{"report_id":"2af92eba-425b-448a-b23a-c5dcf56cb980","version":6,"status":"done","tags":[],"date":"2026-01-05T12:29:48Z","url":{"schema":"http","addr":"web.i-whatsapp.com.cn","fqdn":"web.i-whatsapp.com.cn","domain":"i-whatsapp.com.cn","tld":"com.cn"},"ip":{"addr":"154.221.8.129","port":0,"asn":137951,"as":"ASLINE LIMITED","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"web.i-whatsapp.com.cn/","fqdn":"web.i-whatsapp.com.cn","domain":"i-whatsapp.com.cn","tld":"com.cn"},"title":"WhatsApp Web","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T16:51:58.475838Z","times_seen":17873861,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"web.i-whatsapp.com.cn","fqdn":"web.i-whatsapp.com.cn","domain":"i-whatsapp.com.cn","tld":"com.cn"},"ip":{"addr":"154.221.8.129","port":0,"asn":137951,"as":"ASLINE LIMITED","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-09T12:29:48Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"web.i-whatsapp.com.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"web.i-whatsapp.com.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null},"summary":[{"fqdn":"web.i-whatsapp.com.cn","ip":{"addr":"154.221.8.129","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"United States","country_code":"US"},"domain_registered":"2026-01-05","domain_rank":0,"first_seen":"2026-01-05T12:29:49.270975Z","last_seen":"2026-01-05T12:29:49.270975Z","alert_count":36,"request_count":18,"received_data":954589,"sent_data":8093,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Tailwind CSS","description":"Tailwind is a utility-first CSS framework.","website":"https://tailwindcss.com/","common_platform_enumeration":"","icon":"tailwindcss.svg","categories":["UI frameworks"]},{"name":"Lodash","description":"Lodash is a JavaScript library which provides utility functions for common programming tasks using the functional programming paradigm.","website":"https://www.lodash.com","common_platform_enumeration":"cpe:2.3:a:lodash:lodash:*:*:*:*:*:*:*:*","icon":"Lodash.svg","categories":["JavaScript libraries"]},{"name":"Bootstrap:3.3.7","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]},{"name":"jQuery:3.2.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"cdn.tailwindcss.com","ip":{"addr":"104.26.2.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2017-07-20","domain_rank":117330,"first_seen":"2018-07-09T05:46:13Z","last_seen":"2026-01-05T01:33:25.433Z","alert_count":0,"request_count":2,"received_data":816019,"sent_data":834,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}]},{"fqdn":"web.dcobxs.com","ip":{"addr":"172.67.153.77","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2023-11-02","domain_rank":0,"first_seen":"2023-11-15T04:57:36Z","last_seen":"2026-01-05T01:33:25.491957Z","alert_count":0,"request_count":1,"received_data":428,"sent_data":418,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-01-04T22:21:06.427471Z","alert_count":0,"request_count":2,"received_data":30125,"sent_data":900,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"web.i-whatsapp.com.cn/","fqdn":"web.i-whatsapp.com.cn","domain":"i-whatsapp.com.cn","tld":"com.cn"},"ip":{"addr":"154.221.8.129","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"3c17aee691582d1bafbcda58f7c99a25","sha1":"4901942b80f262d51c870beba2fcb680923b406e","sha256":"3258a860f670527f2b6d4e2d116cb2e84a83b35ce008786e233e172685d4a5bd","sha512":"8f62d47cc4ba5e3a172da40aaefe5c3341d7aa6368ea324818c526c4fafb5b9a56baa078f3ce919ff52eab76db7d8eb39958ebbf830808fbe47dd88ad27fe4a0","ssdeep":"","tlshash":"daf05c22588b1afc6263606f2fbe9d2673d7280f5450c0003d4ca410df715c28605288","size":466,"data":"","first_seen":"2025-10-19T01:16:14.660328Z","last_seen":"2026-05-29T00:13:00.830048Z","times_seen":55,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web.i-whatsapp.com.cn/lib/lodash/js/lodash.min.js","fqdn":"web.i-whatsapp.com.cn","domain":"i-whatsapp.com.cn","tld":"com.cn"},"ip":{"addr":"154.221.8.129","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"c8515f131f3194c32a3670c8e274fab6","sha1":"60de6e43c4a2c3326275ab12d4ffd90b2582aee9","sha256":"23258114961c94563c3e7df66f059d487995e01f4ce666f2e5b84f1c499e63cc","sha512":"77fac43371a6dc0f97e2ceecdceb64c15eeb1165598b68ae115416afea2721aaedecc953e8dcd29c3af5ab87fae65d4956c58aa7cedeb95daa8f3c4a8f21c7ad","ssdeep":"1536:VkFd9r+sGaSag+Md2ucB+0L87DsqMq5lkQ:VkFSaMDi67","tlshash":"cd6360c93ac3f41643a364b1406f088bf17eaea5acdda108d0e1f0ec797885dd967e59","size":72772,"data":"","first_seen":"2023-03-07T12:03:35Z","last_seen":"2026-08-13T15:12:41.323546Z","times_seen":628,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.tailwindcss.com/","fqdn":"cdn.tailwindcss.com","domain":"tailwindcss.com","tld":"com"},"ip":{"addr":"104.26.2.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"7a614b9a197e532c00d09a23b0996b5f","sha1":"1ff1738a40f3716e30e9031b181b0955ae578955","sha256":"176e894661aa9cdc9a5cba6c720044cbbf7b8bd80d1c9a142a7c24b1b6c50d15","sha512":"a67bc26f52d938358471be5671ff4b79e11af4e68b486aaf73a35a4c9bf3777aab51101af81563b4e5b7ba4b04dd8971fcfa9ee2c41fb10a0c1ee5604a99abd6","ssdeep":"12288:fpgrZxSAoNbJb0Wie75aUXGuyQZhK4O0s:RCVoNB0Wie75aUWmnO0s","tlshash":"e8844aa57396702647eb51e850ea1042f2beaa38840c44bcf7edd4da39e5e4440fbf79","size":407279,"data":"","first_seen":"2025-07-28T16:58:08.903462Z","last_seen":"2026-08-13T15:43:41.917443Z","times_seen":49010,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"web.i-whatsapp.com.cn/static/js/main.6c724e39.js","fqdn":"web.i-whatsapp.com.cn","domain":"i-whatsapp.com.cn","tld":"com.cn"},"ip":{"addr":"154.221.8.129","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web.i-whatsapp.com.cn/","date":"2026-01-05T12:29:26.499Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.i-whatsapp.com.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 05 Jan 2026 08:08:13 GMT","end":"Sun, 05 Apr 2026 08:08:12 GMT"},"fingerprint":{"sha1":"95:18:ED:BC:53:6A:6D:BE:6E:79:62:83:51:C5:F8:BD:AF:03:CC:1C","sha256":"B0:A6:2D:C3:C3:B1:17:07:E2:69:90:65:3A:B7:8A:54:6F:59:44:5B:9C:6A:CF:3B:1B:C8:04:8E:30:9F:06:D9"}}},"request":{"raw":"GET /static/js/main.6c724e39.js HTTP/1.1\r\nHost: web.i-whatsapp.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://web.i-whatsapp.com.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 05 Jan 2026 12:29:26 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sat, 15 Mar 2025 13:47:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67d58500-34091\"\r\nexpires: Tue, 06 Jan 2026 00:29:26 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":213137,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65465)","md5":"26a8b96a4e2f8ec33a08c340b726c50f","sha1":"1d3204f433b0c7d2f042083094bb1ab17317e3fb","sha256":"7dd85aca2c29abbe85ca1f14cb376ed30e3a9e64a6cb35f9b3f726b1a8784e82","sha512":"7b0de1dfa7540cb4d3e50d5792f61299036de1c8e2e3a9c56a3a64e36cd1cf80f7baf6bdf8a5edd796c6ab75d014d596a1abf53924faaac96c518b5d548886ca","ssdeep":"3072:lqwTemJdjlGG+5tMiGfV+rY2MPeiwXMLthI+:lfTpJdouiwV+rY2MPeiwXathI+","tlshash":"68241ae83955f5516eb343f710af1807737c2a2b280d4da0a211fd9db4b809eb17be99","first_seen":"2025-10-19T01:16:14.645533Z","last_seen":"2026-08-05T03:24:38.255926Z","times_seen":90,"resource_available":true,"data":null}},"time_used":361,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":361,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"web.i-whatsapp.com.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"web.i-whatsapp.com.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.i-whatsapp.com.cn/lib/lodash/js/lodash.min.js","fqdn":"web.i-whatsapp.com.cn","domain":"i-whatsapp.com.cn","tld":"com.cn"},"ip":{"addr":"154.221.8.129","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web.i-whatsapp.com.cn/","date":"2026-01-05T12:29:26.500Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.i-whatsapp.com.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 05 Jan 2026 08:08:13 GMT","end":"Sun, 05 Apr 2026 08:08:12 GMT"},"fingerprint":{"sha1":"95:18:ED:BC:53:6A:6D:BE:6E:79:62:83:51:C5:F8:BD:AF:03:CC:1C","sha256":"B0:A6:2D:C3:C3:B1:17:07:E2:69:90:65:3A:B7:8A:54:6F:59:44:5B:9C:6A:CF:3B:1B:C8:04:8E:30:9F:06:D9"}}},"request":{"raw":"GET /lib/lodash/js/lodash.min.js HTTP/1.1\r\nHost: web.i-whatsapp.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://web.i-whatsapp.com.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 05 Jan 2026 12:29:26 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 25 Mar 2024 00:42:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6600c88a-11c44\"\r\nexpires: Tue, 06 Jan 2026 00:29:26 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":72772,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (4357)","md5":"c8515f131f3194c32a3670c8e274fab6","sha1":"60de6e43c4a2c3326275ab12d4ffd90b2582aee9","sha256":"23258114961c94563c3e7df66f059d487995e01f4ce666f2e5b84f1c499e63cc","sha512":"77fac43371a6dc0f97e2ceecdceb64c15eeb1165598b68ae115416afea2721aaedecc953e8dcd29c3af5ab87fae65d4956c58aa7cedeb95daa8f3c4a8f21c7ad","ssdeep":"1536:VkFd9r+sGaSag+Md2ucB+0L87DsqMq5lkQ:VkFSaMDi67","tlshash":"cd6360c93ac3f41643a364b1406f088bf17eaea5acdda108d0e1f0ec797885dd967e59","first_seen":"2023-03-07T12:03:35Z","last_seen":"2026-08-13T15:12:41.323546Z","times_seen":628,"resource_available":true,"data":null}},"time_used":548,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":548,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"web.i-whatsapp.com.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"web.i-whatsapp.com.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.tailwindcss.com/3.4.17","fqdn":"cdn.tailwindcss.com","domain":"tailwindcss.com","tld":"com"},"ip":{"addr":"104.26.2.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web.i-whatsapp.com.cn/","date":"2026-01-05T12:29:26.523Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tailwindcss.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 23 Nov 2025 07:09:58 GMT","end":"Sat, 21 Feb 2026 08:09:55 GMT"},"fingerprint":{"sha1":"B5:C9:29:A1:B9:60:7F:A7:9E:9E:63:3E:DF:4E:05:34:4B:27:D3:86","sha256":"2D:FA:43:BC:F1:83:E4:D9:E0:ED:1A:D1:C5:0E:F5:E0:77:29:F1:F1:23:2F:E3:30:7B:72:49:1E:82:5C:DB:C1"}}},"request":{"raw":"GET /3.4.17 HTTP/1.1\r\nHost: cdn.tailwindcss.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://web.i-whatsapp.com.cn/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 05 Jan 2026 12:29:26 GMT\r\ncontent-type: text/javascript\r\ncache-control: max-age=31536000\r\ncontent-encoding: br\r\nserver: cloudflare\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: MISS\r\nx-vercel-id: fra1::iad1::jwcjr-1765212281299-f54ecb125284\r\nlast-modified: Mon, 08 Dec 2025 16:44:41 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\nage: 2403884\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wyfucsAzN61LV0b5rY3XNbteYkrZtDEDLsUaW4G7Ifvf4jWXZCjbIv3xC6%2BB%2FLZKPVtX8EUctQhtTu9Ln%2Fk8f%2FGOXHLLKWGg1V3%2BmpUlJbkusw%3D%3D\"}]}\r\ncf-ray: 9b92fb30cf7c5ebd-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":407279,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (52853)","md5":"7a614b9a197e532c00d09a23b0996b5f","sha1":"1ff1738a40f3716e30e9031b181b0955ae578955","sha256":"176e894661aa9cdc9a5cba6c720044cbbf7b8bd80d1c9a142a7c24b1b6c50d15","sha512":"a67bc26f52d938358471be5671ff4b79e11af4e68b486aaf73a35a4c9bf3777aab51101af81563b4e5b7ba4b04dd8971fcfa9ee2c41fb10a0c1ee5604a99abd6","ssdeep":"12288:fpgrZxSAoNbJb0Wie75aUXGuyQZhK4O0s:RCVoNB0Wie75aUWmnO0s","tlshash":"e8844aa57396702647eb51e850ea1042f2beaa38840c44bcf7edd4da39e5e4440fbf79","first_seen":"2025-07-28T16:58:08.903462Z","last_seen":"2026-08-13T15:43:41.917443Z","times_seen":49010,"resource_available":true,"data":null}},"time_used":4,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":4,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web.i-whatsapp.com.cn/favicon.ico","fqdn":"web.i-whatsapp.com.cn","domain":"i-whatsapp.com.cn","tld":"com.cn"},"ip":{"addr":"154.221.8.129","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://web.i-whatsapp.com.cn/","date":"2026-01-05T12:29:28.004Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.i-whatsapp.com.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 05 Jan 2026 08:08:13 GMT","end":"Sun, 05 Apr 2026 08:08:12 GMT"},"fingerprint":{"sha1":"95:18:ED:BC:53:6A:6D:BE:6E:79:62:83:51:C5:F8:BD:AF:03:CC:1C","sha256":"B0:A6:2D:C3:C3:B1:17:07:E2:69:90:65:3A:B7:8A:54:6F:59:44:5B:9C:6A:CF:3B:1B:C8:04:8E:30:9F:06:D9"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: web.i-whatsapp.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://web.i-whatsapp.com.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 05 Jan 2026 12:29:28 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 1385\r\nlast-modified: Sat, 15 Mar 2025 14:05:42 GMT\r\netag: \"67d58936-569\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1385,"size_decoded":0,"mime_type":"image/x-icon","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"b70e6078004aeb5146c635cc4c8af761","sha1":"08361cabab0812baeb8ecf4dfbdddd10a9104423","sha256":"20ce7e373448ca2a51d95f60fc906f57cc27d103a6bba4e33be3453f7b23b98e","sha512":"76e0a9f494998151ab5f5d1ef2f1e2cd826135537e6b3e77e6653997d6e073696880a1ab5100c6a85aea926edcfe036c31513d08f58c0bcc02db0a4c8b6bec09","ssdeep":"","tlshash":"bf210bf3e36020e90841d4310333621b57fa4f7b6d909371f071509112b944845a1e97","first_seen":"2024-12-25T11:23:49.33594Z","last_seen":"2026-08-01T18:23:46.596239Z","times_seen":1965,"resource_available":false,"data":null}},"time_used":183,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":182,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"web.i-whatsapp.com.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"web.i-whatsapp.com.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.i-whatsapp.com.cn/lib/jsonTree/jsonTree.js","fqdn":"web.i-whatsapp.com.cn","domain":"i-whatsapp.com.cn","tld":"com.cn"},"ip":{"addr":"154.221.8.129","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web.i-whatsapp.com.cn/","date":"2026-01-05T12:29:26.505Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.i-whatsapp.com.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 05 Jan 2026 08:08:13 GMT","end":"Sun, 05 Apr 2026 08:08:12 GMT"},"fingerprint":{"sha1":"95:18:ED:BC:53:6A:6D:BE:6E:79:62:83:51:C5:F8:BD:AF:03:CC:1C","sha256":"B0:A6:2D:C3:C3:B1:17:07:E2:69:90:65:3A:B7:8A:54:6F:59:44:5B:9C:6A:CF:3B:1B:C8:04:8E:30:9F:06:D9"}}},"request":{"raw":"GET /lib/jsonTree/jsonTree.js HTTP/1.1\r\nHost: web.i-whatsapp.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://web.i-whatsapp.com.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 05 Jan 2026 12:29:26 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 25 Mar 2024 00:42:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6600c88a-6062\"\r\nexpires: Tue, 06 Jan 2026 00:29:26 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24674,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"3ff80e9766a6ef42d85e78a51074ba6a","sha1":"1fbabf173acf615e89ad99fc4ca72ad575241cbd","sha256":"3cc0e2e4d75f991ab09790bc2f9bd86ae39d726c9827f718e367c2ac86098c09","sha512":"1f0d8e61550b2b60f062859cd3b7b63cb73232cadeb53646c1a413dd8f202892b7f996ac60ed8d4453cdbacf32ae8a9e3c2467f2fe2e4499d2cceeed2558201a","ssdeep":"384:JIjJ8s49pyE2DIR4Lb4YSDncH60lqBxzl/4:JId+9pyECIR4LEYSYgB1p4","tlshash":"b3b264153cf762639427f9b50b4f0045f568050fa905acd8bc9e6ab01f98f2459bbafc","first_seen":"2024-08-19T22:12:06.29686Z","last_seen":"2026-08-05T03:24:38.262512Z","times_seen":91,"resource_available":true,"data":null}},"time_used":548,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":548,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"web.i-whatsapp.com.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"web.i-whatsapp.com.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.i-whatsapp.com.cn/js/BootstrapStep.js","fqdn":"web.i-whatsapp.com.cn","domain":"i-whatsapp.com.cn","tld":"com.cn"},"ip":{"addr":"154.221.8.129","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web.i-whatsapp.com.cn/","date":"2026-01-05T12:29:26.510Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.i-whatsapp.com.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 05 Jan 2026 08:08:13 GMT","end":"Sun, 05 Apr 2026 08:08:12 GMT"},"fingerprint":{"sha1":"95:18:ED:BC:53:6A:6D:BE:6E:79:62:83:51:C5:F8:BD:AF:03:CC:1C","sha256":"B0:A6:2D:C3:C3:B1:17:07:E2:69:90:65:3A:B7:8A:54:6F:59:44:5B:9C:6A:CF:3B:1B:C8:04:8E:30:9F:06:D9"}}},"request":{"raw":"GET /js/BootstrapStep.js HTTP/1.1\r\nHost: web.i-whatsapp.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://web.i-whatsapp.com.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 05 Jan 2026 12:29:26 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 25 Jun 2024 14:31:28 GMT\r\nvary: Accept-Encoding\r\netag: W/\"667ad4c0-12e8f\"\r\nexpires: Tue, 06 Jan 2026 00:29:26 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":77455,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"f76c1d59b412927131d2bdd64cac8be4","sha1":"3311c13fa7175af40427a8af270c647ec6c6fed0","sha256":"c2ade901c6e6b1dfd488789d9d013f0094b084eb65f4caa39fc6c4507c0cb60f","sha512":"90f61851503490e9c270b32b66a7bd334636ba2df959f131ab6622eb97e78a2c40261c79dc38f5049b8150bbfd85d669bcbd212e52c1fdfbe2c3278e738bf3c4","ssdeep":"1536:EM52C9Y2mVGNl5CThrtQLxL5sYpfWFt/JBOyKAWEBTxOZ8GdRcjR+BvF+ShvZIIk:EY9Y2mVGNl5CThr2vsy+BBzKTEBTxO2p","tlshash":"df73838577c6b8c1124767b7b32ab1e5e82e5cdd3088088ff544bc98f5b9916fae0931","first_seen":"2025-10-19T01:16:14.611698Z","last_seen":"2026-08-05T03:24:38.258397Z","times_seen":119,"resource_available":false,"data":null}},"time_used":545,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":545,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"web.i-whatsapp.com.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"web.i-whatsapp.com.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.i-whatsapp.com.cn/js/main.js","fqdn":"web.i-whatsapp.com.cn","domain":"i-whatsapp.com.cn","tld":"com.cn"},"ip":{"addr":"154.221.8.129","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web.i-whatsapp.com.cn/","date":"2026-01-05T12:29:26.512Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.i-whatsapp.com.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 05 Jan 2026 08:08:13 GMT","end":"Sun, 05 Apr 2026 08:08:12 GMT"},"fingerprint":{"sha1":"95:18:ED:BC:53:6A:6D:BE:6E:79:62:83:51:C5:F8:BD:AF:03:CC:1C","sha256":"B0:A6:2D:C3:C3:B1:17:07:E2:69:90:65:3A:B7:8A:54:6F:59:44:5B:9C:6A:CF:3B:1B:C8:04:8E:30:9F:06:D9"}}},"request":{"raw":"GET /js/main.js HTTP/1.1\r\nHost: web.i-whatsapp.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://web.i-whatsapp.com.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 05 Jan 2026 12:29:26 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sun, 16 Mar 2025 10:49:28 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67d6acb8-1f458\"\r\nexpires: Tue, 06 Jan 2026 00:29:26 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":128088,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"d0117a3218db3fb3bf6757de07c481e2","sha1":"97d6f8b06249ec39ebdce4e9c10b03e10d515ef8","sha256":"2f6233c3c2f2ded13630778b83a60d2f0b93cc7eb00ba59e6a0355f41afba7d5","sha512":"74e99ff3b88e39fd2b670894820f32a60a05c687100931cf91e811a5c8f45f024e550a7ba6a311d805873b2933e0f503c07a9caf4091a12c5d50b20be36ad88c","ssdeep":"3072:YgRqiDilIWUKSPXye5ZkrPlepHzLJXHuoR:tDiaWU7Xye5ZkrPYz9Oe","tlshash":"8ec35180b7c2bc8116875b72732bb2e9f52d4de97589488bf500fc94f5ba911fae0931","first_seen":"2025-10-19T01:16:14.594234Z","last_seen":"2026-08-05T03:24:38.265267Z","times_seen":83,"resource_available":false,"data":null}},"time_used":545,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":545,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"web.i-whatsapp.com.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"web.i-whatsapp.com.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.dcobxs.com/matomo.js","fqdn":"web.dcobxs.com","domain":"dcobxs.com","tld":"com"},"ip":{"addr":"172.67.153.77","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web.i-whatsapp.com.cn/","date":"2026-01-05T12:29:26.705Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"dcobxs.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 01 Dec 2025 23:34:22 GMT","end":"Mon, 02 Mar 2026 00:32:50 GMT"},"fingerprint":{"sha1":"63:FB:BA:D8:A0:09:7B:02:F4:E4:F1:17:14:DE:FC:F5:10:E1:16:DF","sha256":"CF:58:92:44:58:FC:31:DC:C3:BC:BE:1D:27:51:07:C7:DD:BC:E2:89:A1:72:5F:4D:0D:1B:C2:A4:FB:94:A2:9F"}}},"request":{"raw":"GET /matomo.js HTTP/1.1\r\nHost: web.dcobxs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://web.i-whatsapp.com.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 521 No Reason Phrase\r\ndate: Mon, 05 Jan 2026 12:29:27 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 6978\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\nx-frame-options: SAMEORIGIN\r\nserver: cloudflare\r\ncf-ray: 9b92fb321f6f75ab-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"521","status_text":"No Reason Phrase","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T16:51:58.475838Z","times_seen":17873861,"resource_available":true,"data":null}},"time_used":333,"timings":{"blocked":27,"dns":10,"connect":1,"send":0,"wait":278,"receive":1,"ssl":14},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web.i-whatsapp.com.cn/logo192.png","fqdn":"web.i-whatsapp.com.cn","domain":"i-whatsapp.com.cn","tld":"com.cn"},"ip":{"addr":"154.221.8.129","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://web.i-whatsapp.com.cn/","date":"2026-01-05T12:29:28.000Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.i-whatsapp.com.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 05 Jan 2026 08:08:13 GMT","end":"Sun, 05 Apr 2026 08:08:12 GMT"},"fingerprint":{"sha1":"95:18:ED:BC:53:6A:6D:BE:6E:79:62:83:51:C5:F8:BD:AF:03:CC:1C","sha256":"B0:A6:2D:C3:C3:B1:17:07:E2:69:90:65:3A:B7:8A:54:6F:59:44:5B:9C:6A:CF:3B:1B:C8:04:8E:30:9F:06:D9"}}},"request":{"raw":"GET /logo192.png HTTP/1.1\r\nHost: web.i-whatsapp.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://web.i-whatsapp.com.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 05 Jan 2026 12:29:28 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 15 Mar 2025 09:39:20 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67d54ac8-14e3\"\r\nexpires: Wed, 04 Feb 2026 12:29:28 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5347,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 192 x 192, 8-bit colormap, non-interlaced","md5":"33dbdd0177549353eeeb785d02c294af","sha1":"7f4f2d68782a7fafceda84554ecab9b489877500","sha256":"c386396ec70db3608075b5fbfaac4ab1ccaa86ba05a68ab393ec551eb66c3e00","sha512":"e34572cf754ff7e1d0acb12d8275252230ad1dd9adc5858e807fef0fb61aea82cb1f9ca3ebab3eeb449460373140105f8d773e7bddbf6745f9e81cc1546621f4","ssdeep":"96:gMgJkzj81lSl2dxYAYKsHHVIqApHGoKf4slNb6LQbTehYx5AtKAdmTRwy/Ik2k3:gMct0nKsUwXTbnkeAMA+Twkv","tlshash":"deb18e4e37e13c238137de00aa8ee5ddff52c6ff81226144e24933e9243839d9591916","first_seen":"2023-04-21T11:39:01Z","last_seen":"2026-08-13T15:51:23.483577Z","times_seen":14057,"resource_available":false,"data":null}},"time_used":182,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":182,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"web.i-whatsapp.com.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"web.i-whatsapp.com.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.i-whatsapp.com.cn/js/UpdaterPromise.js","fqdn":"web.i-whatsapp.com.cn","domain":"i-whatsapp.com.cn","tld":"com.cn"},"ip":{"addr":"154.221.8.129","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web.i-whatsapp.com.cn/","date":"2026-01-05T12:29:26.508Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.i-whatsapp.com.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 05 Jan 2026 08:08:13 GMT","end":"Sun, 05 Apr 2026 08:08:12 GMT"},"fingerprint":{"sha1":"95:18:ED:BC:53:6A:6D:BE:6E:79:62:83:51:C5:F8:BD:AF:03:CC:1C","sha256":"B0:A6:2D:C3:C3:B1:17:07:E2:69:90:65:3A:B7:8A:54:6F:59:44:5B:9C:6A:CF:3B:1B:C8:04:8E:30:9F:06:D9"}}},"request":{"raw":"GET /js/UpdaterPromise.js HTTP/1.1\r\nHost: web.i-whatsapp.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://web.i-whatsapp.com.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 05 Jan 2026 12:29:26 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 25 Jun 2024 14:31:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"667ad4d0-12494\"\r\nexpires: Tue, 06 Jan 2026 00:29:26 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":74900,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"b751955868ca22533228a0b00b202246","sha1":"d2009cf3ce2d3fb12801fd4904f0f1af0dbb4f90","sha256":"6f5ddd748ae17d89c950678f62d8583aa7fef592597a29305df5cf0af1a691a4","sha512":"846d9030528ee05e44bed9e63c2ab5e570df85a2638c6f052549f6b677647f5b763d6761c19707595c79ef2f46b6a87cf3d34a57cf98107010f341b0b7b14043","ssdeep":"1536:JMN3MzMq3sfeJGS6q1h7lF/af9l4V3aiJLMFUZGARy9:J43+GfAxvy1qqilMoy9","tlshash":"da73528077d1b8c102875bb6b72bb1e6f82a5ce9b1c5484ef500f898f8b9915fed1931","first_seen":"2025-10-19T01:16:14.590733Z","last_seen":"2026-08-05T03:24:38.259911Z","times_seen":122,"resource_available":true,"data":null}},"time_used":548,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":548,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"web.i-whatsapp.com.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"web.i-whatsapp.com.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.i-whatsapp.com.cn/","fqdn":"web.i-whatsapp.com.cn","domain":"i-whatsapp.com.cn","tld":"com.cn"},"ip":{"addr":"154.221.8.129","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-05T12:29:25.455Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.i-whatsapp.com.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 05 Jan 2026 08:08:13 GMT","end":"Sun, 05 Apr 2026 08:08:12 GMT"},"fingerprint":{"sha1":"95:18:ED:BC:53:6A:6D:BE:6E:79:62:83:51:C5:F8:BD:AF:03:CC:1C","sha256":"B0:A6:2D:C3:C3:B1:17:07:E2:69:90:65:3A:B7:8A:54:6F:59:44:5B:9C:6A:CF:3B:1B:C8:04:8E:30:9F:06:D9"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: web.i-whatsapp.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 05 Jan 2026 12:29:26 GMT\r\ncontent-type: text/html\r\nlast-modified: Mon, 05 Jan 2026 09:05:56 GMT\r\nvary: Accept-Encoding\r\netag: W/\"695b7ef4-13ee\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Tailwind CSS","description":"Tailwind is a utility-first CSS framework.","website":"https://tailwindcss.com/","common_platform_enumeration":"","icon":"tailwindcss.svg","categories":["UI frameworks"]},{"name":"Lodash","description":"Lodash is a JavaScript library which provides utility functions for common programming tasks using the functional programming paradigm.","website":"https://www.lodash.com","common_platform_enumeration":"cpe:2.3:a:lodash:lodash:*:*:*:*:*:*:*:*","icon":"Lodash.svg","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Bootstrap:3.3.7","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery:3.2.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5102,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"b7d36cf8d9b6693bbd8783dc7128f3dd","sha1":"d052dbcebf97996dc41e131aedc5eb0d8bc761d4","sha256":"bc8990877e5750b616886950fbd492e4687881ce35bc453c0bba0392f1a8050d","sha512":"78f83d4f6ed23fc86255cc95305b6c3ed55548ecc2cecf648a55761ebeafeae6344805df38987cba6ce829f7f8291a003d390f7a4355161adf433957e4cc7d5e","ssdeep":"96:dnhVytQN2nNr1RjpkOS9hWD5SEhuyHorZQoAmath7JASAKJe:dMnjpkB9hWDoEhuSor2oTsObKQ","tlshash":"d0b140479cebdc68612045a579f6f819eca9b18bc924cc74f4dc48fa2fd2fc44893994","first_seen":"2026-01-05T12:29:56.241415Z","last_seen":"2026-01-05T16:16:16.17727Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1602,"timings":{"blocked":710,"dns":334,"connect":181,"send":0,"wait":181,"receive":0,"ssl":192},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"web.i-whatsapp.com.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"web.i-whatsapp.com.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.i-whatsapp.com.cn/css/main.css","fqdn":"web.i-whatsapp.com.cn","domain":"i-whatsapp.com.cn","tld":"com.cn"},"ip":{"addr":"154.221.8.129","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://web.i-whatsapp.com.cn/","date":"2026-01-05T12:29:26.493Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.i-whatsapp.com.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 05 Jan 2026 08:08:13 GMT","end":"Sun, 05 Apr 2026 08:08:12 GMT"},"fingerprint":{"sha1":"95:18:ED:BC:53:6A:6D:BE:6E:79:62:83:51:C5:F8:BD:AF:03:CC:1C","sha256":"B0:A6:2D:C3:C3:B1:17:07:E2:69:90:65:3A:B7:8A:54:6F:59:44:5B:9C:6A:CF:3B:1B:C8:04:8E:30:9F:06:D9"}}},"request":{"raw":"GET /css/main.css HTTP/1.1\r\nHost: web.i-whatsapp.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://web.i-whatsapp.com.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 05 Jan 2026 12:29:26 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 08 Jan 2025 20:37:52 GMT\r\nvary: Accept-Encoding\r\netag: W/\"677ee220-1db1\"\r\nexpires: Tue, 06 Jan 2026 00:29:26 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7601,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"bcae2c55fc15557c686667b5211d6666","sha1":"29bb2f9fe5e429b85fbf1a9735a6c6933ff93ec7","sha256":"1cb533af5df98df30a59d6414fe34f4d407c9ec8de77e537c58c914328429261","sha512":"2f3b0d22229a699b558ac1d25204c658921b282c04c818e8b39eb6e03d6893f26a5f2c11061af3d7022dddde681b45319416db8c9bc1bda55fab9265ae1ba004","ssdeep":"192:3gssXtsPqjDZrugVO4Dy4JscL7MsABM4pquQJNPi:3bx9ZcyU3vz1DHPi","tlshash":"23f103d15fb62508b4afd06d7851eb19a72dc582e64fcc786be1200cddc92cd19b7b88","first_seen":"2025-10-19T01:16:14.641958Z","last_seen":"2026-08-05T03:24:38.261362Z","times_seen":90,"resource_available":false,"data":null}},"time_used":182,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":182,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"web.i-whatsapp.com.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"web.i-whatsapp.com.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.i-whatsapp.com.cn/css/spinner_style.css","fqdn":"web.i-whatsapp.com.cn","domain":"i-whatsapp.com.cn","tld":"com.cn"},"ip":{"addr":"154.221.8.129","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://web.i-whatsapp.com.cn/","date":"2026-01-05T12:29:26.496Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.i-whatsapp.com.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 05 Jan 2026 08:08:13 GMT","end":"Sun, 05 Apr 2026 08:08:12 GMT"},"fingerprint":{"sha1":"95:18:ED:BC:53:6A:6D:BE:6E:79:62:83:51:C5:F8:BD:AF:03:CC:1C","sha256":"B0:A6:2D:C3:C3:B1:17:07:E2:69:90:65:3A:B7:8A:54:6F:59:44:5B:9C:6A:CF:3B:1B:C8:04:8E:30:9F:06:D9"}}},"request":{"raw":"GET /css/spinner_style.css HTTP/1.1\r\nHost: web.i-whatsapp.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://web.i-whatsapp.com.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 05 Jan 2026 12:29:26 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 08 Jan 2025 20:47:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"677ee474-986\"\r\nexpires: Tue, 06 Jan 2026 00:29:26 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2438,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"d3c0fb3e5e8fb8fdec95a92550ac26e6","sha1":"7a6462fd8ca17c42877736b6fa9a17eaf2aaf7cb","sha256":"92503cced30e330d6e7074bca3bcfe0611f21886f737c682b1ff83db1b49ca14","sha512":"635b40841c07044c9b8d25df45e39db9fe0b5765f57d8519e697512babfe9dbb02f243ce95bf948302a12517da3adbae76509b01375246a6a3c3fa670e819156","ssdeep":"","tlshash":"c5412b1e0d8124f6813b937687932c25fb3b5863434a26d5396fad780f32ad81276ef5","first_seen":"2025-10-19T01:16:14.624534Z","last_seen":"2026-08-05T03:24:38.254925Z","times_seen":90,"resource_available":false,"data":null}},"time_used":182,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":182,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"web.i-whatsapp.com.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"web.i-whatsapp.com.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.i-whatsapp.com.cn/static/css/main.4ab9b89d.css","fqdn":"web.i-whatsapp.com.cn","domain":"i-whatsapp.com.cn","tld":"com.cn"},"ip":{"addr":"154.221.8.129","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://web.i-whatsapp.com.cn/","date":"2026-01-05T12:29:26.498Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.i-whatsapp.com.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 05 Jan 2026 08:08:13 GMT","end":"Sun, 05 Apr 2026 08:08:12 GMT"},"fingerprint":{"sha1":"95:18:ED:BC:53:6A:6D:BE:6E:79:62:83:51:C5:F8:BD:AF:03:CC:1C","sha256":"B0:A6:2D:C3:C3:B1:17:07:E2:69:90:65:3A:B7:8A:54:6F:59:44:5B:9C:6A:CF:3B:1B:C8:04:8E:30:9F:06:D9"}}},"request":{"raw":"GET /static/css/main.4ab9b89d.css HTTP/1.1\r\nHost: web.i-whatsapp.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://web.i-whatsapp.com.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 05 Jan 2026 12:29:26 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 15 Mar 2025 13:47:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67d58500-74c\"\r\nexpires: Tue, 06 Jan 2026 00:29:26 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1868,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1823)","md5":"e5c7d3176160705a7932fc2e17a93774","sha1":"21a62d2bc514a07d9181edc2f9c84ff70db9cd3a","sha256":"0aec1499759884b05c5dc4795c5e6aacd16f2c93025a8bdbc8e95a17b8ba04cc","sha512":"11b07b7d3f270a5a4d4a2aa2de1072163e845dfcd1559e5cb301173fa43846caa24b8bf2746f24919f15612ddb67922550b0f645249162125838c1e90ce975e7","ssdeep":"","tlshash":"35318835eb08103fe17bc63b5295f80170262853da63876eb997b724cac35502a37b54","first_seen":"2025-10-19T01:16:14.631743Z","last_seen":"2026-08-05T03:24:38.256582Z","times_seen":90,"resource_available":false,"data":null}},"time_used":181,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":181,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"web.i-whatsapp.com.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"web.i-whatsapp.com.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.i-whatsapp.com.cn/lib/moment/js/moment-2.20.1.min.js","fqdn":"web.i-whatsapp.com.cn","domain":"i-whatsapp.com.cn","tld":"com.cn"},"ip":{"addr":"154.221.8.129","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web.i-whatsapp.com.cn/","date":"2026-01-05T12:29:26.506Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.i-whatsapp.com.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 05 Jan 2026 08:08:13 GMT","end":"Sun, 05 Apr 2026 08:08:12 GMT"},"fingerprint":{"sha1":"95:18:ED:BC:53:6A:6D:BE:6E:79:62:83:51:C5:F8:BD:AF:03:CC:1C","sha256":"B0:A6:2D:C3:C3:B1:17:07:E2:69:90:65:3A:B7:8A:54:6F:59:44:5B:9C:6A:CF:3B:1B:C8:04:8E:30:9F:06:D9"}}},"request":{"raw":"GET /lib/moment/js/moment-2.20.1.min.js HTTP/1.1\r\nHost: web.i-whatsapp.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://web.i-whatsapp.com.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 05 Jan 2026 12:29:26 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 25 Mar 2024 00:42:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6600c88a-c98f\"\r\nexpires: Tue, 06 Jan 2026 00:29:26 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":51599,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (51599), with no line terminators","md5":"5ff1de69e6fd137a6dd511205ea7c49e","sha1":"91a29a02cca99f32598f7b5764c610ab3cc89fba","sha256":"001564a706fd2bd3f1b9bbd1ac732493ac2659c207504f5e0713592d7610f389","sha512":"419fa651f350826ebb4ef5f375352a504886638e1d1394ef5d18197ba45d8e48d12fc99596da7fbc7530ec23f6f46c81706c2743971724200da8f3f43c9af0a4","ssdeep":"768:RmEj5IyZrV7dmUJ8/HhbmINN3vhg+XVspjiCumS5vcAKR1DC:wKxrV7d3g8ixXVspCmcti1+","tlshash":"cc3393ca3646b112176622b5083f490bf33d5959680f0d1df508e9e93979c6e827bfbc","first_seen":"2023-03-07T01:07:40Z","last_seen":"2026-08-13T12:00:29.213779Z","times_seen":960,"resource_available":true,"data":null}},"time_used":548,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":548,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"web.i-whatsapp.com.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"web.i-whatsapp.com.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.i-whatsapp.com.cn/js/WebSocketClient.js","fqdn":"web.i-whatsapp.com.cn","domain":"i-whatsapp.com.cn","tld":"com.cn"},"ip":{"addr":"154.221.8.129","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web.i-whatsapp.com.cn/","date":"2026-01-05T12:29:26.509Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.i-whatsapp.com.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 05 Jan 2026 08:08:13 GMT","end":"Sun, 05 Apr 2026 08:08:12 GMT"},"fingerprint":{"sha1":"95:18:ED:BC:53:6A:6D:BE:6E:79:62:83:51:C5:F8:BD:AF:03:CC:1C","sha256":"B0:A6:2D:C3:C3:B1:17:07:E2:69:90:65:3A:B7:8A:54:6F:59:44:5B:9C:6A:CF:3B:1B:C8:04:8E:30:9F:06:D9"}}},"request":{"raw":"GET /js/WebSocketClient.js HTTP/1.1\r\nHost: web.i-whatsapp.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://web.i-whatsapp.com.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 05 Jan 2026 12:29:26 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 26 Jun 2024 07:32:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"667bc41e-220b3\"\r\nexpires: Tue, 06 Jan 2026 00:29:26 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":139443,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"d26219a6baeda6762dccb88c3cd692a8","sha1":"c3e5f409115d29e117607cc2eca6ef5317af210b","sha256":"e597eb5fcb211106d53ea3940d0bde89b178b093c12ada9de57f81169302ffca","sha512":"6db1170ab0c4571fc3aeed48e785dbf62bc3d03564d1c9b0dee993134db75bf85dea93e345ef801bbb7bc384446c1894705da2725900e2937303b207358962f8","ssdeep":"3072:NLnP1eVKU+ytfF6DyIA7kvo1kis3hQdhnNFn:99VytfL7kA1U3ydhnNFn","tlshash":"6ad3938177c6b88122471bb7772bb1e9f92e4dd870c9088bf154bc98f5b9911fae4930","first_seen":"2025-10-19T01:16:14.653859Z","last_seen":"2026-08-05T03:24:38.260804Z","times_seen":119,"resource_available":false,"data":null}},"time_used":548,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":548,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"web.i-whatsapp.com.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"web.i-whatsapp.com.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.i-whatsapp.com.cn/lib/jquery/js/jquery-3.2.1.min.js","fqdn":"web.i-whatsapp.com.cn","domain":"i-whatsapp.com.cn","tld":"com.cn"},"ip":{"addr":"154.221.8.129","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web.i-whatsapp.com.cn/","date":"2026-01-05T12:29:26.501Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.i-whatsapp.com.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 05 Jan 2026 08:08:13 GMT","end":"Sun, 05 Apr 2026 08:08:12 GMT"},"fingerprint":{"sha1":"95:18:ED:BC:53:6A:6D:BE:6E:79:62:83:51:C5:F8:BD:AF:03:CC:1C","sha256":"B0:A6:2D:C3:C3:B1:17:07:E2:69:90:65:3A:B7:8A:54:6F:59:44:5B:9C:6A:CF:3B:1B:C8:04:8E:30:9F:06:D9"}}},"request":{"raw":"GET /lib/jquery/js/jquery-3.2.1.min.js HTTP/1.1\r\nHost: web.i-whatsapp.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://web.i-whatsapp.com.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 05 Jan 2026 12:29:26 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 25 Mar 2024 00:42:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6600c88a-15283\"\r\nexpires: Tue, 06 Jan 2026 00:29:26 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":86659,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (32058)","md5":"c9f5aeeca3ad37bf2aa006139b935f0a","sha1":"1055018c28ab41087ef9ccefe411606893dabea2","sha256":"87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de","sha512":"dcff2b5c2b8625d3593a7531ff4ddcd633939cc9f7acfeb79c18a9e6038fdaa99487960075502f159d44f902d965b0b5aed32b41bfa66a1dc07d85b5d5152b58","ssdeep":"1536:YNhEyjjTikEJO4edXXe9J578go6MWX2xkj8e4c4j2ll2AckaXEP6n15HZ+FhFcQ7:uxc2yjx4j2uX/kcQDU8Cu9","tlshash":"4483e6d9b2c67062977730b950bf410bb17a98dab44c8c60f158d9d47eb8a8d907bf2c","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-08-13T15:42:11.193965Z","times_seen":99477,"resource_available":true,"data":null}},"time_used":548,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":548,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"web.i-whatsapp.com.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"web.i-whatsapp.com.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.i-whatsapp.com.cn/lib/jquery-colResizable/js/jquery-colResizable-1.6.min.js","fqdn":"web.i-whatsapp.com.cn","domain":"i-whatsapp.com.cn","tld":"com.cn"},"ip":{"addr":"154.221.8.129","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web.i-whatsapp.com.cn/","date":"2026-01-05T12:29:26.502Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.i-whatsapp.com.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 05 Jan 2026 08:08:13 GMT","end":"Sun, 05 Apr 2026 08:08:12 GMT"},"fingerprint":{"sha1":"95:18:ED:BC:53:6A:6D:BE:6E:79:62:83:51:C5:F8:BD:AF:03:CC:1C","sha256":"B0:A6:2D:C3:C3:B1:17:07:E2:69:90:65:3A:B7:8A:54:6F:59:44:5B:9C:6A:CF:3B:1B:C8:04:8E:30:9F:06:D9"}}},"request":{"raw":"GET /lib/jquery-colResizable/js/jquery-colResizable-1.6.min.js HTTP/1.1\r\nHost: web.i-whatsapp.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://web.i-whatsapp.com.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 05 Jan 2026 12:29:26 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 25 Mar 2024 00:42:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6600c88a-16b9\"\r\nexpires: Tue, 06 Jan 2026 00:29:26 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5817,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (5715)","md5":"e289cb315e61253151fadc9b9a63824d","sha1":"ccb6f3fd5f91c7463c1aacadea25d9d63d2b8601","sha256":"df43b04a42d0088dd8b12f7ef3c04c2d2743c1af009acc07a331b8e4da4e9830","sha512":"cdcd859363202ad88be1550be4281d048f2494b5f2b6fbb30933fc65481bafc20247ceda1357d5d065d0a9887fe00e0fc91edb7a227a50207aa3c7df5a786edf","ssdeep":"96:mgfPd892kG0eutk0+DM2Cl7YCfZ4s+WYigQhfp6ir5tzPn5Y2KWDBsomB:mgfP/kcNDMYCfiRbigwp6Cnn5Y5WDOo0","tlshash":"03c1e8497350780f9557a15a382bb91efa220a21eb3bc16ce13ad37d4cf89c48175ebd","first_seen":"2023-03-13T08:49:18Z","last_seen":"2026-08-05T03:24:38.264188Z","times_seen":108,"resource_available":true,"data":null}},"time_used":548,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":548,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"web.i-whatsapp.com.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"web.i-whatsapp.com.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.i-whatsapp.com.cn/lib/bootstrap/js/bootstrap-3.3.7.min.js","fqdn":"web.i-whatsapp.com.cn","domain":"i-whatsapp.com.cn","tld":"com.cn"},"ip":{"addr":"154.221.8.129","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web.i-whatsapp.com.cn/","date":"2026-01-05T12:29:26.503Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.i-whatsapp.com.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 05 Jan 2026 08:08:13 GMT","end":"Sun, 05 Apr 2026 08:08:12 GMT"},"fingerprint":{"sha1":"95:18:ED:BC:53:6A:6D:BE:6E:79:62:83:51:C5:F8:BD:AF:03:CC:1C","sha256":"B0:A6:2D:C3:C3:B1:17:07:E2:69:90:65:3A:B7:8A:54:6F:59:44:5B:9C:6A:CF:3B:1B:C8:04:8E:30:9F:06:D9"}}},"request":{"raw":"GET /lib/bootstrap/js/bootstrap-3.3.7.min.js HTTP/1.1\r\nHost: web.i-whatsapp.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://web.i-whatsapp.com.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 05 Jan 2026 12:29:26 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 25 Mar 2024 00:42:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6600c88a-90b5\"\r\nexpires: Tue, 06 Jan 2026 00:29:26 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":37045,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (32033)","md5":"5869c96cc8f19086aee625d670d741f9","sha1":"430a443d74830fe9be26efca431f448c1b3740f9","sha256":"53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef","sha512":"8b3b64a1bb2f9e329f02d4cd7479065630184ebaed942ee61a9ff9e1ce34c28c0eecb854458977815cf3704a8697fa8a5d096d2761f032b74b70d51da3e37f45","ssdeep":"768:o2rGy27UwlNqMl95qNmCFejhqs8snmi+CSFXfbx8Gf3Zq7Q:Jg73zhq0GvbJ3ZKQ","tlshash":"b6f28606b23031a147efb1e1525b020e7239696ee906907c78b99af53db9c48717bf3d","first_seen":"2023-03-07T01:02:54Z","last_seen":"2026-08-13T15:40:55.886765Z","times_seen":97887,"resource_available":true,"data":null}},"time_used":548,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":548,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"web.i-whatsapp.com.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"web.i-whatsapp.com.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web.i-whatsapp.com.cn/lib/bootstrap/js/bootbox-4.4.0.min.js","fqdn":"web.i-whatsapp.com.cn","domain":"i-whatsapp.com.cn","tld":"com.cn"},"ip":{"addr":"154.221.8.129","port":443,"asn":137951,"as":"ASLINE LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web.i-whatsapp.com.cn/","date":"2026-01-05T12:29:26.504Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.i-whatsapp.com.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 05 Jan 2026 08:08:13 GMT","end":"Sun, 05 Apr 2026 08:08:12 GMT"},"fingerprint":{"sha1":"95:18:ED:BC:53:6A:6D:BE:6E:79:62:83:51:C5:F8:BD:AF:03:CC:1C","sha256":"B0:A6:2D:C3:C3:B1:17:07:E2:69:90:65:3A:B7:8A:54:6F:59:44:5B:9C:6A:CF:3B:1B:C8:04:8E:30:9F:06:D9"}}},"request":{"raw":"GET /lib/bootstrap/js/bootbox-4.4.0.min.js HTTP/1.1\r\nHost: web.i-whatsapp.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://web.i-whatsapp.com.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Mon, 05 Jan 2026 12:29:26 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 25 Mar 2024 00:42:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6600c88a-26f4\"\r\nexpires: Tue, 06 Jan 2026 00:29:26 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9972,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (9748)","md5":"8055e87f2396a627e93c85890189e625","sha1":"842ff4db865468086582581a540e5b87a128f5ce","sha256":"0b6bab63e3aa24b4ab6aab63765a217db5004961bab1ab7d74ffebfa33efb5c4","sha512":"9a18db6c96ebae906c28f9f6396818dbe838db8c32429927755c6d70ca4894a8fe028678b409c3a93790d8a91ee00ff71f761a21d5c746f9f2de436920617f79","ssdeep":"192:SkLnr8QmxYY72OlfojjuXBacAEkEVg3pXrzTGv6:Sk/8BKrypxPLC3pz46","tlshash":"79228281e819e13726737872308f9706303ad569e65948225241e2d59ffaddc43ffb3a","first_seen":"2023-03-07T12:04:36Z","last_seen":"2026-08-11T20:03:24.906878Z","times_seen":1060,"resource_available":true,"data":null}},"time_used":548,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":548,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-05","alert":"Phishing Block","trigger":"web.i-whatsapp.com.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-05","alert":"Sinkholed","trigger":"web.i-whatsapp.com.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/qrcodejs/1.0.0/qrcode.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web.i-whatsapp.com.cn/","date":"2026-01-05T12:29:26.513Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Nov 2025 20:49:06 GMT","end":"Fri, 13 Feb 2026 21:49:04 GMT"},"fingerprint":{"sha1":"9A:71:C8:6F:E2:4B:9A:91:7D:C8:4A:1D:79:98:2F:97:C1:85:D8:79","sha256":"4E:C5:BB:7A:81:A0:D9:00:73:8D:D5:57:59:3D:A0:C3:D3:BE:62:18:4E:6F:6D:98:DA:F0:90:94:5E:E0:0B:63"}}},"request":{"raw":"GET /ajax/libs/qrcodejs/1.0.0/qrcode.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://web.i-whatsapp.com.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 05 Jan 2026 12:29:26 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 6083\r\ncf-ray: 9b92fb30ba6756b5-OSL\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\netag: \"5eb03fad-4dd7\"\r\nlast-modified: Mon, 04 May 2020 16:15:41 GMT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/kv\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 1675756\r\nexpires: Sat, 26 Dec 2026 12:29:26 GMT\r\naccept-ranges: bytes\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=P1ghSCgbXV6ATdAOAJf5Ruga5kLS%2FMzMgJ6yIVQD1N6hwU27De7T8%2FO%2BpFodzIeLure7ozRXp%2B02Wv8TbaYA%2BGCLpmbj5RW%2B9GrAqSftMJYfQx2Meo5n%2FyRPailMOUgoCANp4AMB\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nstrict-transport-security: max-age=15780000\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19927,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with very long lines (19927), with no line terminators","md5":"517b55d3688ce9ef1085a3d9632bcb97","sha1":"2d06c1f823f34c19981c6ae0b0eb0f5861c5e14b","sha256":"c541ef06327885a8415bca8df6071e14189b4855336def4f36db54bde8484f36","sha512":"08d80845e706a3b9e985b799d3849cd7791ad3ba5aa9d793bb4591d4833890d7299810144874905f416c94d8530da74be0ee520066a91ade05a1da8bf0ccb498","ssdeep":"384:WRQ2kvcAAdTRhQLThP2yO9/9G84U5xOiKQYHHHsglDep9m1yfB8dKLMyA+LyUyy9:xThP2V/9N4U/gQYPXa8CAPLyrZ","tlshash":"8c92c7e4f36542f6915e6cd4283f104b64a0a4636c1490acbfb5c1e6a9f8fe0647af74","first_seen":"2023-03-07T01:14:56Z","last_seen":"2026-08-13T14:50:05.814649Z","times_seen":66342,"resource_available":true,"data":null}},"time_used":36,"timings":{"blocked":3,"dns":1,"connect":1,"send":0,"wait":11,"receive":1,"ssl":16},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/uuid/8.3.2/uuid.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web.i-whatsapp.com.cn/","date":"2026-01-05T12:29:26.514Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sat, 15 Nov 2025 20:49:06 GMT","end":"Fri, 13 Feb 2026 21:49:04 GMT"},"fingerprint":{"sha1":"9A:71:C8:6F:E2:4B:9A:91:7D:C8:4A:1D:79:98:2F:97:C1:85:D8:79","sha256":"4E:C5:BB:7A:81:A0:D9:00:73:8D:D5:57:59:3D:A0:C3:D3:BE:62:18:4E:6F:6D:98:DA:F0:90:94:5E:E0:0B:63"}}},"request":{"raw":"GET /ajax/libs/uuid/8.3.2/uuid.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://web.i-whatsapp.com.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Mon, 05 Jan 2026 12:29:26 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 2933\r\ncf-ray: 9b92fb30ba6b56b5-OSL\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\netag: \"5fe06b73-1fe0\"\r\nlast-modified: Mon, 21 Dec 2020 09:31:31 GMT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/kv\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 1668305\r\nexpires: Sat, 26 Dec 2026 12:29:26 GMT\r\naccept-ranges: bytes\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=86KcmA9mpuhX70KBShhZvqHFGoGDPX9bF2XZ9H5ZuIF375T%2BHeSDp39fXMiXLl917I7Ue6HkydnI6hOpx0AU5EekvBvqxIiq61Ueq1gf59g61lwI23CeuB74Sb0jXhwzgNOYDrPJ\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nstrict-transport-security: max-age=15780000\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8160,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (8160), with no line terminators","md5":"50fecb6517141ce734bdc903aeb7aa6d","sha1":"ffce0e94a0a6f3b661942c5f9344e709773ec44a","sha256":"c5df6d9704bdada96df0770523058f395192ee9d1fe13880eb1d57dfe6417533","sha512":"50d3359e302038551aef86746c00f002af206d372a642f048f8c4f4b3a6787497a28c7afc2f901bdb95d17db91fbea8a789f8c3991d18d5d47663a11be30df35","ssdeep":"192:NT/XsoaxLo7L1AsLVllMA5/VYZncbsPYxb2g9n/m5iCyK08l9l4E+kghMnf4W5Qe:VX9aNo7LWsLPnYZncbs5UeiCyK0Q9l4W","tlshash":"d7f193ac6c8960afc3ef1e5d18aa304b72f07511244d8415f2a5b9fa1490eff9b36e1d","first_seen":"2023-03-29T21:08:33Z","last_seen":"2026-08-12T18:15:40.159729Z","times_seen":841,"resource_available":true,"data":null}},"time_used":36,"timings":{"blocked":3,"dns":0,"connect":1,"send":0,"wait":13,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.tailwindcss.com/","fqdn":"cdn.tailwindcss.com","domain":"tailwindcss.com","tld":"com"},"ip":{"addr":"104.26.2.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://web.i-whatsapp.com.cn/","date":"2026-01-05T12:29:26.497Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tailwindcss.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 23 Nov 2025 07:09:58 GMT","end":"Sat, 21 Feb 2026 08:09:55 GMT"},"fingerprint":{"sha1":"B5:C9:29:A1:B9:60:7F:A7:9E:9E:63:3E:DF:4E:05:34:4B:27:D3:86","sha256":"2D:FA:43:BC:F1:83:E4:D9:E0:ED:1A:D1:C5:0E:F5:E0:77:29:F1:F1:23:2F:E3:30:7B:72:49:1E:82:5C:DB:C1"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: cdn.tailwindcss.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://web.i-whatsapp.com.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\ndate: Mon, 05 Jan 2026 12:29:26 GMT\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncache-control: public, max-age=14400\r\nlocation: /3.4.17\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: MISS\r\nx-vercel-id: fra1::iad1::jzjth-1767608701970-801fc25b0c17\r\nexpires: Mon, 05 Jan 2026 14:25:02 GMT\r\nage: 7464\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=F0G3LuPF%2BF%2Fge8bB6gez3MoPIE4UK2GO4fdJolOE1T1GDeXae3JeCFmiSRUv%2BqjivYeyduV9g831KoRhUtBWRZjezOumkYjITSEKzlRzD2aC8Q%3D%3D\"}]}\r\ncf-ray: 9b92fb30af205ebd-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":407279,"size_decoded":0,"mime_type":"text/javascript","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T16:51:58.475838Z","times_seen":17873861,"resource_available":true,"data":null}},"time_used":30,"timings":{"blocked":7,"dns":0,"connect":1,"send":0,"wait":5,"receive":0,"ssl":14},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}