 GMT\r\ncontent-type: text/html\r\ncontent-length: 138\r\netag: \"694b7fd7-8a\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":138,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"7389d931c86b3d7bb6b8af46d8c4172b","sha1":"8d2a4760aa0b47984d11cd1a66448719177fb791","sha256":"301bd9f16f94feedfae7a946a14bac38cb73c43efe6117bc5586835af03d7d6f","sha512":"dd6d1511e4fcd5bc09d821ffe091fb5946ac9654c48664aed504e479e9ac20c1cad44b6df90f42190d47e28f5f96bfb09d24056df6b950243d68ee8100a9a889","ssdeep":"","tlshash":"d9c09b5d755366449913155167c33641d196837f689a84510941c593f0cf69ac4c73a9","first_seen":"2023-03-13T12:56:15Z","last_seen":"2026-08-16T23:53:41.411055Z","times_seen":319684,"resource_available":true,"data":null}},"time_used":335,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":334,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/js(1)","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.046Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/js(1) HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 514330\r\nlast-modified: Wed, 24 Dec 2025 06:43:19 GMT\r\netag: \"694b8b87-7d91a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":514330,"size_decoded":0,"mime_type":"application/octet-stream","magic":"JavaScript source, ASCII text, with very long lines (6031)","md5":"4838d23605f229289248e6886603f6bb","sha1":"a1f687f1b8a34ffece1bda3968fbf801d070c6f7","sha256":"593c3e4141ff7656dc365e6727ab202c0abe27cb1b5b8cbc9a464de4057dbe0f","sha512":"e433edc912a6660b7ab2ffa6e54d1b288076377866eb485d29f8f42ea1326fdbde24df234b8ad2f04d02827b74c578f4ead727c0af61c0148e4eb42dc1a802b5","ssdeep":"6144:fgIe7ma2bulKYX61u99Yye5HDmHYmyBFzvnszmO6jQWllEKPad4XEPPkM:JC8bu7q1mcrnszWcWawEL","tlshash":"7fb409ce73c63426539af478502f02cba9bb29e2b45dc89ab1c9ccf01d7459a4167f78","first_seen":"2026-02-03T21:53:29.924555Z","last_seen":"2026-02-03T21:56:12.340522Z","times_seen":3,"resource_available":true,"data":null}},"time_used":2380,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":997,"receive":1383,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/baiduPush.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.056Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/baiduPush.js.%E4%B8%8B%E8%BD%BD HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 211\r\nlast-modified: Wed, 24 Dec 2025 06:43:14 GMT\r\netag: \"694b8b82-d3\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":211,"size_decoded":0,"mime_type":"application/octet-stream","magic":"JavaScript source, ASCII text","md5":"358c43b519ff13120afdd573aa87b324","sha1":"9e4d79a78b7e53a865e3ef7fb092edd8b79ec777","sha256":"0367b50483ad48e93a97dcc891c4657fd944a5e26df217299858dd8723e76597","sha512":"a147a4fa91fcc4125c0c0f18a61a63981c6637f04d39f17744586a4f759db83b00207ded5c867d0fdea2fe84f259a2521ffdf1f36826127c0165d6752510eccf","ssdeep":"","tlshash":"ffd0222e3ca99530375a10be403fda18f1a2202c216ae613c48dec565c30eeb181ebd8","first_seen":"2024-01-06T17:59:57Z","last_seen":"2026-07-19T01:13:04.485464Z","times_seen":44,"resource_available":true,"data":null}},"time_used":2000,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":993,"receive":1007,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/app-example-zh-CN.png","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.104Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/app-example-zh-CN.png HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 24 Dec 2025 06:43:14 GMT\r\nvary: Accept-Encoding\r\netag: W/\"694b8b82-2d42a\"\r\nexpires: Thu, 05 Mar 2026 21:55:45 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":185386,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1440 x 632, 8-bit/color RGBA, non-interlaced","md5":"117754ec509bc2b2bad122999edfbfd2","sha1":"d1a4507c227e4d4378c5f60b4b137c36e27aa4a5","sha256":"1ce8d6094ceb65376b49ee2234c0a414a1196de018f75627901e6ec1f20dae56","sha512":"5a1523e25562ef1d549694ad590c836e128638fdfe6067e8928b1e85395d3a85c543f80148e72f6192eeeda9d0c48ed48dd65537c8fa7a5753a4f6593dcc39c9","ssdeep":"3072:MHdTbvoA2mwEDUPtDKxfGGSoKwldFD9cleJ2wVxnshfMDUN5kBnxkJqbF0E1i19x:MH5oA3KF+GGSvwlJclnwDnst5kBnxlRg","tlshash":"cc041289add59985e330c03444630b617be1e9b9de0b176ecebf36ab1cfb2086f11516","first_seen":"2025-07-02T21:10:40.151022Z","last_seen":"2026-08-05T03:53:04.958807Z","times_seen":48,"resource_available":false,"data":null}},"time_used":957,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":957,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/saved_resource.html","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:46.379Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/saved_resource.html HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nCookie: Hm_lvt_f4b3788b2247dd149fb7fdffe8aece79=1770155746; Hm_lpvt_f4b3788b2247dd149fb7fdffe8aece79=1770155746; HMACCOUNT=748D89D7109A157E\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:46 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 24 Dec 2025 06:43:21 GMT\r\nvary: Accept-Encoding\r\netag: W/\"694b8b89-aee\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2798,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (882)","md5":"b0672296809defcc9f249863628a4382","sha1":"b424cc9ab719d67215aafd87a06da476824c4b5b","sha256":"ac5c9195c010957ec5af02991aac3889251248ed21a4c5b73934eb391713fb5c","sha512":"0f63f58eb5a661c403eab0f9d036fd4a9596631b4e758f2c12a59afd04b5e1846f3b83a83397ee2eb2a65f633d318070cd0908e710c29463211fc7c6ac66ab92","ssdeep":"","tlshash":"bd51a6ba8174292e312f76f1aa79fa5010af9046f6461015f17f73b8c7c7648f803468","first_seen":"2026-01-23T17:42:42.615272Z","last_seen":"2026-03-29T01:56:14.013907Z","times_seen":7,"resource_available":false,"data":null}},"time_used":950,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":950,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sp0.baidu.com/9_Q4simg2RQJ8t7jm9iCKT-xh_/s.gif?l=https://imtoken.download-zh-cn.com/","fqdn":"sp0.baidu.com","domain":"baidu.com","tld":"com"},"ip":{"addr":"103.235.46.102","port":443,"asn":55967,"as":"Beijing Baidu Netcom Science and Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:56:02.065Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"baidu.com","organization":"Beijing Baidu Netcom Science Technology Co., Ltd"},"issuer":{"commonName":"GlobalSign RSA OV SSL CA 2018","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 09 Jul 2025 07:01:02 GMT","end":"Mon, 10 Aug 2026 07:01:01 GMT"},"fingerprint":{"sha1":"21:BF:66:0D:67:BE:7A:7F:49:48:05:30:F4:7F:09:F2:30:36:CA:63","sha256":"0D:82:2C:9A:90:5A:EF:E9:8F:37:12:C0:E0:26:30:EE:95:33:2C:45:5F:E7:74:5D:F0:8D:BC:79:F4:B0:A1:49"}}},"request":{"raw":"GET /9_Q4simg2RQJ8t7jm9iCKT-xh_/s.gif?l=https://imtoken.download-zh-cn.com/ HTTP/1.1\r\nHost: sp0.baidu.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Length: 0\r\nContent-Type: text/plain; charset=utf-8\r\nDate: Tue, 03 Feb 2026 21:56:02 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T00:11:31.489385Z","times_seen":17927033,"resource_available":true,"data":null}},"time_used":347,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":340,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/discord.svg","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.115Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/discord.svg HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 24 Dec 2025 06:43:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"694b8b84-540\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1344,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4843ef32f5106881cea9a4da691223cc","sha1":"6f806744b2e9dc22ac05491301d663c7cd01f219","sha256":"76e374e9e73d1f9fc28f6d5c31bd17fe07819599a35cb431f16cadba6b71e612","sha512":"2ccede4eb3bb08d01d1875f8462ecf2b7a232e656c17668e1d4672d45a1aa97bbfc452b671258e0b86d12f66dc1f17f3da9bc856d5a56e92a3cb85f711f3d66d","ssdeep":"","tlshash":"6521c1f283e460e464479f85e4358913f51a34fab75e4a484780ebc17b25017984eca0","first_seen":"2023-05-10T10:24:22Z","last_seen":"2026-08-10T16:24:43.873673Z","times_seen":1107,"resource_available":false,"data":null}},"time_used":951,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":951,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/analytics.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.041Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/analytics.js.%E4%B8%8B%E8%BD%BD HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 52310\r\nlast-modified: Wed, 24 Dec 2025 06:43:13 GMT\r\netag: \"694b8b81-cc56\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":52310,"size_decoded":0,"mime_type":"application/octet-stream","magic":"JavaScript source, ASCII text, with very long lines (1597)","md5":"f7707e932a846eeac5cb7f64004b9a5b","sha1":"1fb03bf73f9f0dc69c18eb67ed1bb4e589961f75","sha256":"f1a61277e3f902f50ab42015d8b07218db9b7601bb0967e54a52bfdcb4fa7e81","sha512":"122e1f1ede0b0962fedc78d2add5e6d4cbcd575a54ce35319f752d3ba10c1c8f919fd1ddcbdec8430e34d27688495a1255bf45f2c2891974f4fea09723d45a2c","ssdeep":"768:wwbeaWc7/IZDws2wt+BfN658GL+t+qghDXWz5o5cJDeVVgCqaDuY6N5jEi5BZsy:FbeaWcjI6TBfW7i5SLY5o5cJrBoi5h","tlshash":"b533f9f977463466c3a2b1e4403f100790baadd5f449d8a4b58ae6d06d38e6b01fbf78","first_seen":"2025-07-22T18:03:00.39653Z","last_seen":"2026-08-16T18:56:01.619296Z","times_seen":19392,"resource_available":true,"data":null}},"time_used":2005,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":998,"receive":1007,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/partner-ens.svg","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.094Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/partner-ens.svg HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 24 Dec 2025 06:43:20 GMT\r\nvary: Accept-Encoding\r\netag: W/\"694b8b88-f47\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3911,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"39f7b50c7d975fde84338c3ab2bfcd27","sha1":"493851ee7e32e939a9891c132e00531b22443fdf","sha256":"c4936ef9611363c7e187202a22963725002644720b826815517aafa50cade8bd","sha512":"f8c1b7ec6a328b1ac32befb4f0dc54342cb83cb57b544eecd693f4fcf633cf8838729d2394674716693cc068ea79e3a5176e8aeca7bbe9b7801627338f4ad096","ssdeep":"","tlshash":"6881a7cd37f75abcf09363fa9a1214f8a815e8f748c38121c2a91d0594c258cdc56ce7","first_seen":"2025-07-02T21:10:40.135106Z","last_seen":"2026-07-19T16:28:08.116825Z","times_seen":70,"resource_available":false,"data":null}},"time_used":977,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":977,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/tokenfans.svg","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.101Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/tokenfans.svg HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 24 Dec 2025 06:43:22 GMT\r\nvary: Accept-Encoding\r\netag: W/\"694b8b8a-97b\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2427,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"18e2d7aedfe2a020bac2151652e98489","sha1":"8e3685295ee75cb8f970506ec82d32d5f8ba5c93","sha256":"1213e2494be782c5692aae6cb77078f3c99212a3242cac6fc90eb27894645dd3","sha512":"f2d861f3324d58d8ce4c6c1615cf6414d97f39898f2b2d67a4737608f983d74c6529c9cdbb90ae0e8310ba60bd81bdb750fde6af2f513d3aeb46ad153dcd1d23","ssdeep":"","tlshash":"7041b58e9790db7cb11193f86b0aa93833632fd45903c59d87802c96e91581c5d73dcf","first_seen":"2025-07-02T21:10:40.147611Z","last_seen":"2026-08-05T03:53:04.98023Z","times_seen":65,"resource_available":false,"data":null}},"time_used":963,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":963,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hm.baidu.com/hm.gif?hca=748D89D7109A157E\u0026cc=1\u0026ck=1\u0026cl=24-bit\u0026ds=1280x1024\u0026vl=1024\u0026et=0\u0026ja=0\u0026ln=en-us\u0026lo=0\u0026rnd=1183162533\u0026si=f4b3788b2247dd149fb7fdffe8aece79\u0026v=1.3.2\u0026lv=1\u0026sn=55396\u0026r=0\u0026ww=1280\u0026u=https%3A%2F%2Fimtoken.download-zh-cn.com%2F","fqdn":"hm.baidu.com","domain":"baidu.com","tld":"com"},"ip":{"addr":"111.45.11.83","port":443,"asn":9808,"as":"China Mobile Communications Group Co., Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:46.376Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"baidu.com","organization":"Beijing Baidu Netcom Science Technology Co., Ltd"},"issuer":{"commonName":"GlobalSign RSA OV SSL CA 2018","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 09 Jul 2025 07:01:02 GMT","end":"Mon, 10 Aug 2026 07:01:01 GMT"},"fingerprint":{"sha1":"21:BF:66:0D:67:BE:7A:7F:49:48:05:30:F4:7F:09:F2:30:36:CA:63","sha256":"0D:82:2C:9A:90:5A:EF:E9:8F:37:12:C0:E0:26:30:EE:95:33:2C:45:5F:E7:74:5D:F0:8D:BC:79:F4:B0:A1:49"}}},"request":{"raw":"GET /hm.gif?hca=748D89D7109A157E\u0026cc=1\u0026ck=1\u0026cl=24-bit\u0026ds=1280x1024\u0026vl=1024\u0026et=0\u0026ja=0\u0026ln=en-us\u0026lo=0\u0026rnd=1183162533\u0026si=f4b3788b2247dd149fb7fdffe8aece79\u0026v=1.3.2\u0026lv=1\u0026sn=55396\u0026r=0\u0026ww=1280\u0026u=https%3A%2F%2Fimtoken.download-zh-cn.com%2F HTTP/1.1\r\nHost: hm.baidu.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nCache-Control: private, max-age=0, no-cache\r\nContent-Length: 43\r\nContent-Type: image/gif\r\nDate: Tue, 03 Feb 2026 21:55:47 GMT\r\nP3p: CP=\"CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR\"\r\nPragma: no-cache\r\nServer: apache\r\nSet-Cookie: HMACCOUNT=A555558A3A61F9A3; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT\r\nStrict-Transport-Security: max-age=172800\r\nX-Content-Type-Options: nosniff\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":43,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1 x 1","md5":"ad4b0f606e0f8465bc4c4c170b37e1a3","sha1":"50b30fd5f87c85fe5cba2635cb83316ca71250d7","sha256":"cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda","sha512":"ebfe0c0df4bcc167d5cb6ebdd379f9083df62bef63a23818e1c6adf0f64b65467ea58b7cd4d03cf0a1b1a2b07fb7b969bf35f25f1f8538cc65cf3eebdf8a0910","ssdeep":"","tlshash":"15900003fbc08002c2b2e0300b3b0380238ce2200aa8030b80aeb0acecaa3a20c03020","first_seen":"2023-04-05T02:54:03Z","last_seen":"2026-08-17T00:09:16.629576Z","times_seen":377012,"resource_available":true,"data":null}},"time_used":1521,"timings":{"blocked":626,"dns":1,"connect":200,"send":0,"wait":265,"receive":1,"ssl":424},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"beacon-v2.helpscout.net/static/js/vendor.0c72b11a.js","fqdn":"beacon-v2.helpscout.net","domain":"helpscout.net","tld":"net"},"ip":{"addr":"108.157.214.29","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:56:02.469Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.helpscout.net","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Thu, 06 Mar 2025 00:00:00 GMT","end":"Fri, 03 Apr 2026 23:59:59 GMT"},"fingerprint":{"sha1":"13:DB:4C:AE:C2:EF:23:C5:95:76:77:E7:70:21:28:E3:46:E4:F2:1E","sha256":"95:AE:AF:20:4C:C0:EA:E7:FF:CA:03:0F:C4:66:5D:C6:D6:64:20:9E:28:52:44:DB:EB:C1:E2:48:D0:A1:93:CD"}}},"request":{"raw":"GET /static/js/vendor.0c72b11a.js HTTP/1.1\r\nHost: beacon-v2.helpscout.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: application/javascript\r\ncontent-length: 24954\r\nlast-modified: Mon, 26 Jan 2026 16:33:55 GMT\r\nx-amz-server-side-encryption: AES256\r\ncontent-encoding: gzip\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ndate: Tue, 03 Feb 2026 21:28:24 GMT\r\ncache-control: max-age=315360000, s-maxage=7200, public\r\netag: \"a7b8a45d85678ecbd3f6ef21bd952b87\"\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 e2bc8da8a8d03748525187195f797d86.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN56-P1\r\nx-amz-cf-id: TkZ8K1gx7M_LrCoFgVZ74XyGLmbkod6KGvWQzWz2ijfjJ85uPmpENg==\r\nage: 1659\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000\r\nvary: accept-encoding, Origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":69544,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"7be16d9ed5dc8181531357bd0e9f4070","sha1":"ecc2c65a6c3db7948fbff8321a8d7a7d5cb5fd0c","sha256":"0fe0adf6f2a4ea84ddd49a4dd137ec2098a33946427ffa65bfabdbb4f990107b","sha512":"6a662151afb07214ca56077536a407e29e31c28289579b89fb50e3bed5dc38331776569dcc6e16e1536b628028e87916e5e624d6ef4ed7f1ca4e9aaac4096c1e","ssdeep":"768:N77zTT43DLhgmBGQOyMuCX5eLWk+Z0meb9fruMLuPNjOHtNeIviK9+sZkKtBREOe:Nrn8ZgaxkLeFNXwrrilTB9vaNm5ahb","tlshash":"1f63f9e975d1f06153ea20f5407f150bf33a592a784d80e0b224ecea6cb454e96a7fbc","first_seen":"2025-09-18T07:35:52.046276Z","last_seen":"2026-05-21T11:26:26.239851Z","times_seen":1119,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/commons.67bd593aa58696eea502.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.069Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/commons.67bd593aa58696eea502.js.%E4%B8%8B%E8%BD%BD HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 17104\r\nlast-modified: Wed, 24 Dec 2025 06:43:16 GMT\r\netag: \"694b8b84-42d0\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17104,"size_decoded":0,"mime_type":"application/octet-stream","magic":"JavaScript source, ASCII text, with very long lines (17104), with no line terminators","md5":"98c4fb667ef7f5bf6208a2d2f7b393a6","sha1":"895649104eb3e3327398d6f372df516a6f14e2f5","sha256":"9848f488aa8d97d99729efc50708122ced683c15b5b31bae5e885ae16bd1ef7f","sha512":"5b7efc635f6b9fba655b3d7b98d4b0f3d2be2625eddbc3aad5780fc9edb68932ebd3df49c7b87b509db5928721869912300cad1a11b8b034dd10cfe0ad5a0f13","ssdeep":"384:hqEXFft9Q3C8zlDSafL9561DRzHuSrxp0A2W8o1sO2oXD9zs:/1ft9Q3Rzl3TaFzHH0Ho1Zps","tlshash":"44724ecab1c7b1165393f5b4002f150af62f98a5384f89a9e566e5d2bc7884dc037fb8","first_seen":"2025-09-02T09:27:03.846152Z","last_seen":"2026-05-28T07:03:01.222829Z","times_seen":33,"resource_available":true,"data":null}},"time_used":1323,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":988,"receive":335,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/1a46e30aa4e663319e6b6e5a9f6ad18086ba23be.21e0e7f2f40adffeea4e.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.070Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/1a46e30aa4e663319e6b6e5a9f6ad18086ba23be.21e0e7f2f40adffeea4e.js.%E4%B8%8B%E8%BD%BD HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 29238\r\nlast-modified: Wed, 24 Dec 2025 06:43:07 GMT\r\netag: \"694b8b7b-7236\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":29238,"size_decoded":0,"mime_type":"application/octet-stream","magic":"JavaScript source, ASCII text, with very long lines (29238), with no line terminators","md5":"e5da55f4dde64f21878dea30883bb4f9","sha1":"6ee27f80ff98c55839b7d2ea266e91ef1c14b0c2","sha256":"2e22db0edb336ade7ac6b9d7743346806123cbf42095921ce6cc395bccb864f8","sha512":"a3b9c49be1c9f7c669868d89ecb98d9717bb5b4db6cb970cde78b7452cdc37241f6e92a407482d41dc83e2db17090febf0365f9fa316f7bac2a955d6e58a72bc","ssdeep":"768:TlfughpEQ9T+kaEwzdJx+u21CxyNNUtCe:Zdpt+kaEoF+Ng","tlshash":"21d2d7e8b192f0a547e622b4803f120af27b5964a44dc881f376dcd2ad7494f9137f7a","first_seen":"2025-09-02T09:27:03.787752Z","last_seen":"2026-05-28T07:03:01.229068Z","times_seen":33,"resource_available":true,"data":null}},"time_used":1648,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":986,"receive":662,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/swiper.min.css","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.020Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/swiper.min.css HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 24 Dec 2025 06:43:22 GMT\r\nvary: Accept-Encoding\r\netag: W/\"694b8b8a-4d3f\"\r\nexpires: Wed, 04 Feb 2026 09:55:45 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19775,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (19513)","md5":"13e3477e9b99b8653e80def106e569e7","sha1":"34a50a5848aea3d3b6345a2a29fea97d0b48e8c4","sha256":"cbd3907ccf320bf09a971e16978df6d2293228febdbcffd158ce25011a6d68a1","sha512":"54776d5f9ef56af29d4deeef3884c7385bdc0419698694a6c63481b53e17fd4af3c8ba89d95284944b23778cf66810b0ec705e9b757e7c798da15e7957398bcf","ssdeep":"192:dWaNv/lSSyJWCh8zfi5o/mXDN3eBxwdJ5c:dWa1/lS0Cifi5o/mXOGJ5c","tlshash":"5592612c17003057e6334f1a87d99778c724c9939e4358ef6250ee48c7bb96a32af766","first_seen":"2023-04-06T20:39:57Z","last_seen":"2026-08-13T23:12:23.603257Z","times_seen":1704,"resource_available":false,"data":null}},"time_used":334,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":334,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/framework.a0cc4416b9424a5588b2.js.%E4%B8%8B%E8%BD%BD","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.068Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/framework.a0cc4416b9424a5588b2.js.%E4%B8%8B%E8%BD%BD HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 129218\r\nlast-modified: Wed, 24 Dec 2025 06:43:17 GMT\r\netag: \"694b8b85-1f8c2\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":129218,"size_decoded":0,"mime_type":"application/octet-stream","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"f52502ac9007133582fe44e8c7b70136","sha1":"6f017871e79d3b5e08aab7db5080e287fc2212c5","sha256":"275ca0ad51cab700a7c66736740557494b815a03fc464577b9c0fdfaf9c41441","sha512":"cec19cb62a3e74b2d9be8d0049597049d6b0d53754c2d6f24d5d422b59a16998fbb33ecfd5cfe53af0f1437f98056517e44e2a16adae3e1865a1fab6609d01ff","ssdeep":"1536:U4v3hV6X5JRGNeG4XFmkXdKwDSuSdDp7FktuGhR8XvCi0AHlk:nfhV6TZ1YwKt7gRwCi0AHlk","tlshash":"e7c3f8d93992f5626bf311b7109f1813733d161b280c4960a212fddeb9bd05ea12bf9e","first_seen":"2023-09-20T16:39:30Z","last_seen":"2026-08-10T16:24:43.912261Z","times_seen":301,"resource_available":true,"data":null}},"time_used":1666,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":988,"receive":678,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"beacon-v2.helpscout.net/static/js/main.b7bf113c.js","fqdn":"beacon-v2.helpscout.net","domain":"helpscout.net","tld":"net"},"ip":{"addr":"108.157.214.29","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:47.091Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.helpscout.net","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M03","organization":"Amazon"},"validity":{"start":"Thu, 06 Mar 2025 00:00:00 GMT","end":"Fri, 03 Apr 2026 23:59:59 GMT"},"fingerprint":{"sha1":"13:DB:4C:AE:C2:EF:23:C5:95:76:77:E7:70:21:28:E3:46:E4:F2:1E","sha256":"95:AE:AF:20:4C:C0:EA:E7:FF:CA:03:0F:C4:66:5D:C6:D6:64:20:9E:28:52:44:DB:EB:C1:E2:48:D0:A1:93:CD"}}},"request":{"raw":"GET /static/js/main.b7bf113c.js HTTP/1.1\r\nHost: beacon-v2.helpscout.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: application/javascript\r\ncontent-length: 12450\r\nlast-modified: Fri, 19 Dec 2025 12:42:46 GMT\r\nx-amz-server-side-encryption: AES256\r\ncontent-encoding: gzip\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\ndate: Tue, 03 Feb 2026 21:53:01 GMT\r\ncache-control: max-age=315360000, s-maxage=7200, public\r\netag: \"df03b1ca70abc704e186c38df007e887\"\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 e2bc8da8a8d03748525187195f797d86.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN56-P1\r\nx-amz-cf-id: 3beZKWRwvHsOHhSlOtvEx40wjJ0Qjvwgu4egypRBWz9bDPWxmsJP6g==\r\nage: 2581\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: SAMEORIGIN\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000\r\nvary: accept-encoding, Origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":32141,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (32026)","md5":"3484accc83cb4145538452f23086b089","sha1":"6c0f379a81c7270983d79c93423b549775237eb9","sha256":"4a63c402b7403531a5955d3305bd1af363cf805ddc7b5cce3cf0821b9761e3e1","sha512":"a7cdaedb55dc07b80306d6b87873c7fb15051ff19e413c1d7c06d7aa7f460d28424c2dbd4f9e97d294647888bd61f50b23392eb7a8221f7badbd0ee90d41d56b","ssdeep":"768:QAwOGkUUnTxnWmjUju069uBAnRjCVaM8c3XaHf53ZXpMAhcZ7xRcSxdfS:3TxfL1kn3E","tlshash":"6de24ccc35d2b0ed2243eae9177f55d9ab3e3520783a6480bacde0da676258cc153f58","first_seen":"2025-12-19T23:03:06.922666Z","last_seen":"2026-02-03T21:56:12.317924Z","times_seen":86,"resource_available":true,"data":null}},"time_used":59,"timings":{"blocked":17,"dns":1,"connect":9,"send":0,"wait":14,"receive":1,"ssl":15},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/github.svg","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.114Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/github.svg HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 696\r\nlast-modified: Wed, 24 Dec 2025 06:43:17 GMT\r\netag: \"694b8b85-2b8\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":696,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4149501d6f5d8ca92ce457bf972ddd58","sha1":"914af4392becba78bf750a49b9bf2cdf50d3bbb4","sha256":"77932b8662117bf991a79571d25775103f60a7625edfe9d7151a880144332e0b","sha512":"cb22ae17f8af457b86808495f50f875ad060f9f6941759760788efbccaada24ce42a5fcf05e46cff7b94f44e3b36d96072f3934bc3b2902d39155fca5ca56b43","ssdeep":"","tlshash":"b2017bac63e073606d46d76cd0a974b0b28734b72fa9c5a4e145e843a1158dfa8d8910","first_seen":"2023-05-10T10:24:22Z","last_seen":"2026-08-10T16:24:43.899634Z","times_seen":1182,"resource_available":false,"data":null}},"time_used":2272,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":951,"receive":1321,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/globe.svg","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:45.117Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/globe.svg HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:45 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 693\r\nlast-modified: Wed, 24 Dec 2025 06:43:17 GMT\r\netag: \"694b8b85-2b5\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":693,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"10e9b7298119a70fcdb7ce6ed5430f6e","sha1":"942e41acc75f1fd1ec6b33dd2cb21b29126c6bff","sha256":"f55d4b245d10bad8715a66b9fc5461f23ecf2902bdf1c8ff7c6d04b41e0afea5","sha512":"82e217f7306036f635c6d7af212da66acd33a4547ecd6f91d10555532097627f02e8a707771e809282d7922b3119b7eaaef9b7a04b85f94de3be6a8776997c6e","ssdeep":"","tlshash":"9d012b59b36dce3d78631764d31232b660e7125309487395d432d1346990c5e6b77dcc","first_seen":"2023-05-07T16:57:14Z","last_seen":"2026-08-10T16:24:43.923977Z","times_seen":1034,"resource_available":false,"data":null}},"time_used":2269,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":949,"receive":1320,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"imtoken.download-zh-cn.com/index_files/484c840239a025432effd6ecc373d498fa764368_CSS.9a8fc300.chunk.css","fqdn":"imtoken.download-zh-cn.com","domain":"download-zh-cn.com","tld":"com"},"ip":{"addr":"18.162.53.8","port":443,"asn":16509,"as":"AMAZON-02","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:47.489Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"imtoken.hk","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sun, 28 Dec 2025 17:02:15 GMT","end":"Sat, 28 Mar 2026 17:02:14 GMT"},"fingerprint":{"sha1":"05:B0:4F:AC:68:8A:5A:24:24:AC:4F:FB:8C:DF:44:C5:41:4E:E3:EF","sha256":"CC:B8:F8:B8:1A:C7:FF:4C:92:61:91:B9:3D:BB:31:8F:A1:0D:41:21:4C:8B:E4:EC:A3:BA:A5:9E:FE:90:F4:06"}}},"request":{"raw":"GET /index_files/484c840239a025432effd6ecc373d498fa764368_CSS.9a8fc300.chunk.css HTTP/1.1\r\nHost: imtoken.download-zh-cn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://imtoken.download-zh-cn.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: Hm_lvt_f4b3788b2247dd149fb7fdffe8aece79=1770155746; Hm_lpvt_f4b3788b2247dd149fb7fdffe8aece79=1770155746; HMACCOUNT=748D89D7109A157E; _ga=GA1.2.272943273.1770155747; _gid=GA1.2.1584147989.1770155747\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 03 Feb 2026 21:55:47 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 24 Dec 2025 06:43:11 GMT\r\nvary: Accept-Encoding\r\netag: W/\"694b8b7f-1a344\"\r\nexpires: Wed, 04 Feb 2026 09:55:47 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":107332,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"09820633dbc0da351f54b3c0ebe944ef","sha1":"9ddb9a24d4b422e127497f6ea9de9b8eb911e7bf","sha256":"a8d75286367eeeda2e353fd4025bd5ad53f5a064750682fa7bd583c97a1d0858","sha512":"06435063826c8e9ccd18235a9648cd2aad49530dc69f6e2df0abce23d5b2fda08f9bb99dc27c2b4db9b9c8e1ff7f4b894890950acc6f1b52a528a897caa1ca42","ssdeep":"768:AYFqnl00UyYSqRC64crouEuDjpAsEGX0OwD2qktAo+o34kuL0esE2oualBX46WoR:NFqnl0NyYSqANqSrEg","tlshash":"58a3792a3b6205096231dba977c57b556234e113a16efca7fafd7c00ef46d4688c2e07","first_seen":"2025-10-04T00:21:30.853604Z","last_seen":"2026-05-28T07:03:01.245342Z","times_seen":31,"resource_available":false,"data":null}},"time_used":339,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":339,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-03","alert":"Sinkholed","trigger":"imtoken.download-zh-cn.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-03","alert":"Phishing Block","trigger":"imtoken.download-zh-cn.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"token.im/img/favicon-16x16.png","fqdn":"token.im","domain":"token.im","tld":"im"},"ip":{"addr":"104.20.45.246","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://imtoken.download-zh-cn.com/","date":"2026-02-03T21:55:47.929Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.token.im","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Fri, 06 Jun 2025 00:00:00 GMT","end":"Mon, 08 Jun 2026 23:59:59 GMT"},"fingerprint":{"sha1":"CD:6A:97:52:4E:A8:46:CE:4F:1D:42:72:6D:C1:19:46:04:DD:E7:0E","sha256":"54:95:F0:AB:F3:83:AB:3A:88:D5:EA:82:AD:9E:2E:8B:05:68:CD:B5:B7:F3:38:F0:F9:18:27:39:5D:38:08:1C"}}},"request":{"raw":"GET /img/favicon-16x16.png HTTP/1.1\r\nHost: token.im\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://imtoken.download-zh-cn.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 03 Feb 2026 21:55:47 GMT\r\ncontent-type: image/png\r\ncontent-length: 564\r\nlast-modified: Wed, 31 Dec 2025 07:05:53 GMT\r\ncache-control: max-age=31536\r\nx-frame-options: SAMEORIGIN\r\nx-from: gke-prod\r\nx-xss-protection: 1; mode=block\r\nx-geoip-city-country-code: NO\r\nx-geoip-city-country-name: Norway\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nvia: 1.1 google\r\nage: 165\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nserver: cloudflare\r\ncf-ray: 9c852cb0d85f23eb-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":564,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced","md5":"a9e72fde9756f0477fbdfce7b2725020","sha1":"cb8208cd7824a287db8d97e8750cd0b0c7b9704c","sha256":"d292c48434ad9c30f4220e220c5cb53f8221acdf0e93e59de5659f7b4e735af6","sha512":"507bfabd7f58d15d72b68a73565f019da129aa5f2d6e4ddd650dc41401bf844ac6ba402dfe020c5e60ba3174ab1c5a676149434a49d481d4b5798225c831e9b6","ssdeep":"","tlshash":"cdf096cae6286d7a2758900a69360770fc370b9344c151be01e43321f53ac316a8b8bc","first_seen":"2024-04-19T06:46:35Z","last_seen":"2026-08-13T23:12:23.599504Z","times_seen":842,"resource_available":false,"data":null}},"time_used":56,"timings":{"blocked":0,"dns":29,"connect":1,"send":0,"wait":8,"receive":1,"ssl":16},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}