{"report_id":"2b4812a3-2c2f-464a-a82b-26e495e32dcb","version":0,"status":"done","tags":[],"date":"2026-10-14T19:42:27Z","url":{"schema":"http","addr":"w3-okx.com.cn/","fqdn":"w3-okx.com.cn","domain":"w3-okx.com.cn","tld":"com.cn"},"ip":{"addr":"179.61.182.123","port":0,"asn":153656,"as":"OWGELS INTERNATIONAL CO., LIMITED","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"w3-okx.com.cn/","fqdn":"w3-okx.com.cn","domain":"w3-okx.com.cn","tld":"com.cn"},"title":"欧易 · okx · 欧易交易所","dom":{"size":46204,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (406)","md5":"d7d31540151b5eb6a59872e14c42f4dd","sha1":"95669d4a49044143b66c74228c43af7c3ffb77bd","sha256":"351540eb785d98d376e0825a2cf356e94336e7c97f246b17349b525253dd556c","sha512":"330245b06d2cb8f16d5ad6b87f926233e4fad8e07f7619cdc7be586cddc067c301fe370e0fd9a9155ee179a4889eba3ab64b7c0c0503d07f4f8de15a33db40cb","ssdeep":"384:pZoGB6DhgiQcZxXoqANZFtTfqxiuJrNpkQdudxPxwWj88O8ROINieC3MpUJKPGQ5:RyJOzNZFtu5xpTQzj8KNyMRU7amE","tlshash":"5c23fa61d1f1683a3063c1d8a6d5635e3574e803c81b1618bb6e12998fcffeb6a2734d","dom_hash":"domhashb7575a5a5f032caa3308505199ae7e37","first_seen":"2026-10-14T19:42:31.593186Z","last_seen":"2026-10-14T19:42:32.27157Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"w3-okx.com.cn/","fqdn":"w3-okx.com.cn","domain":"w3-okx.com.cn","tld":"com.cn"},"ip":{"addr":"179.61.182.123","port":0,"asn":153656,"as":"OWGELS INTERNATIONAL CO., LIMITED","country":"Hong Kong","country_code":"HK"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-18T19:42:27Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-14","alert":"Sinkholed","trigger":"w3-okx.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"w3-okx.com.cn","ip":{"addr":"179.61.182.123","port":443,"asn":214318,"as":"Netcode LLC","country":"United Arab Emirates","country_code":"AE"},"domain_registered":"2026-10-12","domain_rank":0,"first_seen":"2026-10-14T19:42:27.331624Z","last_seen":"2026-10-14T19:42:27.331624Z","alert_count":1,"request_count":1,"received_data":46801,"sent_data":482,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"w3-okx.com.cn/","fqdn":"w3-okx.com.cn","domain":"w3-okx.com.cn","tld":"com.cn"},"ip":{"addr":"179.61.182.123","port":443,"asn":214318,"as":"Netcode LLC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":true,"md5":"93890ccf46dbd03b647a0b2b1eca939e","sha1":"aa78ca60c29dd98484caa18aa49f40b5ed63ca42","sha256":"5865e534387ef49a64fc3caa3aedee3d87885c8c453059a368e8ca5806ed242c","sha512":"6540e7890a1a5281b6dbc2da083a7a2f0bf5e39a5f319e05ef3f28837ea50acb84a84c2854566eedc3ce02b33f7f389fd9329282895982dd399a15636d9f4fd3","ssdeep":"","tlshash":"15210f5b74e470fe05b721fa825f32893e25009a1842c622bd6ce7915fe067a0a76ecd","size":1244,"data":"","first_seen":"2026-10-14T19:42:31.615761Z","last_seen":"2026-10-14T19:42:32.277146Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"w3-okx.com.cn/","fqdn":"w3-okx.com.cn","domain":"w3-okx.com.cn","tld":"com.cn"},"ip":{"addr":"179.61.182.123","port":443,"asn":214318,"as":"Netcode LLC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-14T19:41:47.547Z","timestamp":1792006907547,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"w3-okx.com.cn","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Sun, 11 Oct 2026 23:00:00 GMT","end":"Sat, 09 Jan 2027 22:59:59 GMT"},"fingerprint":{"sha1":"99:2D:7F:96:2E:C8:D9:F8:F4:FA:74:7E:EE:45:7F:07:3B:D0:AA:77","sha256":"B8:E8:C3:27:3E:BF:D3:D6:84:B5:FB:09:89:92:BE:8C:ED:82:5A:3F:37:2D:3A:13:6B:97:34:5F:EE:9E:6A:F2"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: w3-okx.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 14 Oct 2026 19:14:38 GMT\r\ncontent-type: text/html\r\nlast-modified: Mon, 12 Oct 2026 00:08:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6acc2508-b516\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":46358,"size_decoded":13117,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (406)","md5":"0ea09e22f185e3eee73b4667712bed47","sha1":"9918986db8573164363ed27abc635951e5154a90","sha256":"5845d584d61a116e924c434e8b7456a63d53521e247f4df9c940cfd9c9b53343","sha512":"79f50f04919d06881258d5230a1aa8c2480be8cabbcc431e05718ce1bc23dff44dfe923f96f0978b20cf9157691f960f263a2b14e3f08e569ecdb45947810c55","ssdeep":"384:XZoGB6DhgiQcZxXoqANZFtTfqxiuJr1vkOdudf7tkxVO8/JROIRXhC3MpUJK1LQ3:zyJOzNZFtu5JvhQ+VOcRqMaU7amS","tlshash":"9623f961d2f1683a3063c5d4a6d5635e3574e803c81b0618bb6e12a94fcffeb6a2734d","first_seen":"2026-10-14T19:42:31.609374Z","last_seen":"2026-10-14T19:42:32.275313Z","times_seen":2,"resource_available":true,"data":null}},"time_used":1854,"timings":{"blocked":-1,"dns":1063,"connect":260,"send":0,"wait":258,"receive":0,"ssl":272},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-14","alert":"Sinkholed","trigger":"w3-okx.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}