{"report_id":"35ef1fc0-113a-4b3a-af54-8fe6a03314d6","version":0,"status":"done","tags":[],"date":"2026-09-26T21:41:44Z","url":{"schema":"http","addr":"znjj99.com/","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":0,"asn":9294,"as":"GNET INC.","country":"Seychelles","country_code":"SC"},"final":{"url":{"schema":"https","addr":"znjj99.com/","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"title":"pa视讯(中国)集团官网 - playace","dom":{"size":160,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with no line terminators","md5":"af0c65e24d965a360e630e016ed14fe8","sha1":"1f0a364fb25f04e1b6de7c686e0b1b3bf541f281","sha256":"f82b4ebc965a15b4589b675c6c8fa684cbab759b173fd600f4d3dcc1c2a4d803","sha512":"5b913f8d14212393136a1359885f9c17488a2385809ab2e3a40055b1b8e44eaadf16a6162fd2a717b952fadfaef26b842a351b5daa7313d6b33b1f3091663874","ssdeep":"","tlshash":"bec080e79069440d925166b14e81710445c9b55977834c006dc8319e1554325c4935cc","dom_hash":"domhash8c2e87ac90d2b77a4d92dfea1f50d3d7","first_seen":"2025-10-30T02:22:24.884439Z","last_seen":"2026-09-26T21:58:51.229591Z","times_seen":713,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"znjj99.com/","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":0,"asn":9294,"as":"GNET INC.","country":"Seychelles","country_code":"SC"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-31T21:41:44Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"31pu2ilhjrkmwpf"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"www.whhsg.com","ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"domain_registered":"2010-12-02","domain_rank":0,"first_seen":"2025-11-02T11:13:33.193229Z","last_seen":"2026-08-14T21:46:10.861046Z","alert_count":0,"request_count":42,"received_data":801639,"sent_data":23289,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"znjj99.com","ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"domain_registered":"2024-11-10","domain_rank":0,"first_seen":"2026-06-22T13:32:56.407128Z","last_seen":"2026-06-22T13:32:56.407128Z","alert_count":58,"request_count":58,"received_data":693415,"sent_data":35198,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"GSAP","description":"GSAP is an animation library that allows you to create animations with JavaScript.","website":"https://greensock.com/gsap","common_platform_enumeration":"","icon":"TweenMax.png","categories":["JavaScript frameworks"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Material Design Lite","description":"Material Design Lite is a library of components for web developers.","website":"https://getmdl.io","common_platform_enumeration":"","icon":"Material Design Lite.png","categories":["UI frameworks"]},{"name":"Swiper","description":"Swiper is a JavaScript library that creates modern touch sliders with hardware-accelerated transitions.","website":"https://swiperjs.com","common_platform_enumeration":"","icon":"Swiper.svg","categories":["JavaScript libraries"]}]},{"fqdn":"34.92.232.92","ip":{"addr":"34.92.232.92","port":16666,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"Hong Kong","country_code":"HK"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":1,"received_data":284,"sent_data":558,"comment":"","tags":null,"fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"znjj99.com/","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"868d0f358e62f4c380bc8ce9f12122f7","sha1":"5f8c819c09c0212f49d3e007777561d6dd4d7474","sha256":"0482a1f5f18c5e751264f305bbbc9c35ea334783315d3dd53ce7871f9ff7d035","sha512":"732ea795dcbb37e3a71a50c1d7bd63dae8a4c1093a0bff305cebea006af7a3fbc6b9da61bc0210813eac4e43e1ec6e3cf42fd56fdaf681c12a633a459696821f","ssdeep":"","tlshash":"31c08c58ae3789a0c8320a2b8c34ec5c00b68d22c004e64c40873a0c1108bc44b083a4","size":160,"data":"","first_seen":"2024-12-08T03:18:54.033239Z","last_seen":"2026-09-26T21:41:57.551065Z","times_seen":1798,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"2d313be4b5d93e9b681de954aaeb3006","sha1":"1e0508be1026244daf1812f988033612c3945bdb","sha256":"9059d0d74efaf0e229d59a9c05ace7b975b42ccacea21e01aa64c56b2157048c","sha512":"83b5d773d5184b8feefc9c7fa2637098ad1c9ca5839ac5dd68f59372c7b4329b8298f1236c8d9247b3b2fd6afc159b9dc8cabbd6a8bbe8e5e2707dd6a7fbc82b","ssdeep":"","tlshash":"b99002c9f196a475e2b96030551b9205a0164c4d8c3c415c6100347e381559a8857679","size":57,"data":"","first_seen":"2023-03-07T01:19:11Z","last_seen":"2026-09-26T22:49:35.183007Z","times_seen":12526,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/js/swiper.min.js","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"25fbafbf6c1618ed3d021c697bb559d8","sha1":"0becd40f962b16fd219c563fcbbdb7fa23b24f98","sha256":"b4dd9413fa86c56b573dae23061ac03d6198968453b20d88e33a78672a032ed6","sha512":"c13019a301aa3d523d212d24634ace9d1e2f666a5fb6c567f36629e23c1f9610064294e5afc8dd093c52a536365350c705b55d1ee065073fccce043d43535204","ssdeep":"1536:eyOkN3TklR3ZIFDJ+Y7n2L5ydUTq0tSQfCBT+:LTX73uTqA","tlshash":"2793d66eb314f3e295d3214a675ac64122f21706b849dae830b54c4a68bcc5d03bffbd","size":96445,"data":"","first_seen":"2026-09-26T21:41:57.492205Z","last_seen":"2026-09-26T21:41:57.492205Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"introduction_type":"eval","is_inline":false,"md5":"b5a35fd1107af63408debb4ae16169cf","sha1":"fd10eba9bf23f94d945a3a47d996c6cb5a76f049","sha256":"8b7e316f5c25d1bbe4c1fc164a82f8c68e2381f76ace02939f23b3eab1a5ebb0","sha512":"5fa1dafb28696bf24fee04da5dfed4fb11b659076840e5b3df363cbb40a8ce5d20e04fede628f6bb1d70f8344c4f881b0af63ff570bca152bb981c7c4a838d27","ssdeep":"96:fo58Cd5/d/DGhs4ZY+6p1WRBDHDbl3LUTL1ba6f06jX3:w5/BDGhJZY+5RBT41bjLD","tlshash":"2fb1a8692a923532c1d7f254a46fc201793c9493b9cbe830b29cd8c91db4cb6a653f0d","size":5324,"data":"","first_seen":"2023-03-11T10:56:10Z","last_seen":"2026-09-26T21:41:57.556707Z","times_seen":41,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/fafafa.js","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"f670d84496266f70a3b0922149caa27e","sha1":"c73aaf670be912a2de3839c7ecf2f4f9b3daf250","sha256":"b607b38d0337a8d0fc223178ef72869b7a7bc769557ed88f67f1452f8b41c0a2","sha512":"868203312b73c825ac3535e6e28bf6299037d64a4cf885ce797f6d76c5bc2c97502db8bc97ca5337b01e67852d2dc05c11557087d450e48e52b76eecf18a11e9","ssdeep":"","tlshash":"c731ffeb0863a418e372402d753a974c75b40057ab35d501ac9cada9afa4f54a4efbcc","size":1581,"data":"","first_seen":"2026-09-23T04:25:36.382257Z","last_seen":"2026-09-26T21:41:57.538413Z","times_seen":14,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/js/jquery.min.js","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e4b89b8ce58d87ef069e51c2ccfce87e","sha1":"1812664f158728a90ac43b0ac1971730ed292511","sha256":"407a809ecdc55451ccf934fdbd7e76a3e09769686741996f38505eb23d13b6ef","sha512":"919eec0e6d8b9b9d379a7782913ae73c662d985871f9572ea8b98b31baba9443b41dd01fd52b24c5e25dfdbd385a07ef55b922ea143e3fda1e4f130febd5f596","ssdeep":"","tlshash":"708000c08ec802e002808caa28803c20022a20af08c00208000088c00aeaaa0a000822","size":26,"data":"","first_seen":"2025-10-26T23:28:00.096385Z","last_seen":"2026-09-26T21:41:57.474403Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/js/jquery.cookie.js","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e8afe4c2d4d325117ffc78d247792cde","sha1":"3f5ad0301370cc62f5649a76b06b7c61974cb755","sha256":"0f69ba112e56efac31ab5271d04d03323d2be265b35ac4a16ecb16578b332929","sha512":"da885d1fb3d26cc011d5a7383b9cda950edd95569b7db1dbac040a193c08144da44e961a8540f3de77c4cf4bb96ce91c2179c6e3198fc5cc4de8f2e5991d2926","ssdeep":"","tlshash":"e5517850b7cc321e06ab22416b6f10ace63cff721158449d8c1965f82cb0c7bdb6bd6a","size":3147,"data":"","first_seen":"2026-09-26T21:41:57.490928Z","last_seen":"2026-09-26T21:41:57.490928Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/js/jquery.lplugs.js","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"4af4657c7370973ff13c20deb169d627","sha1":"c7de4fc677a650a83e7bf37a88f40a60c6155053","sha256":"1e2aca95315b0af26e9312e37ad83cf55bcfb175355cf2ba3cc5cba067018d18","sha512":"56ef31b994b82c3bfa0d9e690d960c3f2d7d058f428511cff91443d5d073291615a624efb4782bf58e65316fa4ffed24db99a0838f38c0eb974037d23b9fb800","ssdeep":"1536:DEPy5wnafzwzECh3/sSXj6vcD6pAZMGDqk20AGHCAGHmdde+HdHMpyggq613HhXg:WCCxj5ROkxBHCBHmd9MEggq6BBXUH","tlshash":"75d33a89b201327782eba3f5506f020a3237e57a5509406cf47cdde1af789a9526bf7c","size":131398,"data":"","first_seen":"2026-09-26T21:41:57.485753Z","last_seen":"2026-09-26T21:41:57.485753Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/js/TweenMax.min.js","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"0192d4dbd4a4213fb399c16266978e26","sha1":"0725b89e07a7e74445e4d7e98b6bd6e9c7a7e531","sha256":"fde03e8d23fbaad1095797e81b0844ef98b2ca661240a2b2242d6f036bc92cbb","sha512":"1ca96c252e8fb4a4e384a2ffaa4d7c4ffa171c96c5e5c97a3b24a98450e6dfd411c51e3d23c5b007d02f9a432f5d1516987eb169c8b0ee16e320594425327abd","ssdeep":"1536:o9mT8B8nFVN8nUH+yMP/rsfqX8InCrEHIbZz18+CPc+YERim:o48BAFkUeH/rsy68wvf+1im","tlshash":"9ca3f8ca7211701145d711da597f0a43b33799a9b40a492cf258c9de3d2caca22fff76","size":103725,"data":"","first_seen":"2026-09-26T21:41:57.512887Z","last_seen":"2026-09-26T21:41:57.512887Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/yyds.js","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"2ebcf831f70a9e076c60779382e50d6e","sha1":"f987573f4a659408bd577f8dfaaec201b9c93f8a","sha256":"a1f7703e10151084eee03b1edcee20d3f7a7a917dba665165ca32f6a8b07f952","sha512":"b513253fbee08bc7f89f03110e4fcb9202ed14bb06d7b903f0ae2dc1dbf143fc0807058c922cd95bdd57ec8a5cbcbab2e6060552936d146d92ba43d8aba57ab5","ssdeep":"","tlshash":"0331e0de68b102bc52a210a85eff359cf1a9462bc854e741f86ed0411fb4a7707abed4","size":1464,"data":"","first_seen":"2024-12-08T03:18:54.031532Z","last_seen":"2026-09-26T21:41:57.537683Z","times_seen":2043,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"www.whhsg.com/static/modules/cms/pc/images/logo_w.png","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:07.177Z","timestamp":1790458867177,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /static/modules/cms/pc/images/logo_w.png HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://znjj99.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 21 Aug 2021 02:28:56 GMT\r\nvary: Accept-Encoding\r\netag: W/\"612064e8-2be9\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11241,"size_decoded":11784,"mime_type":"image/png","magic":"PNG image data, 350 x 97, 8-bit/color RGBA, non-interlaced","md5":"3988baaafc2349af982f85ac4fca42d4","sha1":"f7d1853fac02a0cc28862c5e42f1ac18f7a75b95","sha256":"fc6edb85185a0d2b93082a513b81da3b463f55793639eb33cad90a3ae5fb547d","sha512":"3958f972e2859d9e21db84e0313ecb1fc0c7ff5386fe5745c3070e850ef373db9aa70e917086fcfae7fd03c5effcdbbd410a2e8712bc781cb40ca159ee452bf6","ssdeep":"192:cRzAQIowRCaRmYJFDnAORevKHDIDIrWRXLBb0rOYIxg6HbEjPnpKdl8GHuh0:cRzAQaRZDFDAORevKHUDIc7PNxJQfCpR","tlshash":"9632c0e37528e9ef1a0a4324b42b18b1fc9331458c4ae1a794f737615b881d647c5fbc","first_seen":"2026-03-24T20:16:24.265104Z","last_seen":"2026-09-26T21:41:57.462218Z","times_seen":3,"resource_available":false,"data":null}},"time_used":5910,"timings":{"blocked":311,"dns":0,"connect":0,"send":0,"wait":5599,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/uploads/images/20210906/94d6c0f099bf14559aaa89deeef20f73.jpg","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:07.187Z","timestamp":1790458867187,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /uploads/images/20210906/94d6c0f099bf14559aaa89deeef20f73.jpg HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Mon, 06 Sep 2021 06:52:41 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6135bab9-44161\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/static/modules/cms/pc/images/icon_nav_xian.png","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:07.381Z","timestamp":1790458867381,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /static/modules/cms/pc/images/icon_nav_xian.png HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://znjj99.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 21 Aug 2021 09:40:52 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6120ca24-612\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1554,"size_decoded":1447,"mime_type":"image/png","magic":"PNG image data, 3 x 163, 8-bit/color RGBA, non-interlaced","md5":"f086bd46c57152daeea3f0a9796e12bc","sha1":"b9931fd8f03414051920585830f46fb3b80b0f52","sha256":"91e6d6203627e512e320e4c0420d25f362f04fa195931f0a6e01f51050356967","sha512":"c7bd81d1d39d800a55f5d7cab3df3b6e46ab765e5de8e13f6491b4de0fb2cb327dd6441c609a89c2c78dd8944bbcf48f750deacac18c4292bf51d9e9b8ede729","ssdeep":"","tlshash":"2c31539aec907d0752c9f9066ce6225b292397cca681644b7ccd892394301facf4c9c3","first_seen":"2026-03-24T20:16:24.331013Z","last_seen":"2026-09-26T21:41:57.464925Z","times_seen":3,"resource_available":false,"data":null}},"time_used":5709,"timings":{"blocked":113,"dns":0,"connect":0,"send":0,"wait":5596,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/uploads/images/20211015/ae6d27d35d08dc743a96aeb82e9edf16.jpg","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.168Z","timestamp":1790458866168,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /uploads/images/20211015/ae6d27d35d08dc743a96aeb82e9edf16.jpg HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/uploads/images/20211015/ae6d27d35d08dc743a96aeb82e9edf16.jpg\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/uploads/images/20210906/5799afae6dcfbf8dba18795d2a395fdb.jpg","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.932Z","timestamp":1790458866932,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /uploads/images/20210906/5799afae6dcfbf8dba18795d2a395fdb.jpg HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/uploads/images/20210906/5799afae6dcfbf8dba18795d2a395fdb.jpg\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/images/icon_play_w1.png","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.935Z","timestamp":1790458866935,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /static/modules/cms/pc/images/icon_play_w1.png HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://znjj99.com/static/modules/cms/pc/css/style.css?v=1.0.4\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/static/modules/cms/pc/images/icon_play_w1.png\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":434,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":434,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/static/modules/cms/pc/images/logo.png","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.946Z","timestamp":1790458866946,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /static/modules/cms/pc/images/logo.png HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:08 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 21 Aug 2021 02:28:38 GMT\r\nvary: Accept-Encoding\r\netag: W/\"612064d6-3088\"\r\nexpires: Mon, 26 Oct 2026 21:41:08 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12424,"size_decoded":12967,"mime_type":"image/png","magic":"PNG image data, 350 x 97, 8-bit/color RGBA, non-interlaced","md5":"77bfc8da6faa6cc3162c3915bc13bce4","sha1":"b89730cee1a08cd155ed4bf49b56e1fc25529a37","sha256":"c6b3a4aa067d972037412d195e85ef783ec94e7210a5f2f27ee30df807226590","sha512":"604349e7b0df89563671af3ff4357df2b53891c4fbbf13737d20c1fc922303a7dc30f5c2ed659949cfa3f34804889138f04c20ce13adbc1fae470b3af8983767","ssdeep":"384:xpEepvq0swe6wXAYbLCV7UwroWuPLFpXyq+TrP:piR6wXAYfwp0WS+TrP","tlshash":"2142d0f407379a98416b9c4741c30016eb24fb9a2cac73d9da4fd2a419a4dbb0dc2a1e","first_seen":"2026-03-24T20:16:24.254496Z","last_seen":"2026-09-26T21:41:57.466912Z","times_seen":4,"resource_available":false,"data":null}},"time_used":7062,"timings":{"blocked":-1,"dns":75,"connect":251,"send":0,"wait":5452,"receive":0,"ssl":1284},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/uploads/images/20210906/5799afae6dcfbf8dba18795d2a395fdb.jpg","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:07.181Z","timestamp":1790458867181,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /uploads/images/20210906/5799afae6dcfbf8dba18795d2a395fdb.jpg HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Mon, 06 Sep 2021 06:50:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6135ba4e-3ccef\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/static/modules/cms/pc/css/images/footer-bg.jpg","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:07.388Z","timestamp":1790458867388,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /static/modules/cms/pc/css/images/footer-bg.jpg HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://znjj99.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: text/html\r\ncontent-length: 146\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/favicon.ico","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:11.687Z","timestamp":1790458871687,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://znjj99.com/\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:11 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/favicon.ico\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/x-icon","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":236,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":236,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/favicon.ico","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:11.929Z","timestamp":1790458871929,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://znjj99.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:12 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 4286\r\nlast-modified: Fri, 03 Sep 2021 10:55:31 GMT\r\netag: \"6131ff23-10be\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4286,"size_decoded":4727,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel","md5":"7d1146d5c0b91d1006084c1063b9b818","sha1":"eabefd4c110342157879f57ad565c17337fa5e9b","sha256":"cac0fa500b38e79f2afa1c43ae9ede91bc18805de0854607f7e5a09a463e88b6","sha512":"06604bab2ea895ea416cb82376b5c43384ab75d2b142121cc90757da5e714b35b743f998814dbc06ac1af8d4ed478758e01515545c4e9e9ec951dbfd4db94abf","ssdeep":"48:wxymiPoT5F/UruMNmZJY+XXykAiGEOaJD9j+QjEaWJP6oUxfX9Upladjh/AxQ0aR:hPolOnIHXXykAiGEfjxAP6oK8lsV0is","tlshash":"449161c7ea1657a0fd393f7464260c60661b3e77f4a1bc4eac167aa00bb3183417a667","first_seen":"2026-03-24T20:16:24.300685Z","last_seen":"2026-09-26T21:41:57.468483Z","times_seen":2,"resource_available":false,"data":null}},"time_used":5117,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":3229,"receive":1888,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/uploads/images/20251017/d4df1dae6cd83201c48bd88de1ed2d52.png","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.179Z","timestamp":1790458866179,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /uploads/images/20251017/d4df1dae6cd83201c48bd88de1ed2d52.png HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/uploads/images/20251017/d4df1dae6cd83201c48bd88de1ed2d52.png\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/uploads/images/20210906/467dad39cf1b711cf95faa26e6813e9e.png","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.947Z","timestamp":1790458866947,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /uploads/images/20210906/467dad39cf1b711cf95faa26e6813e9e.png HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 06 Sep 2021 07:08:47 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6135be7f-81a\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2074,"size_decoded":2612,"mime_type":"image/png","magic":"PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced","md5":"f90adc548cdae2b02410a494df8764a6","sha1":"4602fa1dd1f1ed269e74ab50ade22ee5e62f0cd7","sha256":"e7423b6033c13aac7371759d641a6e31653b8e4a7b5590476b6eeed97912958e","sha512":"ba8604cb1c0f20f84a3eccbee138f807a3b44429775a324bbced440921296990178a92f4e790907d31fe7c07028ff1414bc6d213b973f92959c3f1a9c48fd297","ssdeep":"","tlshash":"3c414cf7ff0a1e12eaac61817d1f645e4dd3be95004604ed66d46efb0d6108928eace2","first_seen":"2026-03-24T20:16:24.257737Z","last_seen":"2026-09-26T21:41:57.469949Z","times_seen":4,"resource_available":false,"data":null}},"time_used":6143,"timings":{"blocked":-1,"dns":74,"connect":231,"send":0,"wait":5596,"receive":0,"ssl":237},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/static/modules/cms/pc/images/icon_menu_w.png","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:07.171Z","timestamp":1790458867171,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /static/modules/cms/pc/images/icon_menu_w.png HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://znjj99.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/png\r\ncontent-length: 185\r\nlast-modified: Sat, 21 Aug 2021 10:42:18 GMT\r\netag: \"6120d88a-b9\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":185,"size_decoded":692,"mime_type":"image/png","magic":"PNG image data, 26 x 16, 8-bit/color RGBA, non-interlaced","md5":"1e37357b6c24ea42925ab2147fc7eb5f","sha1":"8625762a4be422c33e2b4be9d8f25383231cf232","sha256":"1f8c597bd2de19bc2bb9aebff7e2a9f5d348a688b7117e1c46314047eb01fd50","sha512":"9f7afce80b338c26185ea3449682993b0ba1fe6b19334de97ffdb190599b2f1819f23fa566eb3c330012818f5fc2c3475d7c8976c7c38542b7a4acc20da40567","ssdeep":"","tlshash":"f3c022ea32c03c39a8ad0132ab1a2900dc261824c57e1109989d0832980a605aa8cb47","first_seen":"2026-03-24T20:16:24.222811Z","last_seen":"2026-09-26T21:41:57.471535Z","times_seen":3,"resource_available":false,"data":null}},"time_used":544,"timings":{"blocked":314,"dns":0,"connect":0,"send":0,"wait":230,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/js/jquery.min.js","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.151Z","timestamp":1790458866151,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /static/modules/cms/pc/js/jquery.min.js HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: text/javascript;charset=utf-8\r\ncontent-length: 26\r\nset-cookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; path=/\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"mj2mailqtnsrrbic6go3s6m9q8","quoted":false,"path":"/","secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; path=/"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26,"size_decoded":559,"mime_type":"text/javascript; charset=utf-8","magic":"exported SGML document, ASCII text, with no line terminators","md5":"e4b89b8ce58d87ef069e51c2ccfce87e","sha1":"1812664f158728a90ac43b0ac1971730ed292511","sha256":"407a809ecdc55451ccf934fdbd7e76a3e09769686741996f38505eb23d13b6ef","sha512":"919eec0e6d8b9b9d379a7782913ae73c662d985871f9572ea8b98b31baba9443b41dd01fd52b24c5e25dfdbd385a07ef55b922ea143e3fda1e4f130febd5f596","ssdeep":"","tlshash":"708000c08ec802e002808caa28803c20022a20af08c00208000088c00aeaaa0a000822","first_seen":"2025-10-26T23:28:00.096385Z","last_seen":"2026-09-26T21:41:57.474403Z","times_seen":7,"resource_available":true,"data":null}},"time_used":470,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":470,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/uploads/images/20211013/89afea90b27f56a126971a21623d1453.png","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.167Z","timestamp":1790458866167,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /uploads/images/20211013/89afea90b27f56a126971a21623d1453.png HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/uploads/images/20211013/89afea90b27f56a126971a21623d1453.png\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/uploads/images/20250818/91ed22b0ae392e75eb31c736018786a2.jpg","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.178Z","timestamp":1790458866178,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /uploads/images/20250818/91ed22b0ae392e75eb31c736018786a2.jpg HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/uploads/images/20250818/91ed22b0ae392e75eb31c736018786a2.jpg\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":445,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":445,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/uploads/images/20240927/05ee4ba918a83a7272543c0694ac2cd5.jpg","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.184Z","timestamp":1790458866184,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /uploads/images/20240927/05ee4ba918a83a7272543c0694ac2cd5.jpg HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/uploads/images/20240927/05ee4ba918a83a7272543c0694ac2cd5.jpg\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/images/icon_menu_w.png","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.922Z","timestamp":1790458866922,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /static/modules/cms/pc/images/icon_menu_w.png HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://znjj99.com/static/modules/cms/pc/css/common.css?v=1.0.2\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/static/modules/cms/pc/images/icon_menu_w.png\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":237,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":237,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/uploads/images/20210906/15320b6c087e2755746509dee727e20d.jpg","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.931Z","timestamp":1790458866931,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /uploads/images/20210906/15320b6c087e2755746509dee727e20d.jpg HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/uploads/images/20210906/15320b6c087e2755746509dee727e20d.jpg\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/images/flogo.png","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.941Z","timestamp":1790458866941,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /static/modules/cms/pc/images/flogo.png HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://znjj99.com/static/modules/cms/pc/css/common.css?v=1.0.2\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/static/modules/cms/pc/images/flogo.png\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":418,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":418,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/uploads/images/20250520/dc641e6ee2f8c6e72ef87a05922d6148.png","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.957Z","timestamp":1790458866957,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /uploads/images/20250520/dc641e6ee2f8c6e72ef87a05922d6148.png HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 20 May 2025 02:25:20 GMT\r\nvary: Accept-Encoding\r\netag: W/\"682be810-1741a\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":95258,"size_decoded":94136,"mime_type":"image/png","magic":"PNG image data, 900 x 383, 8-bit/color RGBA, non-interlaced","md5":"64f01c0687626b6319f622bee29674a8","sha1":"92b313185053a880cac03ee38308f128c02e3361","sha256":"1a093509c612b59a45f29d378ebe37237e03147ce4eee149349ad5ee2334a7f9","sha512":"a2e1d3714173129bf0125d284a6a6e9b7889b3c2c5a9e257f29024f5040fdba8d50fe2fb85f5b399c93d875efd1870a25e601483a28d758b61a7d616ee95f882","ssdeep":"1536:R2Cl3Lg0D5ANYBwHoAFjUebwgGqZc/GfndoL6/4KxJ+34A5sDeVBnEbL:RFl3LL5ggZAF9TZc/GPuO42+SDIOL","tlshash":"c99301dd30ba8899ec8ee7335f18e8b1da03543488e9c6e436d5ee1e4c24bd4cd57681","first_seen":"2026-03-24T20:16:24.145639Z","last_seen":"2026-09-26T21:41:57.475841Z","times_seen":3,"resource_available":false,"data":null}},"time_used":6119,"timings":{"blocked":521,"dns":0,"connect":0,"send":0,"wait":5598,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/js/plus.js?v=1.0.1","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.158Z","timestamp":1790458866158,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /static/modules/cms/pc/js/plus.js?v=1.0.1 HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: application/javascript;charset=utf-8\r\nvary: Accept-Encoding\r\nset-cookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; path=/\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"mj2mailqtnsrrbic6go3s6m9q8","quoted":false,"path":"/","secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; path=/"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":29853,"size_decoded":8622,"mime_type":"application/javascript; charset=utf-8","magic":"data","md5":"45e4326271b4aae9bbfa9914d32c58af","sha1":"a8399c5f02de334d4c2c7d35761c4b660a02f87d","sha256":"00e97da60c3f3e2add297c9c0bfde29f09c9c428af3541766a0f7172709dabd6","sha512":"0525e1a583aed559ca7a0ddd332a5f70163f10af58a1d21d3a86cf14ad8c9c00c5dc517b452e8a781c3c53782c5457b98a7266db19999b47e600a35d1f9cca04","ssdeep":"384:VGYrSNrqeDtNPII7hRu5JlsmymD77ahJfYwVg9odDU8F:+NrqeClsmymP2DfYw24Dn","tlshash":"9fd2a48073ac267e51ef3249457e6648ee3ed437c50684b0f07d5874abf4268271afae","first_seen":"2026-09-26T21:41:57.47787Z","last_seen":"2026-09-26T21:41:57.47787Z","times_seen":1,"resource_available":true,"data":null}},"time_used":477,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":477,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/uploads/images/20250606/d430b2ad6c80391bf76a02ce984d92ec.jpg","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.181Z","timestamp":1790458866181,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /uploads/images/20250606/d430b2ad6c80391bf76a02ce984d92ec.jpg HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/uploads/images/20250606/d430b2ad6c80391bf76a02ce984d92ec.jpg\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":441,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":441,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/uploads/images/20240708/10016b3f6b61589e4395461b12506b4a.jpg","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.186Z","timestamp":1790458866186,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /uploads/images/20240708/10016b3f6b61589e4395461b12506b4a.jpg HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/uploads/images/20240708/10016b3f6b61589e4395461b12506b4a.jpg\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/images/logo_w.png","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.920Z","timestamp":1790458866920,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /static/modules/cms/pc/images/logo_w.png HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://znjj99.com/static/modules/cms/pc/css/common.css?v=1.0.2\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/static/modules/cms/pc/images/logo_w.png\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":240,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":240,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/static/modules/cms/pc/images/about_bg2.jpg","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:07.182Z","timestamp":1790458867182,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /static/modules/cms/pc/images/about_bg2.jpg HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://znjj99.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Fri, 27 Aug 2021 02:43:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"61285140-2f64f\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/uploads/images/20210906/15320b6c087e2755746509dee727e20d.jpg","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:07.188Z","timestamp":1790458867188,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /uploads/images/20210906/15320b6c087e2755746509dee727e20d.jpg HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Mon, 06 Sep 2021 06:54:17 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6135bb19-8f420\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/static/modules/cms/pc/images/icon_more_plus.png","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:07.373Z","timestamp":1790458867373,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /static/modules/cms/pc/images/icon_more_plus.png HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://znjj99.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/png\r\ncontent-length: 484\r\nlast-modified: Sun, 22 Aug 2021 10:25:42 GMT\r\netag: \"61222626-1e4\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":484,"size_decoded":992,"mime_type":"image/png","magic":"PNG image data, 17 x 17, 8-bit/color RGBA, non-interlaced","md5":"9d1c53e1ddfce287f27de8e3a7532316","sha1":"e4854dde0ccdbabd41f862534050f56efe758407","sha256":"31fb38be36807748883d90746425f60faea6be4ff575fc1bab370a1c86237854","sha512":"965fbfa8c62fbb069f57176091f0c5240cdf719cda38a5a4abf7a1d773946fc8a7da05800b7576670fe929c21408b60fb816f61d6ea8684c293d3984003c4edb","ssdeep":"","tlshash":"caf054ed9c3a80b7fb642eb738a9cc49fb2f85352348168c34960c2c3a17e54d08c153","first_seen":"2026-03-24T20:16:24.383194Z","last_seen":"2026-09-26T21:41:57.479158Z","times_seen":3,"resource_available":false,"data":null}},"time_used":23322,"timings":{"blocked":115,"dns":0,"connect":0,"send":0,"wait":5596,"receive":17611,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/uploads/images/20250926/d543c33601aa82a5e0012f57448a69d4.jpg","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.180Z","timestamp":1790458866180,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /uploads/images/20250926/d543c33601aa82a5e0012f57448a69d4.jpg HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/uploads/images/20250926/d543c33601aa82a5e0012f57448a69d4.jpg\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/uploads/images/20211109/0b16f36f2e39035508646fdd40c88da8.jpg","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.929Z","timestamp":1790458866929,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /uploads/images/20211109/0b16f36f2e39035508646fdd40c88da8.jpg HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/uploads/images/20211109/0b16f36f2e39035508646fdd40c88da8.jpg\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/images/about_bg.jpg","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.940Z","timestamp":1790458866940,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /static/modules/cms/pc/images/about_bg.jpg HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://znjj99.com/static/modules/cms/pc/css/style.css?v=1.0.4\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/static/modules/cms/pc/images/about_bg.jpg\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/uploads/files/20211013/fa92199df8da45cb4e5b99aa1dc7f438.mp4","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:07.389Z","timestamp":1790458867389,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /uploads/files/20211013/fa92199df8da45cb4e5b99aa1dc7f438.mp4 HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nRange: bytes=0-\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: video/mp4\r\ncontent-length: 15782793\r\nlast-modified: Wed, 13 Oct 2021 08:00:02 GMT\r\netag: \"61669202-f0d389\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-range: bytes 0-15782792/15782793\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":163840,"size_decoded":164304,"mime_type":"video/mp4","magic":"ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]","md5":"46d225b2935d8d489dac2ac6ac0ead87","sha1":"628d092adbee849cf25e6987f6e7f306d4b8c937","sha256":"5cf073f92b215c6a1f39fdbcdd81b066cf14af8df3012aa397d0cc0fa6ef52f5","sha512":"56b80ec10bba721e3a3301403f53dd581d05b4b2273ec851dad5b9c922426bb25f8b539fc099549558d0c196404ca00ae67c4faa3cb55dd65e9ebc3bc5a3eeff","ssdeep":"3072:VmB4VFMwVOmN2iCEDtcYU2aOwt18EjaRAoHtT0o:cByFM4Ya1U2atj88joeo","tlshash":"45f3b0a4d7a5091be962533698d207247770e5b87283438f43e9a73dfc273e89e834e5","first_seen":"2026-09-26T21:41:57.480536Z","last_seen":"2026-09-26T21:41:57.480536Z","times_seen":1,"resource_available":false,"data":null}},"time_used":10246,"timings":{"blocked":102,"dns":0,"connect":0,"send":0,"wait":5598,"receive":4546,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/css/cube.min.css","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.137Z","timestamp":1790458866137,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /static/modules/cms/pc/css/cube.min.css HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: text/css;charset=utf-8\r\nvary: Accept-Encoding\r\nset-cookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; path=/\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"mj2mailqtnsrrbic6go3s6m9q8","quoted":false,"path":"/","secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; path=/"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":20105,"size_decoded":4635,"mime_type":"text/css; charset=utf-8","magic":"assembler source, ASCII text, with very long lines (436)","md5":"5faf1514bf6f5561c083ef22e0c7980c","sha1":"2e0d52a2e644f284b0899a1d5057ec5f92b1bfdc","sha256":"61dc2e654f41c1cee82f336b5c570ac68d45c1813280aa5f12fe6b6ab3f78a59","sha512":"a604481108c6e6125f0b319c448b6a0bd7e2c18c91fcecbb41f1f2a69c4987cf05ebfa3fa9fde439c11f323b21dec27046dfa89288d274e78cdea91ea5d41736","ssdeep":"192:1Tk44xTTu3Bw5Dy/i3kP9cav4tgUBM0N3WmRuDp36n+Pkkhe8It:1TeBuk2/i3kP9caqgj0lulK1","tlshash":"ca925275b9402c89b22e84e9be993f6c8609459bcf094e76f45fb9fc83c14c50673636","first_seen":"2026-09-26T21:41:57.481986Z","last_seen":"2026-09-26T21:41:57.481986Z","times_seen":1,"resource_available":true,"data":null}},"time_used":277,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":277,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/css/common.css?v=1.0.2","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.141Z","timestamp":1790458866141,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /static/modules/cms/pc/css/common.css?v=1.0.2 HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: text/css;charset=utf-8\r\nvary: Accept-Encoding\r\nset-cookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; path=/\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"mj2mailqtnsrrbic6go3s6m9q8","quoted":false,"path":"/","secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; path=/"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":17548,"size_decoded":5072,"mime_type":"text/css; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (354), with CRLF line terminators","md5":"b57f0cd8397a922fc2679fef4b673052","sha1":"bdfd33ab0cd2c2baa3e75034b7d67d8025f2dcec","sha256":"20b05676155d40d01d54e1fc1c1ebea0849cf5f7044f73a1702ba277b2f94930","sha512":"214fcd4c1374a1eee241b0e60e489cefaa9acae92759a1b1daa7bcd8217677417d4e3f9e551418c8c50585be934dca858a0ac4291e7a341d73400d9ed6c12bdd","ssdeep":"192:Laczaa4JWsYv6JXHvI8aLVxMV/j1rSrMf4NwNARHx/R2PL0LaoXfgzBAAF:N1M86J/I8iVxMVb1Wk63+XzBAU","tlshash":"a272a5364226320da43bd159b6f2570d6a3ec053d21b06fcba252a31c6db65b0b76ec9","first_seen":"2026-09-26T21:41:57.483278Z","last_seen":"2026-09-26T21:41:57.483278Z","times_seen":1,"resource_available":true,"data":null}},"time_used":280,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":280,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/css/style.css?v=1.0.4","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.147Z","timestamp":1790458866147,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /static/modules/cms/pc/css/style.css?v=1.0.4 HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: text/css;charset=utf-8\r\nvary: Accept-Encoding\r\nset-cookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; path=/\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"mj2mailqtnsrrbic6go3s6m9q8","quoted":false,"path":"/","secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; path=/"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":52334,"size_decoded":10102,"mime_type":"text/css; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (364)","md5":"f520286c868e51e6740977803be1b8d1","sha1":"2b882d8c160d32d6c19449592d874ceb3b1522f0","sha256":"3244b05f426e728f76aa86f3a1ec7ebf8faf9a2abed5e743180429f1cf831ffe","sha512":"6306744799cda7842af694a34e5d5d717f63cdb38fb3e2e9cbecdf2b391b991dbe715fd85306ae8e2716056654e8f69a4bbce0d21dc6fb12ebaffd87fdd8900f","ssdeep":"768:KX04/Oitb8U19pkU2OHUXVHJUhPxjJM9hZ:KX04/b8Eq5","tlshash":"d9336325cb74604cf12bb2b6b6a16b5d672dc041f617067df39b785282cf0a8127bbc6","first_seen":"2026-09-26T21:41:57.484466Z","last_seen":"2026-09-26T21:41:57.484466Z","times_seen":1,"resource_available":true,"data":null}},"time_used":283,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":283,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/js/jquery.lplugs.js","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.155Z","timestamp":1790458866155,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /static/modules/cms/pc/js/jquery.lplugs.js HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: application/javascript;charset=utf-8\r\nvary: Accept-Encoding\r\nset-cookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; path=/\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"mj2mailqtnsrrbic6go3s6m9q8","quoted":false,"path":"/","secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; path=/"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":131418,"size_decoded":40311,"mime_type":"application/javascript; charset=utf-8","magic":"data","md5":"4af4657c7370973ff13c20deb169d627","sha1":"c7de4fc677a650a83e7bf37a88f40a60c6155053","sha256":"1e2aca95315b0af26e9312e37ad83cf55bcfb175355cf2ba3cc5cba067018d18","sha512":"56ef31b994b82c3bfa0d9e690d960c3f2d7d058f428511cff91443d5d073291615a624efb4782bf58e65316fa4ffed24db99a0838f38c0eb974037d23b9fb800","ssdeep":"1536:DEPy5wnafzwzECh3/sSXj6vcD6pAZMGDqk20AGHCAGHmdde+HdHMpyggq613HhXg:WCCxj5ROkxBHCBHmd9MEggq6BBXUH","tlshash":"75d33a89b201327782eba3f5506f020a3237e57a5509406cf47cdde1af789a9526bf7c","first_seen":"2026-09-26T21:41:57.485753Z","last_seen":"2026-09-26T21:41:57.485753Z","times_seen":1,"resource_available":true,"data":null}},"time_used":672,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":672,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/uploads/images/20211022/839bfbebd82bf9b53671d58bb8634535.JPG","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.166Z","timestamp":1790458866166,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /uploads/images/20211022/839bfbebd82bf9b53671d58bb8634535.JPG HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/uploads/images/20211022/839bfbebd82bf9b53671d58bb8634535.JPG\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/uploads/images/20210906/4fd75804040b8fa4d1aa9658de073a08.png","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.173Z","timestamp":1790458866173,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /uploads/images/20210906/4fd75804040b8fa4d1aa9658de073a08.png HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/uploads/images/20210906/4fd75804040b8fa4d1aa9658de073a08.png\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":449,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":449,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"34.92.232.92:16666/register","fqdn":"34.92.232.92","domain":"34.92.232.92","tld":""},"ip":{"addr":"34.92.232.92","port":16666,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.870Z","timestamp":1790458866870,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Fri, 25 Sep 2026 04:05:23 GMT","end":"Thu, 01 Oct 2026 20:05:22 GMT"},"fingerprint":{"sha1":"74:74:51:D0:12:FD:48:CB:35:10:77:F7:43:54:27:F0:BD:6F:03:34","sha256":"1A:2A:3E:3D:C0:D9:66:A8:C6:3B:6B:43:58:8D:E5:3F:DB:BB:43:EF:9C:CB:B1:01:11:15:81:FB:A6:88:3B:14"}}},"request":{"raw":"GET /register HTTP/1.1\r\nHost: 34.92.232.92:16666\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://znjj99.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 \r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 134\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\nvia: 1.1 google\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":134,"size_decoded":284,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with no line terminators","md5":"cf4bf23ae244e6fd5ca63598d4dcc82d","sha1":"343d98c24a955312cfefd6bd5947f17e4310edfb","sha256":"c996c0469ef05ff6fdd1f7cefbc3f7e109bb21969de42fcf591498a828a7ad5f","sha512":"3ec60ee9ff8807a76cb360ebcfa109cb74e586ab981184b4f2c7cec48e6f14931822501b30b643aa65e8af419342de3402f2887802df8d7717822da6f50fe0be","ssdeep":"","tlshash":"8fc02bc30070400c535286710a852008c2caba1dffc31800bd8c667f0cc430184b7e8c","first_seen":"2023-04-11T21:57:31Z","last_seen":"2026-09-26T21:58:51.23794Z","times_seen":2297,"resource_available":true,"data":null}},"time_used":934,"timings":{"blocked":-1,"dns":0,"connect":274,"send":0,"wait":374,"receive":0,"ssl":285},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/css/themes/blue/pace-theme-material.css","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.138Z","timestamp":1790458866138,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /static/modules/cms/pc/css/themes/blue/pace-theme-material.css HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: text/css;charset=utf-8\r\nvary: Accept-Encoding\r\nset-cookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; path=/\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"mj2mailqtnsrrbic6go3s6m9q8","quoted":false,"path":"/","secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; path=/"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":35316,"size_decoded":3824,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"c48753e665f9db613ff05fb02191b4e0","sha1":"5d240693113ddfc391b2b986dce29475de3fbc16","sha256":"1c3bfcba087b712330c2d4d920bab2ec2b379282f26d2ff02d4cb93f63b4b5c4","sha512":"ea0be56c8d9afcf7c93f1e74d9dad3f507bde47df3210229c51e2e9bce99e04ca04557584629887879f6850364ec12f98aab46c080b6ba9d3646a2ada0cec9e9","ssdeep":"768:vjojLX2b6g386EcXpJVT6eB74WtUzKYFSL84qXYGUmJHlTNR1WKS7iPt1T/6:3","tlshash":"24f2fb59bc1850d09f2a4e1893cd0e3e1798b2134d1a7cdabb53945e8399fbc189e78f","first_seen":"2026-09-26T21:41:57.487601Z","last_seen":"2026-09-26T21:41:57.487601Z","times_seen":1,"resource_available":true,"data":null}},"time_used":277,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":277,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/css/animate.css","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.145Z","timestamp":1790458866145,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /static/modules/cms/pc/css/animate.css HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: text/css;charset=utf-8\r\nvary: Accept-Encoding\r\nset-cookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; path=/\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"mj2mailqtnsrrbic6go3s6m9q8","quoted":false,"path":"/","secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; path=/"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":69827,"size_decoded":5358,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with CRLF line terminators","md5":"48575f5ec68d4303bb0494857e89eeae","sha1":"234b1a05e6438dfa20c801f39252ab2953708fe6","sha256":"0ec0acd40d0a0436bd9a3c058103687a33d6a3d78abfe07b088c88c524b6bfff","sha512":"89a675b42579e9b495c6a21b474603f23c987eecceb06a6141cd93748a069ed33813bfd0fa6d008090805f38c8adaa06957dd32ef1fdc017da22aea564b60d71","ssdeep":"1536:kVgVFr3OxO/jziJXtO1OhNezb8MQzPSxPsID86UZOOOpOLO7:kVgVFr3OxO/jziJXtO1OhNezb8MQzPSP","tlshash":"3763096e799011c847620e2693fd8f648e3cb97348765cee72c1188fcb96b9c6386747","first_seen":"2026-09-26T21:41:57.489279Z","last_seen":"2026-09-26T21:41:57.489279Z","times_seen":1,"resource_available":true,"data":null}},"time_used":474,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":474,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/js/jquery.cookie.js","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.154Z","timestamp":1790458866154,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /static/modules/cms/pc/js/jquery.cookie.js HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: application/javascript;charset=utf-8\r\nvary: Accept-Encoding\r\nset-cookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; path=/\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"mj2mailqtnsrrbic6go3s6m9q8","quoted":false,"path":"/","secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; path=/"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3147,"size_decoded":1958,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"e8afe4c2d4d325117ffc78d247792cde","sha1":"3f5ad0301370cc62f5649a76b06b7c61974cb755","sha256":"0f69ba112e56efac31ab5271d04d03323d2be265b35ac4a16ecb16578b332929","sha512":"da885d1fb3d26cc011d5a7383b9cda950edd95569b7db1dbac040a193c08144da44e961a8540f3de77c4cf4bb96ce91c2179c6e3198fc5cc4de8f2e5991d2926","ssdeep":"","tlshash":"e5517850b7cc321e06ab22416b6f10ace63cff721158449d8c1965f82cb0c7bdb6bd6a","first_seen":"2026-09-26T21:41:57.490928Z","last_seen":"2026-09-26T21:41:57.490928Z","times_seen":1,"resource_available":true,"data":null}},"time_used":465,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":465,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/uploads/images/20211014/a2694f1567a390664cd88b7a4b237d84.jpg","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.165Z","timestamp":1790458866165,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /uploads/images/20211014/a2694f1567a390664cd88b7a4b237d84.jpg HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/uploads/images/20211014/a2694f1567a390664cd88b7a4b237d84.jpg\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/uploads/images/20210906/ab4e4943162f06c69617a4762dcfec61.png","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.171Z","timestamp":1790458866171,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /uploads/images/20210906/ab4e4943162f06c69617a4762dcfec61.png HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/uploads/images/20210906/ab4e4943162f06c69617a4762dcfec61.png\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":452,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":452,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/uploads/images/20211022/9e21721b969f0edb0847b70088761831.png","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.173Z","timestamp":1790458866173,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /uploads/images/20211022/9e21721b969f0edb0847b70088761831.png HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/uploads/images/20211022/9e21721b969f0edb0847b70088761831.png\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":449,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":449,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/uploads/images/20210906/4ce79152469482fcd0df642dadd2808d.png","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.174Z","timestamp":1790458866174,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /uploads/images/20210906/4ce79152469482fcd0df642dadd2808d.png HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/uploads/images/20210906/4ce79152469482fcd0df642dadd2808d.png\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":449,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":449,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/images/icon_nav_xian.png","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.938Z","timestamp":1790458866938,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /static/modules/cms/pc/images/icon_nav_xian.png HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://znjj99.com/static/modules/cms/pc/css/style.css?v=1.0.4\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/static/modules/cms/pc/images/icon_nav_xian.png\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":424,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":424,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/js/swiper.min.js","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.152Z","timestamp":1790458866152,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /static/modules/cms/pc/js/swiper.min.js HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: application/javascript;charset=utf-8\r\nvary: Accept-Encoding\r\nset-cookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; path=/\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"mj2mailqtnsrrbic6go3s6m9q8","quoted":false,"path":"/","secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; path=/"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":96445,"size_decoded":24497,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (31999)","md5":"25fbafbf6c1618ed3d021c697bb559d8","sha1":"0becd40f962b16fd219c563fcbbdb7fa23b24f98","sha256":"b4dd9413fa86c56b573dae23061ac03d6198968453b20d88e33a78672a032ed6","sha512":"c13019a301aa3d523d212d24634ace9d1e2f666a5fb6c567f36629e23c1f9610064294e5afc8dd093c52a536365350c705b55d1ee065073fccce043d43535204","ssdeep":"1536:eyOkN3TklR3ZIFDJ+Y7n2L5ydUTq0tSQfCBT+:LTX73uTqA","tlshash":"2793d66eb314f3e295d3214a675ac64122f21706b849dae830b54c4a68bcc5d03bffbd","first_seen":"2026-09-26T21:41:57.492205Z","last_seen":"2026-09-26T21:41:57.492205Z","times_seen":1,"resource_available":true,"data":null}},"time_used":468,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":468,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/uploads/images/20210906/4fd75804040b8fa4d1aa9658de073a08.png","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.948Z","timestamp":1790458866948,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /uploads/images/20210906/4fd75804040b8fa4d1aa9658de073a08.png HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 06 Sep 2021 07:08:08 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6135be58-705\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1797,"size_decoded":2334,"mime_type":"image/png","magic":"PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced","md5":"fcb4138c81a8d45126392d120c5e7b1a","sha1":"611344fdcac02dcd75566de6fc57fb10a776c8bf","sha256":"6b3029bd6005c862597edc151e89a59275f05087629cc3d8cb2b18ea4191ae57","sha512":"bfe459925013eb43fc50f91f2a55fa4e2985891709a0e2a227af267a27ead7e183a2daeb63b50b14bc4aeb8f095b08e4f6f70a9c493a5842ba482b85f5f90dd6","ssdeep":"","tlshash":"d4312bb9c1c2a490a951105e47e2403b8bd16fb1b24f721c01321836e07d749fc4ee51","first_seen":"2026-03-24T20:16:24.160092Z","last_seen":"2026-09-26T21:41:57.494246Z","times_seen":4,"resource_available":false,"data":null}},"time_used":6142,"timings":{"blocked":-1,"dns":73,"connect":232,"send":0,"wait":5596,"receive":0,"ssl":239},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/uploads/images/20240927/05ee4ba918a83a7272543c0694ac2cd5.jpg","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.958Z","timestamp":1790458866958,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /uploads/images/20240927/05ee4ba918a83a7272543c0694ac2cd5.jpg HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Fri, 27 Sep 2024 06:43:06 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66f653fa-3b197\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/uploads/images/20241212/6f541d9d662b56c256670b5e1ca8c81f.png","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.965Z","timestamp":1790458866965,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /uploads/images/20241212/6f541d9d662b56c256670b5e1ca8c81f.png HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 12 Dec 2024 07:33:30 GMT\r\nvary: Accept-Encoding\r\netag: W/\"675a91ca-25bd8b\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/static/modules/cms/pc/images/icon_up_w.png","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:07.183Z","timestamp":1790458867183,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /static/modules/cms/pc/images/icon_up_w.png HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://znjj99.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 06 Sep 2021 02:57:09 GMT\r\nvary: Accept-Encoding\r\netag: W/\"61358385-9b9\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2489,"size_decoded":2563,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"848bae4f22f64ed0570c2dc77662b990","sha1":"ab1d5a85fa3832acf1cea0b18e369c4bbfe85922","sha256":"a1ec7acb2ec68d7f2a1ad88455f395bc8eb294cfe018cca79b70e3ca8a25f18f","sha512":"6678e2c9b46deecdc96fbb8ea778c515d5a28bdf52bd4c3be68c00dc253ced5722fddd7be6320c3386ead3a7564a8b57c2f03dccc1c04b68a93d0dbd0ed5b88a","ssdeep":"","tlshash":"7c51f88ada64d70f8e1026243805d7e4f88648d31c7968ce8f7df2d3cac02d5bd60035","first_seen":"2026-03-24T20:16:24.324766Z","last_seen":"2026-09-26T21:41:57.495589Z","times_seen":3,"resource_available":false,"data":null}},"time_used":5904,"timings":{"blocked":305,"dns":0,"connect":0,"send":0,"wait":5599,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/uploads/images/20210906/f8a2d8ee98cd56881bd11c356bb46351.jpg","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:07.185Z","timestamp":1790458867185,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /uploads/images/20210906/f8a2d8ee98cd56881bd11c356bb46351.jpg HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Mon, 06 Sep 2021 06:53:55 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6135bb03-3d023\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":249891,"size_decoded":249004,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1920x940, components 3","md5":"310990ddf364eca3fd05c83469bbc5d6","sha1":"6efd6a344fe8601b0a74214fb4f46c8d181fdb04","sha256":"c1e0a357964c497411d01d6107b37ddf6a79f7aedbe7294d4a9872e46531fdb9","sha512":"1af134a6cba395908a519b0a9429ddc5dfa6629007c022885dd13c619e9de22ecc3bf26b1b243502c840dcbb2d85968fb680abc64bea1663cafce4d6c3293414","ssdeep":"6144:5+DtCfzzKiRVsEZBxePIgOI5VKKlAJl42GsEGlmN:56EzznN0xN5kKeJAsEGcN","tlshash":"0e34234600a707e698f31b612c7596cd9af964ce9382fbfe3dd4cbd7d1e8a41c249908","first_seen":"2026-03-24T20:16:24.292645Z","last_seen":"2026-09-26T21:41:57.497137Z","times_seen":3,"resource_available":false,"data":null}},"time_used":5904,"timings":{"blocked":305,"dns":0,"connect":0,"send":0,"wait":5599,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/static/modules/cms/pc/images/flogo.png","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:07.374Z","timestamp":1790458867374,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /static/modules/cms/pc/images/flogo.png HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://znjj99.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 02 Sep 2021 10:23:05 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6130a609-40b4\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16564,"size_decoded":16850,"mime_type":"image/png","magic":"PNG image data, 254 x 69, 8-bit/color RGBA, non-interlaced","md5":"9a3d2b0daa1d5915804dd8f84a81bff7","sha1":"2f95b66cfcf8f83ee652f2d6037a5b3adb28456c","sha256":"02ff76e5e407a27e6ebaca2b65a22cf0cf5cae17d3850f53cb88f694683c6513","sha512":"c7c47d20c0299933a82721f61bb2e9b75e9cc9d0294c7cba98ef380985d2374f1eae8c68a677f00baa4401f317840fcc2d1f344778237dca4766f97db94c541e","ssdeep":"384:PXAxkF40qZZ7NCTsDbez7+bCdgmIHBBrTw4:PXKkF40W7gOez7+2dgmIHH04","tlshash":"6672d04c38bf9c44035c7c078abe1c26e26b9948d6d5bb88b86eca3a41f03d958593e5","first_seen":"2026-03-24T20:16:24.400565Z","last_seen":"2026-09-26T21:41:57.498744Z","times_seen":3,"resource_available":false,"data":null}},"time_used":5709,"timings":{"blocked":110,"dns":0,"connect":0,"send":0,"wait":5599,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/uploads/images/20210906/b8e5156c440cdb3539242eb9fd2b168a.png","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.170Z","timestamp":1790458866170,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /uploads/images/20210906/b8e5156c440cdb3539242eb9fd2b168a.png HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/uploads/images/20210906/b8e5156c440cdb3539242eb9fd2b168a.png\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":452,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":452,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/uploads/images/20210906/f8a2d8ee98cd56881bd11c356bb46351.jpg","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.927Z","timestamp":1790458866927,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /uploads/images/20210906/f8a2d8ee98cd56881bd11c356bb46351.jpg HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/uploads/images/20210906/f8a2d8ee98cd56881bd11c356bb46351.jpg\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":239,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":239,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/css/images/footer-bg.jpg","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.940Z","timestamp":1790458866940,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /static/modules/cms/pc/css/images/footer-bg.jpg HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://znjj99.com/static/modules/cms/pc/css/common.css?v=1.0.2\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/static/modules/cms/pc/css/images/footer-bg.jpg\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":429,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":429,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/uploads/images/20250818/91ed22b0ae392e75eb31c736018786a2.jpg","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.955Z","timestamp":1790458866955,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /uploads/images/20250818/91ed22b0ae392e75eb31c736018786a2.jpg HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Mon, 18 Aug 2025 01:28:04 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68a281a4-96ba\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":38586,"size_decoded":38858,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 900x268, components 3","md5":"6365ae8e1a2d727e3b96561badf66e8f","sha1":"1be0a21cc62459f675252ca505dbca93297025f2","sha256":"848b8c87d1f715f003a6089248969938b36a8a94fda15f421fc767212cb9873e","sha512":"be87312ef84c5228a7e489fdb60f0c46cf284626f50ff6da3e1cdd9f6978905eef27523858e436894c7d4cc344946ef3fbff8967718297dd5702c80756a4bd40","ssdeep":"768:CW+xbH1Y/ZOoOUSAXdsHyPWFwhs7+uYe0BzaK/6DjqnYi6uQf7GdBNnSa3:SlVvoOU7sSP1uJYee1i3qnYi6uQTG3","tlshash":"3003f155a7b79ac8f9d5cf3d225f9d487f884b3892cdcd8656e8c1b0232a0c01c69147","first_seen":"2026-03-24T20:16:24.393172Z","last_seen":"2026-09-26T21:41:57.500242Z","times_seen":3,"resource_available":false,"data":null}},"time_used":6119,"timings":{"blocked":521,"dns":0,"connect":0,"send":0,"wait":5598,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/uploads/images/20211014/a2694f1567a390664cd88b7a4b237d84.jpg","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.960Z","timestamp":1790458866960,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /uploads/images/20211014/a2694f1567a390664cd88b7a4b237d84.jpg HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/uploads/images/20210906/ab4e4943162f06c69617a4762dcfec61.png","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.962Z","timestamp":1790458866962,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /uploads/images/20210906/ab4e4943162f06c69617a4762dcfec61.png HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 06 Sep 2021 07:09:07 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6135be93-681\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1665,"size_decoded":2207,"mime_type":"image/png","magic":"PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced","md5":"dbd17bf3c8693eb60f6cd5455b038a92","sha1":"b29f1da7856a4520c13a788392ac0f18bc8de771","sha256":"28ee569b7a0c620a13387f6a289be68e46f406334a6a68ad705ff37cb08bf6b2","sha512":"2409a318b393a3ce9b1aea068e3cd0ee7b8dcd279817d776d50e3e1324781f66249704ad583c75cab8844fc0b2492dbb65382489587efec3e7be8c3e391dbbdd","ssdeep":"","tlshash":"79310ac509268559e280cf7695cdbeacff3240b27767d34e60b4b144c2b5e54059c793","first_seen":"2026-03-24T20:16:24.245416Z","last_seen":"2026-09-26T21:41:57.502562Z","times_seen":4,"resource_available":false,"data":null}},"time_used":6117,"timings":{"blocked":519,"dns":0,"connect":0,"send":0,"wait":5598,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/uploads/images/20210906/79a3832d45aaa954fe9555dff396c4b4.jpg","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:07.175Z","timestamp":1790458867175,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /uploads/images/20210906/79a3832d45aaa954fe9555dff396c4b4.jpg HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Mon, 06 Sep 2021 06:51:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6135ba8f-206c0\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":132800,"size_decoded":129679,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1920x940, components 3","md5":"817e8a8e155b36c18540415888e87776","sha1":"b1fca44abc8683624548743ad5a4fa95d0739601","sha256":"01b0aacc8a13d94bb105c6dd39c950f0f8a6ba59e19952dd661e1b659450e5e1","sha512":"a3e9b12719b76ae652ca45e557605425f97fe54ceed48c5a71725f8b4007452ab28eaa6e6c5bfd0fc6dd9c7ccea3ca7811ad8500f2cd25da918c95c9156bf50c","ssdeep":"3072:cOpNjjKpkdkmoKP8asyky8RxSSkt29Di2Q1zIn9:bpNjmpkW7ZYCN1GM9","tlshash":"3cd30236cb925387d488ae355c5b6330f3392e68936abf4a39550f7624942c9dc7bd80","first_seen":"2026-03-24T20:16:24.333071Z","last_seen":"2026-09-26T21:41:57.503879Z","times_seen":3,"resource_available":false,"data":null}},"time_used":1524,"timings":{"blocked":311,"dns":0,"connect":0,"send":0,"wait":1213,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/static/modules/cms/pc/images/icon_play_w1.png","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:07.384Z","timestamp":1790458867384,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /static/modules/cms/pc/images/icon_play_w1.png HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://znjj99.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 06 Sep 2021 02:57:08 GMT\r\nvary: Accept-Encoding\r\netag: W/\"61358384-ba3\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2979,"size_decoded":2575,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"32770a0fd878fc84e857528801e269e4","sha1":"7c29350dcba6ce67fd1a9cb370d59ed8c99159a9","sha256":"a6844475ac666d9ee2adabafa4bc11795a63d6a9c1b7a486570d08a0d020cf2a","sha512":"2ac8d5002c6e89a5dddef3c169585ef7d08ad204149909987376a83fbe028df971fb6c979026c40134b23405520b91621c1b69f5a6d7e842e9a2a6f65d54beba","ssdeep":"","tlshash":"5851c915fe51bc11b944f948b8e8a3a72e3b2b849782f480fccd9cd319552be8e5d5c2","first_seen":"2026-03-24T20:16:24.328055Z","last_seen":"2026-09-26T21:41:57.506332Z","times_seen":3,"resource_available":false,"data":null}},"time_used":5703,"timings":{"blocked":104,"dns":0,"connect":0,"send":0,"wait":5599,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/images/logo.png","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.169Z","timestamp":1790458866169,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /static/modules/cms/pc/images/logo.png HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/static/modules/cms/pc/images/logo.png\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":453,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":453,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/uploads/images/20210906/467dad39cf1b711cf95faa26e6813e9e.png","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.172Z","timestamp":1790458866172,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /uploads/images/20210906/467dad39cf1b711cf95faa26e6813e9e.png HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/uploads/images/20210906/467dad39cf1b711cf95faa26e6813e9e.png\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":450,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":450,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/uploads/images/20210906/79a3832d45aaa954fe9555dff396c4b4.jpg","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.924Z","timestamp":1790458866924,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /uploads/images/20210906/79a3832d45aaa954fe9555dff396c4b4.jpg HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/uploads/images/20210906/79a3832d45aaa954fe9555dff396c4b4.jpg\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":235,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":235,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/images/icon_pause_w.png","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.936Z","timestamp":1790458866936,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /static/modules/cms/pc/images/icon_pause_w.png HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://znjj99.com/static/modules/cms/pc/css/style.css?v=1.0.4\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/static/modules/cms/pc/images/icon_pause_w.png\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":422,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":422,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/uploads/images/20211022/839bfbebd82bf9b53671d58bb8634535.JPG","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.944Z","timestamp":1790458866944,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /uploads/images/20211022/839bfbebd82bf9b53671d58bb8634535.JPG HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/uploads/images/20211022/9e21721b969f0edb0847b70088761831.png","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.952Z","timestamp":1790458866952,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /uploads/images/20211022/9e21721b969f0edb0847b70088761831.png HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 22 Oct 2021 02:42:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"61722522-a84\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2692,"size_decoded":2943,"mime_type":"image/png","magic":"PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced","md5":"5ae0f0d370d519525ea532cf59072e64","sha1":"1c673dac5155e879f11bfb1eafaa53ed7643e876","sha256":"9155bca80f96678156cec9e98838d29e1a71311bcd7dda62e24500dd0fc9a3dc","sha512":"28fd354ece211972e91acb5e19f6f85f4b8178ba995a707555ecd1db1cddc2a5a9e66e0d93768a8eb681e05bfd7459fa9b45f4cb5ddd829ddea4d063e2d562aa","ssdeep":"","tlshash":"97511c1dbbd9a4109386b4117ceb5c17ba1a4a5c5e96b4b59c4bc4a310b02f5182a7e2","first_seen":"2026-03-24T20:16:24.259486Z","last_seen":"2026-09-26T21:41:57.507833Z","times_seen":4,"resource_available":false,"data":null}},"time_used":6118,"timings":{"blocked":520,"dns":0,"connect":0,"send":0,"wait":5598,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/uploads/images/20250606/d430b2ad6c80391bf76a02ce984d92ec.jpg","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.959Z","timestamp":1790458866959,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /uploads/images/20250606/d430b2ad6c80391bf76a02ce984d92ec.jpg HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Fri, 06 Jun 2025 05:59:26 GMT\r\nvary: Accept-Encoding\r\netag: W/\"684283be-6012\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":24594,"size_decoded":24875,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 900x383, components 3","md5":"d19af3e10bc16a1c5db8cf70df004770","sha1":"c3ad73329196e8bce00f0e6c3e9d2527ea7f2a91","sha256":"98e3e5fd264e7a8080d915b1e1976d7ae71945462da9db6f183592e0e7e13112","sha512":"a459ce44208601274269a3d97437fc7dad01c3d5a2e6239630c92b627daeb1e9571658dcb06a079513285752e60e0764af022782df151c91ae96b6e1e7120e60","ssdeep":"384:MJ4/c5xcAflmFKlzIqnUcUWoVF2bKbY5DcTbwKKJiyC5v4PdjKeALGZyREOXtwpY:MYUnfVzIqngLyHDcgt5C5v4PdVAL8Ax","tlshash":"d6b2e012fa67c725c904f4309dbd01d63862b2f1531512df1f3da4d5b3ba2162a2b60b","first_seen":"2026-03-24T20:16:24.174882Z","last_seen":"2026-09-26T21:41:57.509005Z","times_seen":3,"resource_available":false,"data":null}},"time_used":6118,"timings":{"blocked":520,"dns":0,"connect":0,"send":0,"wait":5598,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/static/modules/cms/pc/images/about_bg.jpg","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:07.379Z","timestamp":1790458867379,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /static/modules/cms/pc/images/about_bg.jpg HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://znjj99.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Fri, 27 Aug 2021 02:43:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"61285140-1bf8a\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/css/swiper.min.css","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.140Z","timestamp":1790458866140,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /static/modules/cms/pc/css/swiper.min.css HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: text/css;charset=utf-8\r\nvary: Accept-Encoding\r\nset-cookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; path=/\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"mj2mailqtnsrrbic6go3s6m9q8","quoted":false,"path":"/","secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; path=/"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":17820,"size_decoded":3494,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (17520)","md5":"bd63c5e78023ed381dd7a3f3f2638081","sha1":"872f4016501a8e5570782e5c9f70294b37f78d3b","sha256":"2a99edfb26c4ef9dd14380cba8e58c8dd2389e545fc1e3b629787ed572f3e987","sha512":"eb98427e2ad747c588dcc394970d5249e949546dd6869952c220f0d1c576e63eea8e37764c1ad4728a911bf719d0fbcebbd934e5357d073c3fee9622c7dbe43a","ssdeep":"192:bgG0GpaUCO8jrfg5WHmXgyXyzSHF68DJB0SwS:bgG51CXfgWHfyXyzSl68PT","tlshash":"6a82832c17002067f6324f1987c9e77c9715c8939e0368ef6640de48cbbb5a9227f796","first_seen":"2026-09-26T21:41:57.511138Z","last_seen":"2026-09-26T21:41:57.511138Z","times_seen":1,"resource_available":true,"data":null}},"time_used":273,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":273,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/images/icon_play.png","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.176Z","timestamp":1790458866176,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /static/modules/cms/pc/images/icon_play.png HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/static/modules/cms/pc/images/icon_play.png\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":446,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":446,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/images/about_bg2.jpg","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.923Z","timestamp":1790458866923,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /static/modules/cms/pc/images/about_bg2.jpg HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://znjj99.com/static/modules/cms/pc/css/common.css?v=1.0.2\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/static/modules/cms/pc/images/about_bg2.jpg\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/uploads/images/20211015/ae6d27d35d08dc743a96aeb82e9edf16.jpg","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.956Z","timestamp":1790458866956,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /uploads/images/20211015/ae6d27d35d08dc743a96aeb82e9edf16.jpg HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/js/TweenMax.min.js","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.156Z","timestamp":1790458866156,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /static/modules/cms/pc/js/TweenMax.min.js HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: application/javascript;charset=utf-8\r\nvary: Accept-Encoding\r\nset-cookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; path=/\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"mj2mailqtnsrrbic6go3s6m9q8","quoted":false,"path":"/","secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; path=/"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":103725,"size_decoded":35241,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (32065), with CRLF line terminators","md5":"0192d4dbd4a4213fb399c16266978e26","sha1":"0725b89e07a7e74445e4d7e98b6bd6e9c7a7e531","sha256":"fde03e8d23fbaad1095797e81b0844ef98b2ca661240a2b2242d6f036bc92cbb","sha512":"1ca96c252e8fb4a4e384a2ffaa4d7c4ffa171c96c5e5c97a3b24a98450e6dfd411c51e3d23c5b007d02f9a432f5d1516987eb169c8b0ee16e320594425327abd","ssdeep":"1536:o9mT8B8nFVN8nUH+yMP/rsfqX8InCrEHIbZz18+CPc+YERim:o48BAFkUeH/rsy68wvf+1im","tlshash":"9ca3f8ca7211701145d711da597f0a43b33799a9b40a492cf258c9de3d2caca22fff76","first_seen":"2026-09-26T21:41:57.512887Z","last_seen":"2026-09-26T21:41:57.512887Z","times_seen":1,"resource_available":true,"data":null}},"time_used":496,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":496,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/uploads/images/20250520/dc641e6ee2f8c6e72ef87a05922d6148.png","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.182Z","timestamp":1790458866182,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /uploads/images/20250520/dc641e6ee2f8c6e72ef87a05922d6148.png HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/uploads/images/20250520/dc641e6ee2f8c6e72ef87a05922d6148.png\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":440,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":440,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/uploads/images/20240718/0cc060c0ae61d58874f057a0a4a009af.jpg","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.185Z","timestamp":1790458866185,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /uploads/images/20240718/0cc060c0ae61d58874f057a0a4a009af.jpg HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/uploads/images/20240718/0cc060c0ae61d58874f057a0a4a009af.jpg\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/uploads/images/20210906/94d6c0f099bf14559aaa89deeef20f73.jpg","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.933Z","timestamp":1790458866933,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /uploads/images/20210906/94d6c0f099bf14559aaa89deeef20f73.jpg HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/uploads/images/20210906/94d6c0f099bf14559aaa89deeef20f73.jpg\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/images/icon_down_w.png","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.937Z","timestamp":1790458866937,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /static/modules/cms/pc/images/icon_down_w.png HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://znjj99.com/static/modules/cms/pc/css/style.css?v=1.0.4\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/static/modules/cms/pc/images/icon_down_w.png\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":432,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":432,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/uploads/images/20210906/b8e5156c440cdb3539242eb9fd2b168a.png","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.943Z","timestamp":1790458866943,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /uploads/images/20210906/b8e5156c440cdb3539242eb9fd2b168a.png HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 06 Sep 2021 07:09:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6135beb8-734\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1844,"size_decoded":2381,"mime_type":"image/png","magic":"PNG image data, 58 x 58, 8-bit/color RGBA, non-interlaced","md5":"cb92e08619fc0b2cef11ec3d2c5c4112","sha1":"9c9905acb6457449ebbbcebb87d2a3ebf6854121","sha256":"b54edf56c06715a5c357311685bdd3c7e1ce91532f3139189ee0cc40ea38c523","sha512":"fb75bbd6697aa72d74b815c09bdc8b09c182380c62633e2c10c760fb855965bbb657b170f28ae4d401f9e412af5ca8d751f9effbf0dd4a719de7c281b69f2b2c","ssdeep":"","tlshash":"ba312bef042695f0fbc3865b6240859681ac726582d88ec7e0d311732f9f630b54c129","first_seen":"2026-03-24T20:16:24.285363Z","last_seen":"2026-09-26T21:41:57.529897Z","times_seen":3,"resource_available":false,"data":null}},"time_used":775,"timings":{"blocked":-1,"dns":77,"connect":230,"send":0,"wait":230,"receive":0,"ssl":238},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/static/modules/cms/pc/images/icon_play.png","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.949Z","timestamp":1790458866949,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /static/modules/cms/pc/images/icon_play.png HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/png\r\nlast-modified: Sun, 22 Aug 2021 08:54:20 GMT\r\nvary: Accept-Encoding\r\netag: W/\"612210bc-1f47\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8007,"size_decoded":8502,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"4c4a1f88a2a15a32c08dec3999a867a5","sha1":"3e9004f7f444d6da62c582befba539738fb42045","sha256":"5dd9f1d9d50b61efecdc4d4c495d8026aa9c1a548c006bbbe3fbc46e138704a0","sha512":"c438202a3219e85c12de7d6d48681672e7d979f4929cbd28e1cec58a21cbc063bf612b3d844362317f4bd45205734318a629955c9c2ad641056c034fc3bb5ee7","ssdeep":"192:ylqECw27o5bVZYS1pFXQ8YNF+W9VQGD+LLHJMersI2Gp1fFdh4:oNCw205Q3LQbvaDGp1K","tlshash":"dbf1afc09d523abc38bb3a45ba857011fa8a759d0071e6a450327e344c5e6ffb54e98a","first_seen":"2026-03-24T20:16:24.272035Z","last_seen":"2026-09-26T21:41:57.535411Z","times_seen":4,"resource_available":false,"data":null}},"time_used":6141,"timings":{"blocked":-1,"dns":72,"connect":248,"send":0,"wait":5568,"receive":0,"ssl":252},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/yyds.js","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.160Z","timestamp":1790458866160,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /yyds.js HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 18 Nov 2024 05:51:00 GMT\r\nvary: Accept-Encoding\r\netag: W/\"673ad5c4-5b8\"\r\nexpires: Sun, 27 Sep 2026 09:41:06 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1464,"size_decoded":1219,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (387)","md5":"2ebcf831f70a9e076c60779382e50d6e","sha1":"f987573f4a659408bd577f8dfaaec201b9c93f8a","sha256":"a1f7703e10151084eee03b1edcee20d3f7a7a917dba665165ca32f6a8b07f952","sha512":"b513253fbee08bc7f89f03110e4fcb9202ed14bb06d7b903f0ae2dc1dbf143fc0807058c922cd95bdd57ec8a5cbcbab2e6060552936d146d92ba43d8aba57ab5","ssdeep":"","tlshash":"0331e0de68b102bc52a210a85eff359cf1a9462bc854e741f86ed0411fb4a7707abed4","first_seen":"2024-12-08T03:18:54.031532Z","last_seen":"2026-09-26T21:41:57.537683Z","times_seen":2043,"resource_available":true,"data":null}},"time_used":462,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":462,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/uploads/images/20231229/57788f8c055cb2edec0daff790817537.jpg","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.928Z","timestamp":1790458866928,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /uploads/images/20231229/57788f8c055cb2edec0daff790817537.jpg HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/uploads/images/20231229/57788f8c055cb2edec0daff790817537.jpg\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/images/icon_up_w.png","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.934Z","timestamp":1790458866934,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /static/modules/cms/pc/images/icon_up_w.png HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://znjj99.com/static/modules/cms/pc/css/style.css?v=1.0.4\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/static/modules/cms/pc/images/icon_up_w.png\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":230,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":230,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/uploads/images/20240708/10016b3f6b61589e4395461b12506b4a.jpg","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.951Z","timestamp":1790458866951,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /uploads/images/20240708/10016b3f6b61589e4395461b12506b4a.jpg HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Mon, 08 Jul 2024 06:53:30 GMT\r\nvary: Accept-Encoding\r\netag: W/\"668b8cea-3f2cc\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/uploads/images/20241212/6f541d9d662b56c256670b5e1ca8c81f.png","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.184Z","timestamp":1790458866184,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /uploads/images/20241212/6f541d9d662b56c256670b5e1ca8c81f.png HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/uploads/images/20241212/6f541d9d662b56c256670b5e1ca8c81f.png\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/uploads/images/20250926/d543c33601aa82a5e0012f57448a69d4.jpg","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.950Z","timestamp":1790458866950,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /uploads/images/20250926/d543c33601aa82a5e0012f57448a69d4.jpg HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Fri, 26 Sep 2025 06:32:19 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68d63373-4d23c\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/uploads/images/20251017/d4df1dae6cd83201c48bd88de1ed2d52.png","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.964Z","timestamp":1790458866964,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /uploads/images/20251017/d4df1dae6cd83201c48bd88de1ed2d52.png HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 17 Oct 2025 07:16:25 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68f1ed49-1569cb\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/uploads/images/20211109/0b16f36f2e39035508646fdd40c88da8.jpg","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:07.190Z","timestamp":1790458867190,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /uploads/images/20211109/0b16f36f2e39035508646fdd40c88da8.jpg HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Tue, 09 Nov 2021 08:23:55 GMT\r\nvary: Accept-Encoding\r\netag: W/\"618a301b-49d9d\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/fafafa.js","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.161Z","timestamp":1790458866161,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /fafafa.js HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://znjj99.com/\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 23 Sep 2026 02:51:20 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6ab33ea8-62d\"\r\nexpires: Sun, 27 Sep 2026 09:41:06 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1581,"size_decoded":1338,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"f670d84496266f70a3b0922149caa27e","sha1":"c73aaf670be912a2de3839c7ecf2f4f9b3daf250","sha256":"b607b38d0337a8d0fc223178ef72869b7a7bc769557ed88f67f1452f8b41c0a2","sha512":"868203312b73c825ac3535e6e28bf6299037d64a4cf885ce797f6d76c5bc2c97502db8bc97ca5337b01e67852d2dc05c11557087d450e48e52b76eecf18a11e9","ssdeep":"","tlshash":"c731ffeb0863a418e372402d753a974c75b40057ab35d501ac9cada9afa4f54a4efbcc","first_seen":"2026-09-23T04:25:36.382257Z","last_seen":"2026-09-26T21:41:57.538413Z","times_seen":14,"resource_available":true,"data":null}},"time_used":461,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":461,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/images/icon_more_plus.png","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.939Z","timestamp":1790458866939,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /static/modules/cms/pc/images/icon_more_plus.png HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://znjj99.com/static/modules/cms/pc/css/style.css?v=1.0.4\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg; charset=UTF-8\r\nlocation: https://www.whhsg.com/static/modules/cms/pc/images/icon_more_plus.png\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":419,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":419,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/uploads/files/20211013/fa92199df8da45cb4e5b99aa1dc7f438.mp4","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.942Z","timestamp":1790458866942,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /uploads/files/20211013/fa92199df8da45cb4e5b99aa1dc7f438.mp4 HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nRange: bytes=0-\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: text/html; charset=gbk\r\nlocation: https://www.whhsg.com/uploads/files/20211013/fa92199df8da45cb4e5b99aa1dc7f438.mp4\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"video/mp4","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":428,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":428,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/uploads/images/20211013/89afea90b27f56a126971a21623d1453.png","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.963Z","timestamp":1790458866963,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /uploads/images/20211013/89afea90b27f56a126971a21623d1453.png HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/static/modules/cms/pc/images/icon_pause_w.png","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:07.370Z","timestamp":1790458867370,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /static/modules/cms/pc/images/icon_pause_w.png HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://znjj99.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 06 Sep 2021 02:57:09 GMT\r\nvary: Accept-Encoding\r\netag: W/\"61358385-82c\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2092,"size_decoded":1673,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"ae0c8939c46226eed31958270f42b4b1","sha1":"98ae8afaa2cea81f53d6797b56ef2c928c5b09ee","sha256":"b9be97f4436a6fc135c80e474965033c050ce1f4288bae1669a6f82976fc042c","sha512":"08993d90b68c0965e5394f5618fe42f07f9d27578e6e6f71235af5be3cd29dfa85ea09db5c93424345ee63811294b74bdb69951bb88929699643c3ff337bcb72","ssdeep":"","tlshash":"94412d2eeb61adc01908eb14a4df5a97de3b0bc4dd82d8016cc85eb71c601b99e5e4c7","first_seen":"2026-03-24T20:16:24.375344Z","last_seen":"2026-09-26T21:41:57.539162Z","times_seen":3,"resource_available":false,"data":null}},"time_used":5712,"timings":{"blocked":113,"dns":0,"connect":0,"send":0,"wait":5599,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/static/modules/cms/pc/images/icon_down_w.png","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:07.387Z","timestamp":1790458867387,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /static/modules/cms/pc/images/icon_down_w.png HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://znjj99.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 06 Sep 2021 02:57:09 GMT\r\nvary: Accept-Encoding\r\netag: W/\"61358385-c4a\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3146,"size_decoded":2817,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"c698fbba23dcdc6cc918178990639a0c","sha1":"dff3b9b9056483a02fd789ec6514cfd374aed7de","sha256":"3ebf57a9063b4ddec3b7b1728afa6497481ebfcb59440f6e81bd09c21c6355c9","sha512":"9fb9befa9fc9d1c93a2576fd8efbac9aefd7d630dea35d05549fc0f697f606bf0f16f1217bee5404c7e451dfdc4a4a19f495f8cea1bfb2b38308efbc615b0876","ssdeep":"","tlshash":"7251d776e4801d82831cba11b0e57f1a14f71a5652916447aceb8896f8a41eefd8cece","first_seen":"2026-03-24T20:16:24.19379Z","last_seen":"2026-09-26T21:41:57.540599Z","times_seen":3,"resource_available":false,"data":null}},"time_used":5701,"timings":{"blocked":102,"dns":0,"connect":0,"send":0,"wait":5599,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-26T21:41:04.740Z","timestamp":1790458864740,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:05 GMT\r\ncontent-type: text/html;charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nset-cookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; path=/\nserver_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"mj2mailqtnsrrbic6go3s6m9q8","quoted":false,"path":"/","secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; path=/"},{"name":"server_session_f82e6f9c","value":"7c38e0fd36aa1f1253a48baf03c97c12","quoted":false,"path":"/","max_age":864000,"secure":true,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12; Max-Age=864000; HttpOnly; path=/; Secure; SameSite=Lax"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"GSAP","description":"GSAP is an animation library that allows you to create animations with JavaScript.","website":"https://greensock.com/gsap","common_platform_enumeration":"","icon":"TweenMax.png","categories":["JavaScript frameworks"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Material Design Lite","description":"Material Design Lite is a library of components for web developers.","website":"https://getmdl.io","common_platform_enumeration":"","icon":"Material Design Lite.png","categories":["UI frameworks"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Swiper","description":"Swiper is a JavaScript library that creates modern touch sliders with hardware-accelerated transitions.","website":"https://swiperjs.com","common_platform_enumeration":"","icon":"Swiper.svg","categories":["JavaScript libraries"]}],"data":{"size":72696,"size_decoded":20324,"mime_type":"text/html; charset=utf-8","magic":"data","md5":"6096bc88d1b077204a55ade6f55df853","sha1":"5740fb4f9ccf6f9c012f90d4b2321aeb863d2ebf","sha256":"cd201b4f0f9f4b72cb62c7b28288d9e3ed91a288ea5e94e13148fc9c42e34313","sha512":"667b493f2e79f7a2328c1875543084377d1d1d455715e795aaeac57bdc31bcea9f1d9ce7e3a823465c4500cb1f1b543e388ced7532b5a2423a06763701eae696","ssdeep":"768:fnY09qWG6uVmF/ldw2VmGrYG4vwCD13+d9YDATTVMB9:PX9xG65NwXGrYGwXDwzVMB9","tlshash":"b3633c0065f85427127381e679a46faaf9c6db13c3168d10b6fc67e38ff2e188a67135","first_seen":"2026-09-26T21:41:57.542396Z","last_seen":"2026-09-26T21:41:57.542396Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1214,"timings":{"blocked":-1,"dns":383,"connect":206,"send":0,"wait":412,"receive":0,"ssl":213},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"znjj99.com/static/modules/cms/pc/css/font.css","fqdn":"znjj99.com","domain":"znjj99.com","tld":"com"},"ip":{"addr":"45.197.50.55","port":443,"asn":151800,"as":"HONGKONG IHUASHU INTERNET TECHNOLOGY LIMITED","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.142Z","timestamp":1790458866142,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"023hzny.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 06 Aug 2026 00:53:42 GMT","end":"Wed, 04 Nov 2026 00:53:41 GMT"},"fingerprint":{"sha1":"5F:DD:13:A9:9D:52:CA:1E:A5:8D:95:EA:E4:5F:C5:F9:D3:10:50:76","sha256":"18:BB:02:80:AA:13:7D:AC:31:24:32:0B:70:C4:B6:95:04:8F:31:20:C5:A2:50:70:03:30:B7:8D:E8:5A:B4:52"}}},"request":{"raw":"GET /static/modules/cms/pc/css/font.css HTTP/1.1\r\nHost: znjj99.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; server_session_f82e6f9c=7c38e0fd36aa1f1253a48baf03c97c12\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:06 GMT\r\ncontent-type: text/css;charset=utf-8\r\nvary: Accept-Encoding\r\nset-cookie: PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; path=/\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"mj2mailqtnsrrbic6go3s6m9q8","quoted":false,"path":"/","secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"PHPSESSID=mj2mailqtnsrrbic6go3s6m9q8; path=/"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":8559,"size_decoded":6086,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (6297)","md5":"e39a798cbe454067bf33ad062de32b76","sha1":"b8a8ed2f1335b9b6e52c5e63d0329b852fa22a20","sha256":"d57d51b0dbf7e79cb9187c4c76f2b72335df0e374687c26d40c717cb22437ec6","sha512":"1b09f10deca1f54e80b81a3a6126ebd222cfd1c3c60c6062d5d7ea64033c583acfe3f5f47fac98a197858d529632ea7c1f59951eae4a81904cda1f3c77e5711f","ssdeep":"192:+ourhd6JTk1caxrNJpbmyN92E+G0AkOw3:O6Je7rDL9KG4","tlshash":"ef02e9f159be1ca51358e5d43302ba64ff0477584e478c1fa2a6bc8cfaf2a00a1c299d","first_seen":"2026-09-26T21:41:57.548152Z","last_seen":"2026-09-26T21:41:57.548152Z","times_seen":1,"resource_available":true,"data":null}},"time_used":274,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":274,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"znjj99.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/uploads/images/20240718/0cc060c0ae61d58874f057a0a4a009af.jpg","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.954Z","timestamp":1790458866954,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /uploads/images/20240718/0cc060c0ae61d58874f057a0a4a009af.jpg HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Thu, 18 Jul 2024 06:32:49 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6698b711-89d93c\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/uploads/images/20210906/4ce79152469482fcd0df642dadd2808d.png","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:06.961Z","timestamp":1790458866961,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /uploads/images/20210906/4ce79152469482fcd0df642dadd2808d.png HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 06 Sep 2021 07:07:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6135be24-81b\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2075,"size_decoded":2614,"mime_type":"image/png","magic":"PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced","md5":"c07e57375cea463eb369cdf9de02db16","sha1":"798effb9fc4866bc1d87f9901e5aa2b01a131b58","sha256":"4163269f64ce7ae28d991c253a9e76b2da4436538392e2063830af069e46f283","sha512":"d5fe58782e4c584f2a1df7a9ab2063f55cb79cbdecfdb7605a12faf61b832afcf7a529a9ef169a7259c90ed642ea9e6dd45baf63cb2508c3fd882461fa497179","ssdeep":"","tlshash":"5e413ae432334caad3491bd34aaf0876887e0a78158e02be0a52e208970d526d55e4de","first_seen":"2026-03-24T20:16:24.287853Z","last_seen":"2026-09-26T21:41:57.549631Z","times_seen":4,"resource_available":false,"data":null}},"time_used":6117,"timings":{"blocked":519,"dns":0,"connect":0,"send":0,"wait":5598,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.whhsg.com/uploads/images/20231229/57788f8c055cb2edec0daff790817537.jpg","fqdn":"www.whhsg.com","domain":"whhsg.com","tld":"com"},"ip":{"addr":"123.57.21.27","port":443,"asn":37963,"as":"Hangzhou Alibaba Advertising Co.,Ltd.","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://znjj99.com/","date":"2026-09-26T21:41:07.164Z","timestamp":1790458867164,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.hanshanggroup.com","organization":""},"issuer":{"commonName":"CNSSL DV TLS G2 R36 CA","organization":"Henan Fierce Fire Network Technology Co., Ltd."},"validity":{"start":"Mon, 22 Jun 2026 06:26:54 GMT","end":"Thu, 07 Jan 2027 06:26:53 GMT"},"fingerprint":{"sha1":"81:08:AF:A2:6D:53:09:6C:DA:75:DE:36:B0:25:FC:34:81:A8:54:91","sha256":"4B:00:3D:F0:8B:76:A4:CE:73:7B:44:26:F3:9B:F8:5B:E0:EC:C9:A1:03:46:D5:56:25:08:65:22:30:44:75:21"}}},"request":{"raw":"GET /uploads/images/20231229/57788f8c055cb2edec0daff790817537.jpg HTTP/1.1\r\nHost: www.whhsg.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 26 Sep 2026 21:41:07 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Fri, 29 Dec 2023 04:34:41 GMT\r\nvary: Accept-Encoding\r\netag: W/\"658e4c61-1391ab\"\r\nexpires: Mon, 26 Oct 2026 21:41:07 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"image/jpeg","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-26T22:46:41.621571Z","times_seen":18677532,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}