{"report_id":"2a15f36b-501f-447b-8a58-d73dc61d8cb8","version":6,"status":"done","tags":[],"date":"2025-10-17T18:38:53Z","url":{"schema":"http","addr":"metmask.cn","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":0,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"metmask.cn/","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"title":"小狐狸钱包MetaMask下载 | 去中心化Web3数字钱包管理ETH与NFT"},"submit":{"url":{"schema":"http","addr":"metmask.cn","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":0,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-11-21T18:38:53Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":5}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"metmask.cn","ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"domain_registered":"2025-09-25","domain_rank":0,"first_seen":"2025-10-17T18:38:54.118583Z","last_seen":"2025-10-17T18:38:54.118583Z","alert_count":135,"request_count":27,"received_data":814009,"sent_data":14018,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Elementor:3.30.0","description":"Elementor is a website builder platform for professionals on WordPress.","website":"https://elementor.com","common_platform_enumeration":"","icon":"Elementor.svg","categories":["Page builders","WordPress plugins"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"jQuery Migrate:3.4.1","description":"Query Migrate is a javascript library that allows you to preserve the compatibility of your jQuery code developed for versions of jQuery older than 1.9.","website":"https://github.com/jquery/jquery-migrate","common_platform_enumeration":"","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"WordPress:6.8.3","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"metmask.cn/","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"1c3423f0239f6e476e27cc4f5a8b0b97","sha1":"60a3ba1b50da6172dfa2186c454b4f4b1a5aab52","sha256":"e8c743e07a9547da9ffef87768ee9f602b738cbd56d7405371ef55d17a4ab710","sha512":"5fbcbb54e928520c0b5022afc6bb0fd23ddb2f936acb4d4572ca3df4b10d63193fe66bcc96656929941eb15ebc16f78497e1d55d75b2cd2dd58c203643baf55f","ssdeep":"","tlshash":"6661a89a3775348b32b604d26a2f0e07fb7258361ac89034cab5a7141cb1463d37ae5a","size":3227,"data":"","first_seen":"2025-10-17T18:38:59.223858Z","last_seen":"2025-10-17T18:38:59.223858Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-includes/js/jquery/ui/core.min.js?ver=1.13.3","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"da215ae12b95b3aeeb2047667016c7f8","sha1":"480a7087aa74b5b47c47f05a11670e823a3ae4c0","sha256":"699210a5ed06e497b4730ec83bb65ac4c2269ae4a0ee8af3f24aae7ee5b66b76","sha512":"d256ddc828c06f7b84f7df706a4481928a186ea6d3e1358254a1ec02f403d72d2f3aecd682a93aad61b8f236f17dbcf7e6ca100f78c30a348682bf8ee125d8ff","ssdeep":"384:G/rsrDr8LVyraS3dtrqorqr8hrpCip8fuxNhlGX0CiS9rH/OrLrErJ29FkFvd:iS33ZdvK47kv","tlshash":"06a2d94eb246380586f7a2a5402f521fb132e25cb105c8ddf468d8da3c7eea95173f79","size":21464,"data":"","first_seen":"2025-04-15T23:53:17.313193Z","last_seen":"2026-07-22T02:26:11.638251Z","times_seen":330265,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"9ffeb32e2d9efbf8f70caabded242267","sha1":"3ad0c10e501ac2a9bfa18f9cd7e700219b378738","sha256":"5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89","sha512":"8d6be545508a1c38278b8ad780c3758ae48a25e4e12eee443375aa56031d9b356f8c90f22d4f251140fa3f65603af40523165e33cae2e2d62fc78ec106e3d731","ssdeep":"192:5rprDN+sag6ifKIUpQI99P1tLm9kdgyq1+J3aCJQ+h4MPLORq:5rprxaefKI0LP19m4q1WW+h4Mjp","tlshash":"9952c8adb56679724eb721b8f03bd24f71b205de560d8940d19cc4f6282dc6e812bf78","size":13577,"data":"","first_seen":"2023-05-09T19:21:05Z","last_seen":"2026-07-22T02:24:26.753275Z","times_seen":902865,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.30.0","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"73e6268e40f25a368f5c33686a04d2de","sha1":"07489633018938fb540257bfd3cfae7a9eb4b31e","sha256":"fba296b9000eec2841886bedffeb28ad180b3dde4ebbc36cff18473817f7bc27","sha512":"e89c5f58290ffed88ee76d20652545fb46ec02b7f7b36bf64eb66e63fff1253b7fb01e476933fe260cf4ebd1b9b6016571646abe4ca1276e4559274557c36471","ssdeep":"384:Mxpy+EVxFm6cKJskdHd7taQtHuGJswg/i+pQDTWmMo7YtDTVHJiMqkoh+vFWN7KS:Mxw+EVxFm6cKikdHd7taQtHuGJswg/D2","tlshash":"36b2d9053163ac7a50cf815be467420e77378894740570ed7abc6cdba5b8e9a33ea339","size":24210,"data":"","first_seen":"2025-07-01T13:44:05.628087Z","last_seen":"2026-07-21T23:16:47.834401Z","times_seen":5343,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.30.0","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"c400c47a24a3f50b62697df124e66a6d","sha1":"395ade2e64e8724da21b3b34b50f41aff6b6eec1","sha256":"651f8fb1dc50b25c5dc8305eeada26b8ec66c806cb0511ae0fb44a620693b809","sha512":"fd2c2d3f88f6de849f16e60e7a9a24a2094022c71ada4e09c3a696346e2a2f64a941423a96ecfd2e109eb213ddea89341c0567a23b2c4ada285d6e31ff793726","ssdeep":"96:BuAtsNvDdfzjqj3Ntxl8O7AEQQ1vg+lsmejl3i7wVjLUVsc+2KBbZ7Qah88/2:1sNpzjq3TNQWg+smeMs5QTY1V/2","tlshash":"e6c163d41a94fc2b22e135d8e11ba734662fc0337c16f9c1fa21dce955e8ed183aa572","size":5700,"data":"","first_seen":"2025-07-01T11:14:42.178297Z","last_seen":"2026-07-21T18:38:59.100014Z","times_seen":2127,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"6e434b0b4f43ec7216073eed1f3ffb51","sha1":"8d8a4ab1ed63889095bdf38ba646319b639feabc","sha256":"dd0ec57abf154d52c161fae92db6014f042417d9660679097ae55287041ec52e","sha512":"20978b9f1afc586c91351ef67791224fb5469004a1ebb5af608a05f643103a358e605d2c54cdba2174bc35c266ec963690d5d1fc3f80a045f4c33fc5f67b9ab7","ssdeep":"","tlshash":"6d110cf3b3dd907fbaae6d66193402cd6a1c90735c100a5bfeac3575cc8042538b1d40","size":922,"data":"","first_seen":"2024-04-08T18:49:14Z","last_seen":"2026-07-22T01:46:20.899246Z","times_seen":217860,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-includes/js/jquery/jquery.min.js?ver=3.7.1","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"826eb77e86b02ab7724fe3d0141ff87c","sha1":"79cd3587d565afe290076a8d36c31c305a573d18","sha256":"cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf","sha512":"fc79fdb76763025dc39fac045a215ff155ef2f492a0e9640079d6f089fa6218af2b3ab7c6eaf636827dee9294e6939a95ab24554e870c976679c25567ad6374c","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKO:sHNwcv9VBQpLl88SMBQ47GKO","tlshash":"7483f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","size":87553,"data":"","first_seen":"2023-11-03T09:26:43Z","last_seen":"2026-07-22T02:24:26.758506Z","times_seen":984233,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"fa75b397dd3e2234a0e2860ecea9ea5d","sha1":"e73f548edd98b1f37d16cf1a9fe5ada86ef6092c","sha256":"a4b595bb2c5f7cab0f060a8cf2cef4081f7a794da77b3341110107aa9e5e901b","sha512":"38a453bb9f76bf47665cf92c432edb5cb37eb1f12c5176bbd47d0b2b6460b127159b5ee38c84b75d09698e6c26f39b57861e03b334c1ea541c5d55b22af970fe","ssdeep":"","tlshash":"0dc0121002821d0176db9d5290118e94b0fd81a1d1d4f49d697c451863d7a1e1a59108","size":184,"data":"","first_seen":"2025-04-15T12:46:58.983513Z","last_seen":"2026-07-10T15:34:34.895135Z","times_seen":6361,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"119d3c37569ebf628d0b902ef2483b93","sha1":"216fe489e7d40a88b3d66dd12053cd367cc9c1ac","sha256":"f99c4ad83a707470f497d593aceb6e5204637f7107e5bf8e0f5234ebd5467cf1","sha512":"8e3ae5a31f3828f1c528fd26a7c3b29d2724e2d88a315139ecb7dff7ff4de4f3bd6d31278ac71a665fce1f884a27a343ef8e51a4886297da971135bbe6137354","ssdeep":"","tlshash":"ef5165ac6b494a3a42e3d760fc16bf1b29dd0e301091adf6a4fc096437b26692742e57","size":3003,"data":"","first_seen":"2025-10-17T18:38:59.231143Z","last_seen":"2025-10-17T18:38:59.231143Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-content/plugins/elementor/assets/js/shared-frontend-handlers.30dc2f9c080845a413a6.bundle.min.js","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"c407c4762fe3950a128ff09b046d2a35","sha1":"0e009b56a7eb912c233e775ad7081d208897db97","sha256":"ace6b22b454bd935998d953ce7545201b67372883b2baf62bb955ca0e10f3d6d","sha512":"0d95a3afb72c4ac6b08e84a0eb4f8b5b2c1be67713148390a0bd56506129a6676ab3d4f24411476b7083ac46ca37c3f8d979ce3dd29a59faf2b468bc6e9b2b82","ssdeep":"192:pwfFpzqxODoWV5KxZmdXLf+UvDZ5CMtakRhPZTxcMkCwB410QsFfpRHvcwxDnPoj:yHzqxORV5KxodXLfpvD/NtakRhPZTxcg","tlshash":"9102210a74c1942db58b58ba3532432c66a8014de1018f6eb1bf79fbc5a6d82377b7f1","size":8541,"data":"","first_seen":"2025-07-01T11:14:42.266317Z","last_seen":"2026-07-21T09:16:38.867631Z","times_seen":2289,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-includes/js/wp-emoji-release.min.js?ver=6.8.3","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"c4b50535f3e989a77d537d5486342d47","sha1":"2a1cc988298c022def9376bd54f608f44154071a","sha256":"db8ee8be2b2456c191fc0739f34f6ac675af8ba4782380cf233024498e0eb968","sha512":"be3b974332c4dadc30025aa911fde008442c9f4966ade014a7b8f05926688e30b9fdc32ebdbdd53fe32fc3f4d9c6ac2310b98dc6602843f2d8f00b1ded4e9b83","ssdeep":"384:WAevzW+ZTbXUH3o//bEPhXgA5H1efAJmpr:WF6UXUH3o//YpXgAGfACr","tlshash":"d782fa9bb33a4e8f343e3bd7cd968f4dc9da555321c0e078dbeeb68169a00568274c90","size":19251,"data":"","first_seen":"2025-05-09T23:23:48.206606Z","last_seen":"2026-07-22T02:05:19.470153Z","times_seen":211275,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-includes/js/dist/hooks.min.js?ver=4d63a3d491d11ffd8ac6","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"c6fddbb6be69793478de26fc245b2acf","sha1":"a136ebf5054fdc19729b3592005fe0fefec4bb4c","sha256":"9a1e0d38b691f1d22a92cff65ec0439b428170ac39a4493c7ecb06d5585f56a3","sha512":"8a766304caa9c888cfcab64eabab906905965e7fbcfc4f79c74ab122b892456abad215d0883df17023a16a18ba15a6a4b3d0fa5345cab7173d778f725b827c33","ssdeep":"96:vmK40IdSs6c7DE/3sc/YrEBnUBPwKxbqe/Ds91sBYt1Em4kCofWQRemN:OK40IdS/cHg3NZBnUJbqe/DeGYtu7kC6","tlshash":"b4a161c47482b870a2237457e0bb1485757eabb5743990c5a24dd8a02db3dcfe0a7a3e","size":4776,"data":"","first_seen":"2024-11-13T05:08:51.627546Z","last_seen":"2026-07-22T02:19:55.90901Z","times_seen":229245,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"d30f13da1f424ee0383b76edc55881e1","sha1":"7e348a5f57ab13eedbc4ed917cdeee5bb9f9bd46","sha256":"cf01a621447e67a81629bc28276677c86c48fd72c44cba83a82448574aadfd60","sha512":"06571ea850a1ff105d50dd65340b1109e07dba2915279d549f0880e161c5487e0462e63f5bcf3daa1feb9ebd6fc00f84d552fb806f5f5405ebac203f097b89b8","ssdeep":"","tlshash":"daa0244530471400c04dc1504d13fc00041010c7034fc50435d05d30d550440744331f","size":68,"data":"","first_seen":"2023-03-07T01:02:08Z","last_seen":"2026-07-21T17:34:31.117811Z","times_seen":118746,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"69d2bb8d3b1da0327b291bd0df862167","sha1":"cb34f35b89b2154b8f27ccb89a1497e871cf7be0","sha256":"7bbc60c6878f9fe894f8ca219183ccfcacd9715c31bc33bd58bdaab2cceffbe6","sha512":"3e91aa74a70331f12dc31a4a86ca9405471824af52b5680df8df86ddc4f92f3dea477c31cc66e80a63eaf3d877990215c4dc537d6ebf0d0cb5f051e54990d84b","ssdeep":"","tlshash":"f9219d661e225f2457afa7d871ca3e6f48c0073226d8790d1699e07401fbcddf4692e3","size":1287,"data":"","first_seen":"2025-10-17T18:38:59.236193Z","last_seen":"2025-10-17T18:38:59.236193Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-includes/js/dist/i18n.min.js?ver=5e580eb46a90c2b997e6","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"a8127c1a87bb4f99edbeec7c37311dcd","sha1":"9997a1745f48bdd233dbe9bd8164daa53eba105b","sha256":"f313d12ea6124bd28fc4a6b7163d253bb83d5aeab5edce594880c5c3df475cbc","sha512":"aa10ddc5b29905c60a058faed3f5f195f7577ceac46489e02461b5135732194daa3aef4aa473127bf8c753312e02074cfdac8d0f8f0cc8aa544c7f8e02bebd08","ssdeep":"192:s6zoFrnW4iaX3LzDk1jpJLB2hlq717+3uClD2tFtJ7bykd+SHS+F:s6Udn3LzoJphH8uClD2tFtJ7byTwtF","tlshash":"8612d8ac30deb021239a11e1586fb101f13aaf6532d99ce0da81d9e57db19c960b3ff5","size":9141,"data":"","first_seen":"2024-04-03T08:25:07Z","last_seen":"2026-07-22T02:19:55.889118Z","times_seen":259960,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-content/themes/astra/assets/js/minified/frontend.min.js?ver=4.11.11","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"e3f1d8b0c43863983d30808c8c80350d","sha1":"9986ae27aecfad88862a45d6e9c6deb7157985ba","sha256":"f4d505dfa966359e750416d214a3a4bc047f71e33c1b1c9147ec1b6b26269c07","sha512":"f0314c9f678705e69dac0c6beacdde23cbae9cb971ce277d408a2a5316ab08a34bf707c507e44cdee816c8a27c65afb00644e341e35e79e2d8762997bc595119","ssdeep":"768:uYEPx6KoYcFDTHjkkoKoCo9or62RcjC5LltbmxPE22Ve3rTX6VzSD0tIzQ6IFNd1:uYEPx6V4c62Rcj6lBmxPEyydSLWNdi1e","tlshash":"91b261a663102a3604fe17e7f5daabc57671109ffa0944111838cc6e19a8fd352f1afa","size":25570,"data":"","first_seen":"2025-09-09T21:36:58.056268Z","last_seen":"2026-07-20T07:11:58.996776Z","times_seen":494,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"3688fd64c409264431201fa55a828e81","sha1":"2b7eeefaa1edf3a7621f7576b35b01c895ef5367","sha256":"944433761a880eab1d567dd5389499af76aa03582c82a8aa88838e3c6c2134c6","sha512":"1393fe2f189899d68717be994820d19a7e89660ea5cd90cf4a2d3dd07b41c95c2f63a3a0833d2407f16be6a3eae698ab549eac52d4ffc82bcd2da0e4e46da210","ssdeep":"","tlshash":"bae026faea5a457101e6a1237bce739e293665a3a92a4c402899ce806838dd31126ed1","size":333,"data":"","first_seen":"2023-03-07T01:02:35Z","last_seen":"2026-07-22T01:46:20.919026Z","times_seen":39247,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-content/plugins/elementor/assets/js/text-editor.c084ef86600b6f11690d.bundle.min.js","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"7bf3fb3cf9fb79daa8f22cd84e95e6c8","sha1":"138ec26efeeee1ae778eba800b72df2fe9b552b2","sha256":"61bf0b30ad24aa67df24a80081753673bb902b7f44c00ece1c98995b48d88f71","sha512":"cca8fba740a031dac6b377147b895d85a7e9b8b2d5651bb1a187210b2235a0331e46a0c77f71778a5df6bb391a9cdda5b7ac1747cadb0a95b0f034764d2987e8","ssdeep":"","tlshash":"1b2103f370a398ed48cf148a34522d16f1570c6cb885a01ef5aa08db34b1e853362234","size":1394,"data":"","first_seen":"2025-07-01T11:14:42.294099Z","last_seen":"2026-07-14T15:00:19.385119Z","times_seen":1904,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.30.0","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"1ebaf1cc1b18bc887fa7051a87661528","sha1":"9474a195e519406755eaa7d0031cde89d32bff69","sha256":"fef2b61a3cd99eca5aadbef80053fd13da4ed92d0b20c3fd44c5ecc513639f16","sha512":"3d7c0b4f417b1df0c7f2dcdd44f9594f945f7beae6bd0b2a8b224fa2912b4827a50f4b4c48426dad51742532e6bc41f28f0500b6fe355db770edfdf1bb973a88","ssdeep":"96:BUdxwrudY4kjboFkEO/HfOYr+WY4N53hsstJQPCl2e/VtFVKdpYQGK0Vz38k2:qTXd4jboFemC9N537MPa/pMdOQ8Mk2","tlshash":"05d1569805489d2b26e43bd8b15b6b741b3dd0323c59da81e611eddc18fcfd187ea532","size":6248,"data":"","first_seen":"2025-07-01T13:44:05.655946Z","last_seen":"2026-07-21T23:16:47.830246Z","times_seen":5317,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=3.30.0","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"a37940dc99419ca40387ad0b287f2c74","sha1":"b3204a2af7db39d14f84f80477c12808dc61ee3d","sha256":"77b5ec1d89bb1e10da9f4968bd413c8b262224273cba7a65b1009cdfc4a1d32c","sha512":"3fd360e77a6156ac6e527b33447ecd1044584101cf4b1100a02e4554bbe3a20d678d77a390dd91fe3d733cd3c8f13fd03e493f13bbf134256e1eb25cc58706c7","ssdeep":"768:C/bt9JJD1+WE9A5yLce/J9d0dbdTdGdadWdDdILdUd1dvd6dfdMdxdndTdVdFg7b:0t5D1+WE9A5yLcWJ9mBtIoERuWfRMBKC","tlshash":"4813a511716aca6945cf84abf463164fb7325cacf413f0e67afc8d82a464e87a394731","size":44708,"data":"","first_seen":"2025-07-01T13:44:05.620033Z","last_seen":"2026-07-21T23:16:47.86238Z","times_seen":5328,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.30.0","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"f4148790a48f0d12980fb3e18f97a896","sha1":"2d19ea6f6ec1b5185fe8e4e3e43adcbfc07a0888","sha256":"65d0e0ca37549887c595b803a2adbfeccfad67e22113a0670059e48040f25f9c","sha512":"8c993438543a7fbafed2e3d4360a56b5667850e9b0dbf00bbb0af08a5fcc68b5e06cf60e54eca3d41f2880ad2f1b348327245bbe67a0e60251579f6a80bb518b","ssdeep":"768:IRdRMtJR8RjDKv//DQl5ZnfVgbpM+MpKEAzBc5GlTSeUsveOBNU5aG9g3fWLJhoh:IRdCtJR8RjD8/0fVliEAzBc5UTSeUsGa","tlshash":"7ae209527296d4a2069f48a3f0331119f3765dd9b80af0d8b2acdce1a475f877361b35","size":32876,"data":"","first_seen":"2025-07-01T11:14:42.29251Z","last_seen":"2026-07-21T18:38:59.086433Z","times_seen":2151,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.30.0","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"a1e0bdd58e67fd109881cec93226a030","sha1":"4b3d7211554daa7c604d9a977bf5cf1092b21494","sha256":"533076a2f66a4501d1d25ccadb8f227d978c19c4c099d60b8c67117ede1d809a","sha512":"c22ddbe2f723c21e7c60b5e7b7e7b8afd56b6fef66ff268b7547e0ceb98b9bfa02f4e44e12e5b27d9d17dc6406800cb09e41d34284d49207401b3ba70b438055","ssdeep":"768:leAjA6wk9C+QioJHYNQAzeLHeBHmjkSK7+z1hlN14cR8+AvNKRiA8m6XS3gzlAIT:leAjA6f9C+QiSYNQAzeLHeBHmjkOzRNM","tlshash":"8823c7853652f4f70beb40daa02f450af25619a8640df4d4bfe9dce19470d8e237ab74","size":48393,"data":"","first_seen":"2025-07-01T11:14:42.30803Z","last_seen":"2026-07-21T18:38:59.132954Z","times_seen":2122,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"metmask.cn/wp-content/uploads/elementor/css/post-13.css?ver=1759309535","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metmask.cn/","date":"2025-10-17T18:38:34.543Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metmask.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 16:41:37 GMT","end":"Thu, 25 Dec 2025 16:41:36 GMT"},"fingerprint":{"sha1":"A9:BC:DC:E6:20:DD:88:D9:E5:DA:4B:32:C6:90:CB:1E:CA:C5:6D:2D","sha256":"1D:A4:4A:56:3B:56:97:87:92:96:62:E3:DB:A6:24:AC:55:C1:FE:AF:F0:C4:66:B0:6A:30:15:70:02:61:DD:C8"}}},"request":{"raw":"GET /wp-content/uploads/elementor/css/post-13.css?ver=1759309535 HTTP/1.1\r\nHost: metmask.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metmask.cn/\r\nCookie: SITE_TOTAL_ID=b4c7a9e2b691447a863f40853ebd2f90\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 18:38:34 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 01 Oct 2025 09:05:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68dceedf-4cf\"\r\nexpires: Sat, 18 Oct 2025 06:38:34 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1231,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1231), with no line terminators","md5":"8ee042840085e931d9a4e976aedce0e3","sha1":"9e5d6911914eacbb3a21d4204959dcf1a2106c5f","sha256":"733f5542043f6cdabbdb1d467110c67916b64724a7172ec45b4eaf9ce00cfe9f","sha512":"531addb11a21db774c2b51351251ba81c1598b8fa5ad9f9859d0b42d10a7b47211066db9694bf89a8e16f4f2b8ba73186e3dae8f22d57dd883f14b447cb147f2","ssdeep":"","tlshash":"7f2124457a23d432e07b093f91d3b02c102cd45fa25f8edff81d9649f9bea4a2228643","first_seen":"2025-10-09T06:18:52.877395Z","last_seen":"2026-07-06T23:50:17.289996Z","times_seen":27,"resource_available":false,"data":null}},"time_used":329,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-content/uploads/2025/09/phone.png","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://metmask.cn/","date":"2025-10-17T18:38:34.561Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metmask.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 16:41:37 GMT","end":"Thu, 25 Dec 2025 16:41:36 GMT"},"fingerprint":{"sha1":"A9:BC:DC:E6:20:DD:88:D9:E5:DA:4B:32:C6:90:CB:1E:CA:C5:6D:2D","sha256":"1D:A4:4A:56:3B:56:97:87:92:96:62:E3:DB:A6:24:AC:55:C1:FE:AF:F0:C4:66:B0:6A:30:15:70:02:61:DD:C8"}}},"request":{"raw":"GET /wp-content/uploads/2025/09/phone.png HTTP/1.1\r\nHost: metmask.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metmask.cn/\r\nCookie: SITE_TOTAL_ID=b4c7a9e2b691447a863f40853ebd2f90\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 18:38:34 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 26 Sep 2025 17:50:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d6d254-1a0eb\"\r\nexpires: Sun, 16 Nov 2025 18:38:34 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":106731,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 794 x 643, 8-bit/color RGBA, non-interlaced","md5":"3b234811b50ee1d10213d2671e2644fe","sha1":"4a8281ff914b46c8d28b9b3cf9bdb40bb64b09df","sha256":"49eb9b4bf699e23178547edb75aac36608c865e4c82fb14b16a014665a60284d","sha512":"49316afe95c63cf4f4502893939a1f603ac1f5542bd7ed6587f39c7aaed34e334a1a0a5e01981cbca4ccefe044bb4fed01383823f9e05ac6dd8d2a1906682f4c","ssdeep":"3072:b25051LmuX+v2vzNheO6SwPDuAe00Z/ZTr7:S+rLmT2vzW3KXXr7","tlshash":"78a3022706cb8fa5c59935369ac6b25b4303c495d73f0e3c3e4ad50ad049a3abb6a137","first_seen":"2025-06-10T17:13:57.781359Z","last_seen":"2026-06-29T07:55:53.859453Z","times_seen":52,"resource_available":false,"data":null}},"time_used":649,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":649,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-includes/js/dist/hooks.min.js?ver=4d63a3d491d11ffd8ac6","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metmask.cn/","date":"2025-10-17T18:38:34.623Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metmask.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 16:41:37 GMT","end":"Thu, 25 Dec 2025 16:41:36 GMT"},"fingerprint":{"sha1":"A9:BC:DC:E6:20:DD:88:D9:E5:DA:4B:32:C6:90:CB:1E:CA:C5:6D:2D","sha256":"1D:A4:4A:56:3B:56:97:87:92:96:62:E3:DB:A6:24:AC:55:C1:FE:AF:F0:C4:66:B0:6A:30:15:70:02:61:DD:C8"}}},"request":{"raw":"GET /wp-includes/js/dist/hooks.min.js?ver=4d63a3d491d11ffd8ac6 HTTP/1.1\r\nHost: metmask.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metmask.cn/\r\nCookie: SITE_TOTAL_ID=b4c7a9e2b691447a863f40853ebd2f90\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 18:38:35 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 26 Sep 2025 17:39:34 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d6cfd6-12a8\"\r\nexpires: Sat, 18 Oct 2025 06:38:35 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4776,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (4741)","md5":"c6fddbb6be69793478de26fc245b2acf","sha1":"a136ebf5054fdc19729b3592005fe0fefec4bb4c","sha256":"9a1e0d38b691f1d22a92cff65ec0439b428170ac39a4493c7ecb06d5585f56a3","sha512":"8a766304caa9c888cfcab64eabab906905965e7fbcfc4f79c74ab122b892456abad215d0883df17023a16a18ba15a6a4b3d0fa5345cab7173d778f725b827c33","ssdeep":"96:vmK40IdSs6c7DE/3sc/YrEBnUBPwKxbqe/Ds91sBYt1Em4kCofWQRemN:OK40IdS/cHg3NZBnUJbqe/DeGYtu7kC6","tlshash":"b4a161c47482b870a2237457e0bb1485757eabb5743990c5a24dd8a02db3dcfe0a7a3e","first_seen":"2024-11-13T05:08:51.627546Z","last_seen":"2026-07-22T02:19:55.90901Z","times_seen":229245,"resource_available":true,"data":null}},"time_used":645,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":645,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-17T18:38:31.453Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metmask.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 16:41:37 GMT","end":"Thu, 25 Dec 2025 16:41:36 GMT"},"fingerprint":{"sha1":"A9:BC:DC:E6:20:DD:88:D9:E5:DA:4B:32:C6:90:CB:1E:CA:C5:6D:2D","sha256":"1D:A4:4A:56:3B:56:97:87:92:96:62:E3:DB:A6:24:AC:55:C1:FE:AF:F0:C4:66:B0:6A:30:15:70:02:61:DD:C8"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: metmask.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 18:38:33 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nlink: \u003chttps://metmask.cn/index.php?rest_route=/\u003e; rel=\"https://api.w.org/\", \u003chttps://metmask.cn/index.php?rest_route=/wp/v2/pages/10\u003e; rel=\"alternate\"; title=\"JSON\"; type=\"application/json\", \u003chttps://metmask.cn/\u003e; rel=shortlink\r\nset-cookie: SITE_TOTAL_ID=b4c7a9e2b691447a863f40853ebd2f90; Path=/; Max-Age=259200000; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Elementor:3.30.0","description":"Elementor is a website builder platform for professionals on WordPress.","website":"https://elementor.com","common_platform_enumeration":"","icon":"Elementor.svg","categories":["Page builders","WordPress plugins"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"jQuery Migrate:3.4.1","description":"Query Migrate is a javascript library that allows you to preserve the compatibility of your jQuery code developed for versions of jQuery older than 1.9.","website":"https://github.com/jquery/jquery-migrate","common_platform_enumeration":"","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"WordPress:6.8.3","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]}],"data":{"size":142985,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (54355)","md5":"5f3c2a339bd789892f30c9f4c93a8878","sha1":"6ba4eed346896e72814565325e0affec240ba25b","sha256":"3d2eeb7d909f12a464146e4bcbb8ddf4d7130b03069910db503e221b88fc13e4","sha512":"f3a415ae9ab9e09bca76bd86e1ca2f9a70d3a784b7c449e66ebb2ffda96ea69d1210c0ccebe180b81b6dc63cea9f2b175097fa685a4b21d8447f9468e8d26239","ssdeep":"1536:MEmnAlnKWoE+5VuHfhJiTCmapn1mRTRVnph6vZ+VjWy+qjOvGabIyQP/pnaaT:MEwIN1wVpAvqjWy+qjOLbIyQPxnx","tlshash":"6cd3b56177902535253b03fed55bb7082169ea23d61e6ad2f4bd80a8c6daff330a170d","first_seen":"2025-10-17T18:38:59.122062Z","last_seen":"2025-10-17T18:38:59.122062Z","times_seen":1,"resource_available":false,"data":null}},"time_used":4609,"timings":{"blocked":1675,"dns":1014,"connect":328,"send":0,"wait":1258,"receive":0,"ssl":331},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-content/uploads/elementor/css/post-10.css?ver=1759309535","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metmask.cn/","date":"2025-10-17T18:38:34.549Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metmask.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 16:41:37 GMT","end":"Thu, 25 Dec 2025 16:41:36 GMT"},"fingerprint":{"sha1":"A9:BC:DC:E6:20:DD:88:D9:E5:DA:4B:32:C6:90:CB:1E:CA:C5:6D:2D","sha256":"1D:A4:4A:56:3B:56:97:87:92:96:62:E3:DB:A6:24:AC:55:C1:FE:AF:F0:C4:66:B0:6A:30:15:70:02:61:DD:C8"}}},"request":{"raw":"GET /wp-content/uploads/elementor/css/post-10.css?ver=1759309535 HTTP/1.1\r\nHost: metmask.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metmask.cn/\r\nCookie: SITE_TOTAL_ID=b4c7a9e2b691447a863f40853ebd2f90\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 18:38:34 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 01 Oct 2025 09:05:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68dceedf-39ea\"\r\nexpires: Sat, 18 Oct 2025 06:38:34 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14826,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (14826), with no line terminators","md5":"477e7af797a01f432b4da7b8223763c6","sha1":"97c58a798241aa5dec337d21beda1ba9ee505dcc","sha256":"e4c8f4ed5f2aa58f95cc14e5f2ebd246c6eb67cc218e4b4b7a54ef209e2ca420","sha512":"2b83692f5250b65ea18c9ef1f8d86da14e1604eff21c0d74c90ecee4f3f668e5b62a63ab7ccb724e3be6d626e89d42ec7af79e31fac9879933dd17919539a48f","ssdeep":"192:l0FwnJWkuU1uW+qC9z6ZqZJ49ZcHyrZoZE0P03Z9ZO/Z8Z8Z2z2:oZ","tlshash":"e56234607c839229f22f106f6103b55d38e49cc9d67e6ac9fd626127f4fae8137a065c","first_seen":"2025-10-17T18:38:59.12638Z","last_seen":"2025-10-17T18:38:59.12638Z","times_seen":1,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-content/uploads/2025/09/vevtorobject.png","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://metmask.cn/","date":"2025-10-17T18:38:34.562Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metmask.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 16:41:37 GMT","end":"Thu, 25 Dec 2025 16:41:36 GMT"},"fingerprint":{"sha1":"A9:BC:DC:E6:20:DD:88:D9:E5:DA:4B:32:C6:90:CB:1E:CA:C5:6D:2D","sha256":"1D:A4:4A:56:3B:56:97:87:92:96:62:E3:DB:A6:24:AC:55:C1:FE:AF:F0:C4:66:B0:6A:30:15:70:02:61:DD:C8"}}},"request":{"raw":"GET /wp-content/uploads/2025/09/vevtorobject.png HTTP/1.1\r\nHost: metmask.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metmask.cn/\r\nCookie: SITE_TOTAL_ID=b4c7a9e2b691447a863f40853ebd2f90\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 18:38:35 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 26 Sep 2025 18:05:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d6d5fc-120b5\"\r\nexpires: Sun, 16 Nov 2025 18:38:35 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":73909,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 916 x 640, 8-bit/color RGBA, non-interlaced","md5":"dcafa411a550301f6adb4615dce1620b","sha1":"2b51a598fb4a671f6058c30e697116fe81a1dda2","sha256":"bac7096825ad6ede6500df8e012b9d0ee06b173b52b7f348b7c1a94ebf7e3b59","sha512":"ce52a4f6c16937d9bc33e287f258cd5e7a0c6594859a6eba9efbfd6ca767b0ccb25c4747f5068203d1b8bfdf98e8fabff7c70ca4f685a6472aee16c0c8ae1a0d","ssdeep":"1536:Jv5nhyLUpJP/R/oMvv5sWjKUBO9JJ9Fd3D7enqtk178JFdwl2l78ldYDw:JhnhCI/BTRsoCJ9TTCnV178sUk","tlshash":"9b7302e93ae5c1b03b80a2f3752987c579977fb242e4d07359a7ec4ce9d91821e3618c","first_seen":"2025-08-19T03:29:54.989454Z","last_seen":"2026-06-08T04:44:40.418332Z","times_seen":12,"resource_available":false,"data":null}},"time_used":657,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":657,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-includes/js/jquery/ui/core.min.js?ver=1.13.3","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metmask.cn/","date":"2025-10-17T18:38:34.618Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metmask.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 16:41:37 GMT","end":"Thu, 25 Dec 2025 16:41:36 GMT"},"fingerprint":{"sha1":"A9:BC:DC:E6:20:DD:88:D9:E5:DA:4B:32:C6:90:CB:1E:CA:C5:6D:2D","sha256":"1D:A4:4A:56:3B:56:97:87:92:96:62:E3:DB:A6:24:AC:55:C1:FE:AF:F0:C4:66:B0:6A:30:15:70:02:61:DD:C8"}}},"request":{"raw":"GET /wp-includes/js/jquery/ui/core.min.js?ver=1.13.3 HTTP/1.1\r\nHost: metmask.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metmask.cn/\r\nCookie: SITE_TOTAL_ID=b4c7a9e2b691447a863f40853ebd2f90\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 18:38:35 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 26 Sep 2025 17:39:34 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d6cfd6-53d8\"\r\nexpires: Sat, 18 Oct 2025 06:38:35 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21464,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (8189)","md5":"da215ae12b95b3aeeb2047667016c7f8","sha1":"480a7087aa74b5b47c47f05a11670e823a3ae4c0","sha256":"699210a5ed06e497b4730ec83bb65ac4c2269ae4a0ee8af3f24aae7ee5b66b76","sha512":"d256ddc828c06f7b84f7df706a4481928a186ea6d3e1358254a1ec02f403d72d2f3aecd682a93aad61b8f236f17dbcf7e6ca100f78c30a348682bf8ee125d8ff","ssdeep":"384:G/rsrDr8LVyraS3dtrqorqr8hrpCip8fuxNhlGX0CiS9rH/OrLrErJ29FkFvd:iS33ZdvK47kv","tlshash":"06a2d94eb246380586f7a2a5402f521fb132e25cb105c8ddf468d8da3c7eea95173f79","first_seen":"2025-04-15T23:53:17.313193Z","last_seen":"2026-07-22T02:26:11.638251Z","times_seen":330265,"resource_available":true,"data":null}},"time_used":653,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":653,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-content/plugins/elementor/assets/js/shared-frontend-handlers.30dc2f9c080845a413a6.bundle.min.js","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metmask.cn/","date":"2025-10-17T18:38:36.515Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metmask.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 16:41:37 GMT","end":"Thu, 25 Dec 2025 16:41:36 GMT"},"fingerprint":{"sha1":"A9:BC:DC:E6:20:DD:88:D9:E5:DA:4B:32:C6:90:CB:1E:CA:C5:6D:2D","sha256":"1D:A4:4A:56:3B:56:97:87:92:96:62:E3:DB:A6:24:AC:55:C1:FE:AF:F0:C4:66:B0:6A:30:15:70:02:61:DD:C8"}}},"request":{"raw":"GET /wp-content/plugins/elementor/assets/js/shared-frontend-handlers.30dc2f9c080845a413a6.bundle.min.js HTTP/1.1\r\nHost: metmask.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metmask.cn/\r\nCookie: SITE_TOTAL_ID=b4c7a9e2b691447a863f40853ebd2f90\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 18:38:36 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 26 Sep 2025 17:39:34 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d6cfd6-215d\"\r\nexpires: Sat, 18 Oct 2025 06:38:36 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8541,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (8501)","md5":"c407c4762fe3950a128ff09b046d2a35","sha1":"0e009b56a7eb912c233e775ad7081d208897db97","sha256":"ace6b22b454bd935998d953ce7545201b67372883b2baf62bb955ca0e10f3d6d","sha512":"0d95a3afb72c4ac6b08e84a0eb4f8b5b2c1be67713148390a0bd56506129a6676ab3d4f24411476b7083ac46ca37c3f8d979ce3dd29a59faf2b468bc6e9b2b82","ssdeep":"192:pwfFpzqxODoWV5KxZmdXLf+UvDZ5CMtakRhPZTxcMkCwB410QsFfpRHvcwxDnPoj:yHzqxORV5KxodXLfpvD/NtakRhPZTxcg","tlshash":"9102210a74c1942db58b58ba3532432c66a8014de1018f6eb1bf79fbc5a6d82377b7f1","first_seen":"2025-07-01T11:14:42.266317Z","last_seen":"2026-07-21T09:16:38.867631Z","times_seen":2289,"resource_available":true,"data":null}},"time_used":328,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-content/plugins/elementor/assets/css/widget-image.min.css?ver=3.30.0","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metmask.cn/","date":"2025-10-17T18:38:34.546Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metmask.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 16:41:37 GMT","end":"Thu, 25 Dec 2025 16:41:36 GMT"},"fingerprint":{"sha1":"A9:BC:DC:E6:20:DD:88:D9:E5:DA:4B:32:C6:90:CB:1E:CA:C5:6D:2D","sha256":"1D:A4:4A:56:3B:56:97:87:92:96:62:E3:DB:A6:24:AC:55:C1:FE:AF:F0:C4:66:B0:6A:30:15:70:02:61:DD:C8"}}},"request":{"raw":"GET /wp-content/plugins/elementor/assets/css/widget-image.min.css?ver=3.30.0 HTTP/1.1\r\nHost: metmask.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metmask.cn/\r\nCookie: SITE_TOTAL_ID=b4c7a9e2b691447a863f40853ebd2f90\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 18:38:34 GMT\r\ncontent-type: text/css\r\ncontent-length: 254\r\nlast-modified: Fri, 26 Sep 2025 17:39:33 GMT\r\netag: \"68d6cfd5-fe\"\r\nexpires: Sat, 18 Oct 2025 06:38:34 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":254,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"08a6f5ce1cc60fab79a572c983a65dfa","sha1":"3c814d559fc6677ae3a1748a9849b242f4f7049d","sha256":"7178d21a896d8cd1d36aaef764d3475a517557741fdb21c77ef4634e1f0acb91","sha512":"085bedad81bf77155e35271f3f3deca8a0da39e1fd7a03e8936ed9c5719edc13f4df7dca03a29d31843cd7984964fc317f95d28c2f0bd986183b2fd654a67ec1","ssdeep":"","tlshash":"aad05e4034674382301f596926ab2a9e38c41ddcf346cb90eca5661256bacc83372120","first_seen":"2025-07-01T11:27:13.554595Z","last_seen":"2026-07-21T18:38:59.103524Z","times_seen":1846,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.30.0","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metmask.cn/","date":"2025-10-17T18:38:34.619Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metmask.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 16:41:37 GMT","end":"Thu, 25 Dec 2025 16:41:36 GMT"},"fingerprint":{"sha1":"A9:BC:DC:E6:20:DD:88:D9:E5:DA:4B:32:C6:90:CB:1E:CA:C5:6D:2D","sha256":"1D:A4:4A:56:3B:56:97:87:92:96:62:E3:DB:A6:24:AC:55:C1:FE:AF:F0:C4:66:B0:6A:30:15:70:02:61:DD:C8"}}},"request":{"raw":"GET /wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.30.0 HTTP/1.1\r\nHost: metmask.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metmask.cn/\r\nCookie: SITE_TOTAL_ID=b4c7a9e2b691447a863f40853ebd2f90\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 18:38:35 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 26 Sep 2025 17:39:34 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d6cfd6-806c\"\r\nexpires: Sat, 18 Oct 2025 06:38:35 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":32876,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (32836)","md5":"f4148790a48f0d12980fb3e18f97a896","sha1":"2d19ea6f6ec1b5185fe8e4e3e43adcbfc07a0888","sha256":"65d0e0ca37549887c595b803a2adbfeccfad67e22113a0670059e48040f25f9c","sha512":"8c993438543a7fbafed2e3d4360a56b5667850e9b0dbf00bbb0af08a5fcc68b5e06cf60e54eca3d41f2880ad2f1b348327245bbe67a0e60251579f6a80bb518b","ssdeep":"768:IRdRMtJR8RjDKv//DQl5ZnfVgbpM+MpKEAzBc5GlTSeUsveOBNU5aG9g3fWLJhoh:IRdCtJR8RjD8/0fVliEAzBc5UTSeUsGa","tlshash":"7ae209527296d4a2069f48a3f0331119f3765dd9b80af0d8b2acdce1a475f877361b35","first_seen":"2025-07-01T11:14:42.29251Z","last_seen":"2026-07-21T18:38:59.086433Z","times_seen":2151,"resource_available":true,"data":null}},"time_used":651,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":651,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-content/uploads/2025/09/cropped-ODF-2-34x34.png","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://metmask.cn/","date":"2025-10-17T18:38:36.862Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metmask.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 16:41:37 GMT","end":"Thu, 25 Dec 2025 16:41:36 GMT"},"fingerprint":{"sha1":"A9:BC:DC:E6:20:DD:88:D9:E5:DA:4B:32:C6:90:CB:1E:CA:C5:6D:2D","sha256":"1D:A4:4A:56:3B:56:97:87:92:96:62:E3:DB:A6:24:AC:55:C1:FE:AF:F0:C4:66:B0:6A:30:15:70:02:61:DD:C8"}}},"request":{"raw":"GET /wp-content/uploads/2025/09/cropped-ODF-2-34x34.png HTTP/1.1\r\nHost: metmask.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metmask.cn/\r\nCookie: SITE_TOTAL_ID=b4c7a9e2b691447a863f40853ebd2f90\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 18:38:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 26 Sep 2025 18:18:01 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d6d8d9-7ba\"\r\nexpires: Sun, 16 Nov 2025 18:38:37 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1978,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 34 x 34, 8-bit/color RGBA, non-interlaced","md5":"6345a35c5c2123758a149c5deec24ab7","sha1":"9fd8db10ce80b2b1b1b2a1a13d1695dc3037b500","sha256":"313046194a26f5e71c3aa7532dd2766ddd116d09220c6d983b78664ec934d96f","sha512":"c19d6e1844b9c697514b0f8de5c4b55d29a3e11b0b4384867bfc4294e08a9fbc0ba8ed3e6e60f4ec2b438e7c910dda381c3484fc43c5aeda4eb1468a2328239d","ssdeep":"","tlshash":"dd412ccc3dd4c16f94619365c21251d2d9b3db0f49969efb6045f80e0cc6af04bb4b48","first_seen":"2025-10-17T18:38:59.157707Z","last_seen":"2025-10-17T18:38:59.157707Z","times_seen":1,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-content/themes/astra/assets/js/minified/frontend.min.js?ver=4.11.11","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metmask.cn/","date":"2025-10-17T18:38:34.563Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metmask.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 16:41:37 GMT","end":"Thu, 25 Dec 2025 16:41:36 GMT"},"fingerprint":{"sha1":"A9:BC:DC:E6:20:DD:88:D9:E5:DA:4B:32:C6:90:CB:1E:CA:C5:6D:2D","sha256":"1D:A4:4A:56:3B:56:97:87:92:96:62:E3:DB:A6:24:AC:55:C1:FE:AF:F0:C4:66:B0:6A:30:15:70:02:61:DD:C8"}}},"request":{"raw":"GET /wp-content/themes/astra/assets/js/minified/frontend.min.js?ver=4.11.11 HTTP/1.1\r\nHost: metmask.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metmask.cn/\r\nCookie: SITE_TOTAL_ID=b4c7a9e2b691447a863f40853ebd2f90\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 18:38:35 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 26 Sep 2025 17:39:34 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d6cfd6-63e2\"\r\nexpires: Sat, 18 Oct 2025 06:38:35 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":25570,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (25570), with no line terminators","md5":"e3f1d8b0c43863983d30808c8c80350d","sha1":"9986ae27aecfad88862a45d6e9c6deb7157985ba","sha256":"f4d505dfa966359e750416d214a3a4bc047f71e33c1b1c9147ec1b6b26269c07","sha512":"f0314c9f678705e69dac0c6beacdde23cbae9cb971ce277d408a2a5316ab08a34bf707c507e44cdee816c8a27c65afb00644e341e35e79e2d8762997bc595119","ssdeep":"768:uYEPx6KoYcFDTHjkkoKoCo9or62RcjC5LltbmxPE22Ve3rTX6VzSD0tIzQ6IFNd1:uYEPx6V4c62Rcj6lBmxPEyydSLWNdi1e","tlshash":"91b261a663102a3604fe17e7f5daabc57671109ffa0944111838cc6e19a8fd352f1afa","first_seen":"2025-09-09T21:36:58.056268Z","last_seen":"2026-07-20T07:11:58.996776Z","times_seen":494,"resource_available":true,"data":null}},"time_used":657,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":657,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.30.0","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metmask.cn/","date":"2025-10-17T18:38:34.626Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metmask.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 16:41:37 GMT","end":"Thu, 25 Dec 2025 16:41:36 GMT"},"fingerprint":{"sha1":"A9:BC:DC:E6:20:DD:88:D9:E5:DA:4B:32:C6:90:CB:1E:CA:C5:6D:2D","sha256":"1D:A4:4A:56:3B:56:97:87:92:96:62:E3:DB:A6:24:AC:55:C1:FE:AF:F0:C4:66:B0:6A:30:15:70:02:61:DD:C8"}}},"request":{"raw":"GET /wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.30.0 HTTP/1.1\r\nHost: metmask.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metmask.cn/\r\nCookie: SITE_TOTAL_ID=b4c7a9e2b691447a863f40853ebd2f90\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 18:38:35 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 26 Sep 2025 17:39:33 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d6cfd5-5e92\"\r\nexpires: Sat, 18 Oct 2025 06:38:35 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24210,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (24166)","md5":"73e6268e40f25a368f5c33686a04d2de","sha1":"07489633018938fb540257bfd3cfae7a9eb4b31e","sha256":"fba296b9000eec2841886bedffeb28ad180b3dde4ebbc36cff18473817f7bc27","sha512":"e89c5f58290ffed88ee76d20652545fb46ec02b7f7b36bf64eb66e63fff1253b7fb01e476933fe260cf4ebd1b9b6016571646abe4ca1276e4559274557c36471","ssdeep":"384:Mxpy+EVxFm6cKJskdHd7taQtHuGJswg/i+pQDTWmMo7YtDTVHJiMqkoh+vFWN7KS:Mxw+EVxFm6cKikdHd7taQtHuGJswg/D2","tlshash":"36b2d9053163ac7a50cf815be467420e77378894740570ed7abc6cdba5b8e9a33ea339","first_seen":"2025-07-01T13:44:05.628087Z","last_seen":"2026-07-21T23:16:47.834401Z","times_seen":5343,"resource_available":true,"data":null}},"time_used":642,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":642,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-includes/js/wp-emoji-release.min.js?ver=6.8.3","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metmask.cn/","date":"2025-10-17T18:38:36.493Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metmask.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 16:41:37 GMT","end":"Thu, 25 Dec 2025 16:41:36 GMT"},"fingerprint":{"sha1":"A9:BC:DC:E6:20:DD:88:D9:E5:DA:4B:32:C6:90:CB:1E:CA:C5:6D:2D","sha256":"1D:A4:4A:56:3B:56:97:87:92:96:62:E3:DB:A6:24:AC:55:C1:FE:AF:F0:C4:66:B0:6A:30:15:70:02:61:DD:C8"}}},"request":{"raw":"GET /wp-includes/js/wp-emoji-release.min.js?ver=6.8.3 HTTP/1.1\r\nHost: metmask.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metmask.cn/\r\nCookie: SITE_TOTAL_ID=b4c7a9e2b691447a863f40853ebd2f90\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 18:38:36 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 26 Sep 2025 17:39:34 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d6cfd6-4b33\"\r\nexpires: Sat, 18 Oct 2025 06:38:36 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19251,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (16277)","md5":"c4b50535f3e989a77d537d5486342d47","sha1":"2a1cc988298c022def9376bd54f608f44154071a","sha256":"db8ee8be2b2456c191fc0739f34f6ac675af8ba4782380cf233024498e0eb968","sha512":"be3b974332c4dadc30025aa911fde008442c9f4966ade014a7b8f05926688e30b9fdc32ebdbdd53fe32fc3f4d9c6ac2310b98dc6602843f2d8f00b1ded4e9b83","ssdeep":"384:WAevzW+ZTbXUH3o//bEPhXgA5H1efAJmpr:WF6UXUH3o//YpXgAGfACr","tlshash":"d782fa9bb33a4e8f343e3bd7cd968f4dc9da555321c0e078dbeeb68169a00568274c90","first_seen":"2025-05-09T23:23:48.206606Z","last_seen":"2026-07-22T02:05:19.470153Z","times_seen":211275,"resource_available":true,"data":null}},"time_used":329,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-content/plugins/elementor/assets/js/text-editor.c084ef86600b6f11690d.bundle.min.js","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metmask.cn/","date":"2025-10-17T18:38:36.526Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metmask.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 16:41:37 GMT","end":"Thu, 25 Dec 2025 16:41:36 GMT"},"fingerprint":{"sha1":"A9:BC:DC:E6:20:DD:88:D9:E5:DA:4B:32:C6:90:CB:1E:CA:C5:6D:2D","sha256":"1D:A4:4A:56:3B:56:97:87:92:96:62:E3:DB:A6:24:AC:55:C1:FE:AF:F0:C4:66:B0:6A:30:15:70:02:61:DD:C8"}}},"request":{"raw":"GET /wp-content/plugins/elementor/assets/js/text-editor.c084ef86600b6f11690d.bundle.min.js HTTP/1.1\r\nHost: metmask.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metmask.cn/\r\nCookie: SITE_TOTAL_ID=b4c7a9e2b691447a863f40853ebd2f90\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 18:38:36 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 26 Sep 2025 17:39:34 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d6cfd6-572\"\r\nexpires: Sat, 18 Oct 2025 06:38:36 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1394,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1354)","md5":"7bf3fb3cf9fb79daa8f22cd84e95e6c8","sha1":"138ec26efeeee1ae778eba800b72df2fe9b552b2","sha256":"61bf0b30ad24aa67df24a80081753673bb902b7f44c00ece1c98995b48d88f71","sha512":"cca8fba740a031dac6b377147b895d85a7e9b8b2d5651bb1a187210b2235a0331e46a0c77f71778a5df6bb391a9cdda5b7ac1747cadb0a95b0f034764d2987e8","ssdeep":"","tlshash":"1b2103f370a398ed48cf148a34522d16f1570c6cb885a01ef5aa08db34b1e853362234","first_seen":"2025-07-01T11:14:42.294099Z","last_seen":"2026-07-14T15:00:19.385119Z","times_seen":1904,"resource_available":true,"data":null}},"time_used":331,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":331,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.30.0","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metmask.cn/","date":"2025-10-17T18:38:34.612Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metmask.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 16:41:37 GMT","end":"Thu, 25 Dec 2025 16:41:36 GMT"},"fingerprint":{"sha1":"A9:BC:DC:E6:20:DD:88:D9:E5:DA:4B:32:C6:90:CB:1E:CA:C5:6D:2D","sha256":"1D:A4:4A:56:3B:56:97:87:92:96:62:E3:DB:A6:24:AC:55:C1:FE:AF:F0:C4:66:B0:6A:30:15:70:02:61:DD:C8"}}},"request":{"raw":"GET /wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.30.0 HTTP/1.1\r\nHost: metmask.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metmask.cn/\r\nCookie: SITE_TOTAL_ID=b4c7a9e2b691447a863f40853ebd2f90\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 18:38:35 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 26 Sep 2025 17:39:34 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d6cfd6-1644\"\r\nexpires: Sat, 18 Oct 2025 06:38:35 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5700,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (5660)","md5":"c400c47a24a3f50b62697df124e66a6d","sha1":"395ade2e64e8724da21b3b34b50f41aff6b6eec1","sha256":"651f8fb1dc50b25c5dc8305eeada26b8ec66c806cb0511ae0fb44a620693b809","sha512":"fd2c2d3f88f6de849f16e60e7a9a24a2094022c71ada4e09c3a696346e2a2f64a941423a96ecfd2e109eb213ddea89341c0567a23b2c4ada285d6e31ff793726","ssdeep":"96:BuAtsNvDdfzjqj3Ntxl8O7AEQQ1vg+lsmejl3i7wVjLUVsc+2KBbZ7Qah88/2:1sNpzjq3TNQWg+smeMs5QTY1V/2","tlshash":"e6c163d41a94fc2b22e135d8e11ba734662fc0337c16f9c1fa21dce955e8ed183aa572","first_seen":"2025-07-01T11:14:42.178297Z","last_seen":"2026-07-21T18:38:59.100014Z","times_seen":2127,"resource_available":true,"data":null}},"time_used":657,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":657,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-content/uploads/2025/09/cropped-ODF-2-300x300.png","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://metmask.cn/","date":"2025-10-17T18:38:36.861Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metmask.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 16:41:37 GMT","end":"Thu, 25 Dec 2025 16:41:36 GMT"},"fingerprint":{"sha1":"A9:BC:DC:E6:20:DD:88:D9:E5:DA:4B:32:C6:90:CB:1E:CA:C5:6D:2D","sha256":"1D:A4:4A:56:3B:56:97:87:92:96:62:E3:DB:A6:24:AC:55:C1:FE:AF:F0:C4:66:B0:6A:30:15:70:02:61:DD:C8"}}},"request":{"raw":"GET /wp-content/uploads/2025/09/cropped-ODF-2-300x300.png HTTP/1.1\r\nHost: metmask.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metmask.cn/\r\nCookie: SITE_TOTAL_ID=b4c7a9e2b691447a863f40853ebd2f90\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 18:38:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 26 Sep 2025 18:18:01 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d6d8d9-1c29\"\r\nexpires: Sun, 16 Nov 2025 18:38:37 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7209,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"7c0361c58fc3172d79716bd5120d64c0","sha1":"fe6c88f357a2e69ea64ffb1e5719776b7baa497d","sha256":"a2edb88ac98d7426adeb8d8987539c3d9ab8a7c66c7e3e841dcb98d659aaac3a","sha512":"55d09c242b301e538174e2dc72ad2cf08260ccba63674ceb36934245ed6d2c0d7830e436c4a55c49b85e0aed417f45ae1050528272258417ae2621e1c3839a0e","ssdeep":"192:+rFTMKCs1DNauWgGDRJ5HwTwrN2mGWbu3:+rFA7s/gJehmGD","tlshash":"00e17d5da0e3d07b355b2f224a559120cc8b8a3b18c44fb954ef205f642ad1b8364d5f","first_seen":"2025-10-17T18:38:59.17957Z","last_seen":"2025-10-17T18:38:59.17957Z","times_seen":1,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-content/themes/astra/assets/css/minified/main.min.css?ver=4.11.11","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metmask.cn/","date":"2025-10-17T18:38:34.539Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metmask.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 16:41:37 GMT","end":"Thu, 25 Dec 2025 16:41:36 GMT"},"fingerprint":{"sha1":"A9:BC:DC:E6:20:DD:88:D9:E5:DA:4B:32:C6:90:CB:1E:CA:C5:6D:2D","sha256":"1D:A4:4A:56:3B:56:97:87:92:96:62:E3:DB:A6:24:AC:55:C1:FE:AF:F0:C4:66:B0:6A:30:15:70:02:61:DD:C8"}}},"request":{"raw":"GET /wp-content/themes/astra/assets/css/minified/main.min.css?ver=4.11.11 HTTP/1.1\r\nHost: metmask.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metmask.cn/\r\nCookie: SITE_TOTAL_ID=b4c7a9e2b691447a863f40853ebd2f90\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 18:38:34 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 26 Sep 2025 17:39:34 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d6cfd6-b2a3\"\r\nexpires: Sat, 18 Oct 2025 06:38:34 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":45731,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (43549)","md5":"063387c1aadb9ba1e6e2038c8ce990ad","sha1":"ed1577ef20820b34b58e9c4b194e6c2715b4683f","sha256":"2ed2af3da90ae0f65ec5b2512186251d247a10b7e18eea1f3425a551426a1ffe","sha512":"2bec73ec88ba0fa5ff85634f82f8a2a66a2c0b4c842d4e71074d4b5c51c4acb205bf46066ae1b7bbb231b3325fdfa483535b62178f8136ae6b31b3b3a2f21aaa","ssdeep":"768:mPcOrk1rhDYollnk+FHk3YCzxdvN3JR2/WLmiyCFS7OHQtBU5PT1enhm2a7ZAR2s:A2YY+tHQtBU5PTwDuaP","tlshash":"a323f96047d035391233873efad6b9082a694313d74f26e6f8ab8768c9c57d71a72e4c","first_seen":"2025-09-09T21:36:58.042082Z","last_seen":"2026-07-21T21:04:58.736279Z","times_seen":14969,"resource_available":false,"data":null}},"time_used":329,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=3.30.0","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metmask.cn/","date":"2025-10-17T18:38:34.541Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metmask.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 16:41:37 GMT","end":"Thu, 25 Dec 2025 16:41:36 GMT"},"fingerprint":{"sha1":"A9:BC:DC:E6:20:DD:88:D9:E5:DA:4B:32:C6:90:CB:1E:CA:C5:6D:2D","sha256":"1D:A4:4A:56:3B:56:97:87:92:96:62:E3:DB:A6:24:AC:55:C1:FE:AF:F0:C4:66:B0:6A:30:15:70:02:61:DD:C8"}}},"request":{"raw":"GET /wp-content/plugins/elementor/assets/css/frontend.min.css?ver=3.30.0 HTTP/1.1\r\nHost: metmask.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metmask.cn/\r\nCookie: SITE_TOTAL_ID=b4c7a9e2b691447a863f40853ebd2f90\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 18:38:34 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 26 Sep 2025 17:39:33 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d6cfd5-d0ae\"\r\nexpires: Sat, 18 Oct 2025 06:38:34 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":53422,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (53382)","md5":"3a43428f2ded54d81b6373c706a8c1a6","sha1":"c4ac592932e97dbd69ec8b3268fb98de7ea1fc01","sha256":"a89d549d36e4ab743b0da08479c25a898246f77333120f1540b81047c7858298","sha512":"4924d9585e8308c6a735d07afedc6c0aad305f9bd8301581f96f9b2379026d477e7c066ff7d858a22cf497c37f06a9d385b6dc81880d089bb8b99c5f0adee8db","ssdeep":"384:AvrJ9/vmyeUaEMoZ0qk0e/RmRC5Cz9TfikvmGkvmCLldlRaE2ksFrOk:wLRdL2t7RrlNX7skk","tlshash":"f633fb623d13b269226f442b82d7364c526495c1ee4376d9fa04c523dafece63b36c1b","first_seen":"2025-07-01T11:14:42.290795Z","last_seen":"2026-07-21T18:38:59.092631Z","times_seen":1838,"resource_available":false,"data":null}},"time_used":329,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-includes/js/dist/i18n.min.js?ver=5e580eb46a90c2b997e6","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metmask.cn/","date":"2025-10-17T18:38:34.625Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metmask.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 16:41:37 GMT","end":"Thu, 25 Dec 2025 16:41:36 GMT"},"fingerprint":{"sha1":"A9:BC:DC:E6:20:DD:88:D9:E5:DA:4B:32:C6:90:CB:1E:CA:C5:6D:2D","sha256":"1D:A4:4A:56:3B:56:97:87:92:96:62:E3:DB:A6:24:AC:55:C1:FE:AF:F0:C4:66:B0:6A:30:15:70:02:61:DD:C8"}}},"request":{"raw":"GET /wp-includes/js/dist/i18n.min.js?ver=5e580eb46a90c2b997e6 HTTP/1.1\r\nHost: metmask.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metmask.cn/\r\nCookie: SITE_TOTAL_ID=b4c7a9e2b691447a863f40853ebd2f90\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 18:38:35 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 26 Sep 2025 17:39:34 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d6cfd6-23b5\"\r\nexpires: Sat, 18 Oct 2025 06:38:35 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9141,"size_decoded":0,"mime_type":"application/javascript","magic":"data","md5":"a8127c1a87bb4f99edbeec7c37311dcd","sha1":"9997a1745f48bdd233dbe9bd8164daa53eba105b","sha256":"f313d12ea6124bd28fc4a6b7163d253bb83d5aeab5edce594880c5c3df475cbc","sha512":"aa10ddc5b29905c60a058faed3f5f195f7577ceac46489e02461b5135732194daa3aef4aa473127bf8c753312e02074cfdac8d0f8f0cc8aa544c7f8e02bebd08","ssdeep":"192:s6zoFrnW4iaX3LzDk1jpJLB2hlq717+3uClD2tFtJ7bykd+SHS+F:s6Udn3LzoJphH8uClD2tFtJ7byTwtF","tlshash":"8612d8ac30deb021239a11e1586fb101f13aaf6532d99ce0da81d9e57db19c960b3ff5","first_seen":"2024-04-03T08:25:07Z","last_seen":"2026-07-22T02:19:55.889118Z","times_seen":259960,"resource_available":true,"data":null}},"time_used":644,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":644,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=3.30.0","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metmask.cn/","date":"2025-10-17T18:38:34.627Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metmask.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 16:41:37 GMT","end":"Thu, 25 Dec 2025 16:41:36 GMT"},"fingerprint":{"sha1":"A9:BC:DC:E6:20:DD:88:D9:E5:DA:4B:32:C6:90:CB:1E:CA:C5:6D:2D","sha256":"1D:A4:4A:56:3B:56:97:87:92:96:62:E3:DB:A6:24:AC:55:C1:FE:AF:F0:C4:66:B0:6A:30:15:70:02:61:DD:C8"}}},"request":{"raw":"GET /wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=3.30.0 HTTP/1.1\r\nHost: metmask.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metmask.cn/\r\nCookie: SITE_TOTAL_ID=b4c7a9e2b691447a863f40853ebd2f90\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 18:38:35 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 26 Sep 2025 17:39:33 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d6cfd5-aea4\"\r\nexpires: Sat, 18 Oct 2025 06:38:35 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":44708,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (44664)","md5":"a37940dc99419ca40387ad0b287f2c74","sha1":"b3204a2af7db39d14f84f80477c12808dc61ee3d","sha256":"77b5ec1d89bb1e10da9f4968bd413c8b262224273cba7a65b1009cdfc4a1d32c","sha512":"3fd360e77a6156ac6e527b33447ecd1044584101cf4b1100a02e4554bbe3a20d678d77a390dd91fe3d733cd3c8f13fd03e493f13bbf134256e1eb25cc58706c7","ssdeep":"768:C/bt9JJD1+WE9A5yLce/J9d0dbdTdGdadWdDdILdUd1dvd6dfdMdxdndTdVdFg7b:0t5D1+WE9A5yLcWJ9mBtIoERuWfRMBKC","tlshash":"4813a511716aca6945cf84abf463164fb7325cacf413f0e67afc8d82a464e87a394731","first_seen":"2025-07-01T13:44:05.620033Z","last_seen":"2026-07-21T23:16:47.86238Z","times_seen":5328,"resource_available":true,"data":null}},"time_used":641,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":641,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-content/plugins/elementor/assets/css/widget-heading.min.css?ver=3.30.0","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://metmask.cn/","date":"2025-10-17T18:38:34.545Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metmask.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 16:41:37 GMT","end":"Thu, 25 Dec 2025 16:41:36 GMT"},"fingerprint":{"sha1":"A9:BC:DC:E6:20:DD:88:D9:E5:DA:4B:32:C6:90:CB:1E:CA:C5:6D:2D","sha256":"1D:A4:4A:56:3B:56:97:87:92:96:62:E3:DB:A6:24:AC:55:C1:FE:AF:F0:C4:66:B0:6A:30:15:70:02:61:DD:C8"}}},"request":{"raw":"GET /wp-content/plugins/elementor/assets/css/widget-heading.min.css?ver=3.30.0 HTTP/1.1\r\nHost: metmask.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metmask.cn/\r\nCookie: SITE_TOTAL_ID=b4c7a9e2b691447a863f40853ebd2f90\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 18:38:34 GMT\r\ncontent-type: text/css\r\ncontent-length: 600\r\nlast-modified: Fri, 26 Sep 2025 17:39:33 GMT\r\netag: \"68d6cfd5-258\"\r\nexpires: Sat, 18 Oct 2025 06:38:34 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":600,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (560)","md5":"b08ef9672d6c7dbfac634253a15a94ec","sha1":"e7c7d2a82106ca472372927e5c02d4be500b887d","sha256":"32a17f83d126956d509bf2f2dc9d8a2004f5585a883b3060b02e5fa7fb6d75ba","sha512":"6617213af319fcb0d60b44e3ab8e70290a9104740d8743193e9f4a504574b7af26f1905691b0ef331cea340ead36fddb1279a83cca647bc0ac7d914702458cb1","ssdeep":"","tlshash":"d7f012237e4b94aa783f195b1083337c74944ecc93a0a8d8e8fa91436df4ca37330622","first_seen":"2025-07-01T11:14:42.339128Z","last_seen":"2026-07-21T18:38:59.112578Z","times_seen":1868,"resource_available":false,"data":null}},"time_used":329,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-includes/js/jquery/jquery.min.js?ver=3.7.1","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metmask.cn/","date":"2025-10-17T18:38:34.555Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metmask.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 16:41:37 GMT","end":"Thu, 25 Dec 2025 16:41:36 GMT"},"fingerprint":{"sha1":"A9:BC:DC:E6:20:DD:88:D9:E5:DA:4B:32:C6:90:CB:1E:CA:C5:6D:2D","sha256":"1D:A4:4A:56:3B:56:97:87:92:96:62:E3:DB:A6:24:AC:55:C1:FE:AF:F0:C4:66:B0:6A:30:15:70:02:61:DD:C8"}}},"request":{"raw":"GET /wp-includes/js/jquery/jquery.min.js?ver=3.7.1 HTTP/1.1\r\nHost: metmask.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metmask.cn/\r\nCookie: SITE_TOTAL_ID=b4c7a9e2b691447a863f40853ebd2f90\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 18:38:34 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 26 Sep 2025 17:39:34 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d6cfd6-15601\"\r\nexpires: Sat, 18 Oct 2025 06:38:34 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":87553,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"826eb77e86b02ab7724fe3d0141ff87c","sha1":"79cd3587d565afe290076a8d36c31c305a573d18","sha256":"cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf","sha512":"fc79fdb76763025dc39fac045a215ff155ef2f492a0e9640079d6f089fa6218af2b3ab7c6eaf636827dee9294e6939a95ab24554e870c976679c25567ad6374c","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKO:sHNwcv9VBQpLl88SMBQ47GKO","tlshash":"7483f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","first_seen":"2023-11-03T09:26:43Z","last_seen":"2026-07-22T02:24:26.758506Z","times_seen":984233,"resource_available":true,"data":null}},"time_used":330,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":330,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-content/uploads/2025/09/cropped-ODF-2-34x34.png","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://metmask.cn/","date":"2025-10-17T18:38:34.559Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metmask.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 16:41:37 GMT","end":"Thu, 25 Dec 2025 16:41:36 GMT"},"fingerprint":{"sha1":"A9:BC:DC:E6:20:DD:88:D9:E5:DA:4B:32:C6:90:CB:1E:CA:C5:6D:2D","sha256":"1D:A4:4A:56:3B:56:97:87:92:96:62:E3:DB:A6:24:AC:55:C1:FE:AF:F0:C4:66:B0:6A:30:15:70:02:61:DD:C8"}}},"request":{"raw":"GET /wp-content/uploads/2025/09/cropped-ODF-2-34x34.png HTTP/1.1\r\nHost: metmask.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metmask.cn/\r\nCookie: SITE_TOTAL_ID=b4c7a9e2b691447a863f40853ebd2f90\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 18:38:34 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 26 Sep 2025 18:18:01 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d6d8d9-7ba\"\r\nexpires: Sun, 16 Nov 2025 18:38:34 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1978,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 34 x 34, 8-bit/color RGBA, non-interlaced","md5":"6345a35c5c2123758a149c5deec24ab7","sha1":"9fd8db10ce80b2b1b1b2a1a13d1695dc3037b500","sha256":"313046194a26f5e71c3aa7532dd2766ddd116d09220c6d983b78664ec934d96f","sha512":"c19d6e1844b9c697514b0f8de5c4b55d29a3e11b0b4384867bfc4294e08a9fbc0ba8ed3e6e60f4ec2b438e7c910dda381c3484fc43c5aeda4eb1468a2328239d","ssdeep":"","tlshash":"dd412ccc3dd4c16f94619365c21251d2d9b3db0f49969efb6045f80e0cc6af04bb4b48","first_seen":"2025-10-17T18:38:59.157707Z","last_seen":"2025-10-17T18:38:59.157707Z","times_seen":1,"resource_available":false,"data":null}},"time_used":649,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":649,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metmask.cn/","date":"2025-10-17T18:38:34.556Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metmask.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 16:41:37 GMT","end":"Thu, 25 Dec 2025 16:41:36 GMT"},"fingerprint":{"sha1":"A9:BC:DC:E6:20:DD:88:D9:E5:DA:4B:32:C6:90:CB:1E:CA:C5:6D:2D","sha256":"1D:A4:4A:56:3B:56:97:87:92:96:62:E3:DB:A6:24:AC:55:C1:FE:AF:F0:C4:66:B0:6A:30:15:70:02:61:DD:C8"}}},"request":{"raw":"GET /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 HTTP/1.1\r\nHost: metmask.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metmask.cn/\r\nCookie: SITE_TOTAL_ID=b4c7a9e2b691447a863f40853ebd2f90\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 18:38:34 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 26 Sep 2025 17:39:34 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d6cfd6-3509\"\r\nexpires: Sat, 18 Oct 2025 06:38:34 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13577,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (13479)","md5":"9ffeb32e2d9efbf8f70caabded242267","sha1":"3ad0c10e501ac2a9bfa18f9cd7e700219b378738","sha256":"5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89","sha512":"8d6be545508a1c38278b8ad780c3758ae48a25e4e12eee443375aa56031d9b356f8c90f22d4f251140fa3f65603af40523165e33cae2e2d62fc78ec106e3d731","ssdeep":"192:5rprDN+sag6ifKIUpQI99P1tLm9kdgyq1+J3aCJQ+h4MPLORq:5rprxaefKI0LP19m4q1WW+h4Mjp","tlshash":"9952c8adb56679724eb721b8f03bd24f71b205de560d8940d19cc4f6282dc6e812bf78","first_seen":"2023-05-09T19:21:05Z","last_seen":"2026-07-22T02:24:26.753275Z","times_seen":902865,"resource_available":true,"data":null}},"time_used":651,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":651,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.30.0","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metmask.cn/","date":"2025-10-17T18:38:34.616Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metmask.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 16:41:37 GMT","end":"Thu, 25 Dec 2025 16:41:36 GMT"},"fingerprint":{"sha1":"A9:BC:DC:E6:20:DD:88:D9:E5:DA:4B:32:C6:90:CB:1E:CA:C5:6D:2D","sha256":"1D:A4:4A:56:3B:56:97:87:92:96:62:E3:DB:A6:24:AC:55:C1:FE:AF:F0:C4:66:B0:6A:30:15:70:02:61:DD:C8"}}},"request":{"raw":"GET /wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.30.0 HTTP/1.1\r\nHost: metmask.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metmask.cn/\r\nCookie: SITE_TOTAL_ID=b4c7a9e2b691447a863f40853ebd2f90\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 18:38:35 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 26 Sep 2025 17:39:34 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d6cfd6-bd09\"\r\nexpires: Sat, 18 Oct 2025 06:38:35 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":48393,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (48352)","md5":"a1e0bdd58e67fd109881cec93226a030","sha1":"4b3d7211554daa7c604d9a977bf5cf1092b21494","sha256":"533076a2f66a4501d1d25ccadb8f227d978c19c4c099d60b8c67117ede1d809a","sha512":"c22ddbe2f723c21e7c60b5e7b7e7b8afd56b6fef66ff268b7547e0ceb98b9bfa02f4e44e12e5b27d9d17dc6406800cb09e41d34284d49207401b3ba70b438055","ssdeep":"768:leAjA6wk9C+QioJHYNQAzeLHeBHmjkSK7+z1hlN14cR8+AvNKRiA8m6XS3gzlAIT:leAjA6f9C+QiSYNQAzeLHeBHmjkOzRNM","tlshash":"8823c7853652f4f70beb40daa02f450af25619a8640df4d4bfe9dce19470d8e237ab74","first_seen":"2025-07-01T11:14:42.30803Z","last_seen":"2026-07-21T18:38:59.132954Z","times_seen":2122,"resource_available":true,"data":null}},"time_used":655,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":655,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"metmask.cn/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.30.0","fqdn":"metmask.cn","domain":"metmask.cn","tld":"cn"},"ip":{"addr":"101.36.124.122","port":443,"asn":135377,"as":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://metmask.cn/","date":"2025-10-17T18:38:34.622Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"metmask.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 16:41:37 GMT","end":"Thu, 25 Dec 2025 16:41:36 GMT"},"fingerprint":{"sha1":"A9:BC:DC:E6:20:DD:88:D9:E5:DA:4B:32:C6:90:CB:1E:CA:C5:6D:2D","sha256":"1D:A4:4A:56:3B:56:97:87:92:96:62:E3:DB:A6:24:AC:55:C1:FE:AF:F0:C4:66:B0:6A:30:15:70:02:61:DD:C8"}}},"request":{"raw":"GET /wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.30.0 HTTP/1.1\r\nHost: metmask.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://metmask.cn/\r\nCookie: SITE_TOTAL_ID=b4c7a9e2b691447a863f40853ebd2f90\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 17 Oct 2025 18:38:35 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 26 Sep 2025 17:39:33 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d6cfd5-1868\"\r\nexpires: Sat, 18 Oct 2025 06:38:35 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6248,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (6204)","md5":"1ebaf1cc1b18bc887fa7051a87661528","sha1":"9474a195e519406755eaa7d0031cde89d32bff69","sha256":"fef2b61a3cd99eca5aadbef80053fd13da4ed92d0b20c3fd44c5ecc513639f16","sha512":"3d7c0b4f417b1df0c7f2dcdd44f9594f945f7beae6bd0b2a8b224fa2912b4827a50f4b4c48426dad51742532e6bc41f28f0500b6fe355db770edfdf1bb973a88","ssdeep":"96:BUdxwrudY4kjboFkEO/HfOYr+WY4N53hsstJQPCl2e/VtFVKdpYQGK0Vz38k2:qTXd4jboFemC9N537MPa/pMdOQ8Mk2","tlshash":"05d1569805489d2b26e43bd8b15b6b741b3dd0323c59da81e611eddc18fcfd187ea532","first_seen":"2025-07-01T13:44:05.655946Z","last_seen":"2026-07-21T23:16:47.830246Z","times_seen":5317,"resource_available":true,"data":null}},"time_used":647,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":647,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-17","alert":"Sinkholed","trigger":"metmask.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}