{"report_id":"3753d25c-b60c-4d0e-ab63-f5c463409240","version":0,"status":"done","tags":[],"date":"2026-10-07T05:51:54Z","url":{"schema":"https","addr":"google.js.cn/","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":0,"asn":979,"as":"NetLab Global","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"google.js.cn/","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"title":"Google Chrome官网 - Google Chrome 网络浏览器 - 下载和安装谷歌浏览器","dom":{"size":19246,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (341)","md5":"0ea8ef20df3c9923a95f6f43036339bb","sha1":"aedc4cf0aea0d8ffe606fc2efc5fb3f8ecdfa1a0","sha256":"6bd3610319d4aed7c4b5147f335b32c7fbdf299101940b34134db629c0e7d3d2","sha512":"aa6c956db931e34f26e11f827a94ed9a972e05afd30ad64e76ea22e18d5eb8350bb0eb2a3b301cda9c6d9c4c5faeeb263fe24b20067b6e1cdf76b580898ce592","ssdeep":"384:e6j9xS9G+8kW4B6W5zozYduuIS/t7ulpRtFtwZhl:MGiB6Gzoz0gjnAhl","tlshash":"d5827615a4f5babb153758b0712b5846bfe4f917ca26c20073bc014caf92ef6870b997","dom_hash":"domhash3f73c8e4788d708beaec9f48b0cb7f5e","first_seen":"2025-11-07T02:55:25.144218Z","last_seen":"2026-10-07T17:50:14.776021Z","times_seen":9,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"google.js.cn/","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":0,"asn":979,"as":"NetLab Global","country":"Hong Kong","country_code":"HK"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-11T05:51:54Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null},"summary":[{"fqdn":"google.js.cn","ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"domain_registered":"2025-11-19","domain_rank":0,"first_seen":"2026-10-07T05:35:59.246252Z","last_seen":"2026-10-07T05:35:59.246252Z","alert_count":128,"request_count":32,"received_data":732839,"sent_data":15471,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery:1.9.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"google.js.cn/","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"bfdd089799f26e4c16eae25aac48304f","sha1":"48a1548ff4eafbc489d0dc0fceea56a5ebab04ef","sha256":"8b947879d60853db5cf49a55962528eeef7ca31e4ce1a45bfac322befec8f276","sha512":"8701398906285022028c75c9973443aedddee20bbb80ff6d044a550297ae758dd997d7a4d547e09855e2c8590c7832173ceea87a47f42a7de088c7ac7f0df51b","ssdeep":"","tlshash":"eb21218bb975a9b340337374574f6f8d3a6290db18589a0d3e6d88858fa5e0600ea18f","size":1292,"data":"","first_seen":"2026-10-07T05:36:04.452112Z","last_seen":"2026-10-07T17:50:14.803585Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"58bed327df055bc42568fd68c27dfa88","sha1":"82647db3796b25fa4c73b4479fd181f000328f87","sha256":"2f32b6e290c1c15207248fccf56874cd334db31118cd227b63dc655569c6e684","sha512":"c33b39aec6c61ebe326810433948861475065e58d08e4c459198c528c6f270fc635ac70faf636fdda48df70e3efad3e523d98276a0c4a8587473ef7a4de3ca37","ssdeep":"","tlshash":"26d0951f1c5524341369047f117af54cb571544c003fd50040ddd8108874fd1082e7cc","size":252,"data":"","first_seen":"2026-10-07T05:36:04.454878Z","last_seen":"2026-10-07T17:50:14.804656Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/js/analytics.js","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"4507839525a19180914799b08fb5fa5b","sha1":"738d7e47e47a102e67d09efa63408d21aaf02245","sha256":"e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44","sha512":"124bb24b26ede426ac7ef14db40ff894ddea6eb9c7a5bf408fd83b116bd55ec86b51b6839d5eec7ec0f481aab940795006005b4534dff6cc0f3a6560f7cf9bea","ssdeep":"768:L5zaBkiBCwsZtisP5XqYlpL+CyfiHOlTjdGoz2enV6KD1CgYUD0ZTXEwyVfZsk:BaBki125hziD8O9dGozFGUwyVL","tlshash":"8c330af9b7523466c3a271e4403f1007907aadc5f449d8a4f58ad6d46d38eab02fbf68","size":52082,"data":"","first_seen":"2023-04-22T06:25:39Z","last_seen":"2026-10-07T17:50:14.795057Z","times_seen":96,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/js/autotrack.js","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"5e6539fd0b1c0778a5254a4ed1305db8","sha1":"6dfe476e85112334a53d16c11e319a7422d8396e","sha256":"449f80795c70e94fa7457ba00a62eeae62ce7efe0abab9681b379833aafed838","sha512":"003d9e211cca5c2ff77eb9a2c275796697c931ef1361d7013b010ecd41e304c33bd3f538105241c3a69224853b5aa45021596b3766fa13b9143ca82aaa23fc60","ssdeep":"768:Rt9hXjJ9UP+8qeyDVrQi7xD21qTOxcVB9yNGm:L9hXjJYyDVrQi7xD21qTfBu","tlshash":"64b2c89c3352357a45a7a1b3663f134a723aa499f484d05c7688d8f12c74a6e123bf7c","size":25247,"data":"","first_seen":"2023-03-08T14:45:25Z","last_seen":"2026-10-07T17:50:14.789759Z","times_seen":29,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/js/animation.gsap.min.js","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"fbc6fd5e2fc6409c75f602320cb5909e","sha1":"a37d2d19425526b6f9dc1873525afb437cefe25f","sha256":"eca64f6a9419a07b0638c88ac89f7b1c7b8d6f16865291df6f668d200064a233","sha512":"1092f44a35a17423ae8f70d554b5204b8a0ffe41355706567b09469d42d60f6a174434da921d8a21b73ef6862b6fc8d6ead14ff2b85a373ad4e5b090c39c5801","ssdeep":"","tlshash":"9e41085d3a006b5315cf2364543f84c9fa36d026ba4f0ac6a426f0d07e28e5d99fbf80","size":2411,"data":"","first_seen":"2023-03-08T14:45:25Z","last_seen":"2026-10-07T17:50:14.787409Z","times_seen":24,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/js/main.min.js","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"c52a88aeeda0d097669f274edc4ce764","sha1":"5499369fd321e912e313dc66069351e85e3f682e","sha256":"bd1e7b7dfac88514366b79b50bddbb7c546c2efac6f74b0ca948bc729c6db9e2","sha512":"3d9d964aba1bf5e4a8c33a6bce48bf808b6fda7a8545e9a374a2978e95ade3d1f030b83ee739e1e66e573434c08f595cb9631326692e314dceead28a98b09924","ssdeep":"768:KGZFBWaZNhnunBR1N69pLivGXQdM7UnXuVqgFIQtjlWVLk2qKNtNPP6DiUz:hnWaZNsnT5XmjsVLIIiuUz","tlshash":"0623f99cb7327072067a61b1512f054ab139a5adf98884acb088d8e53c78dbd077bf7d","size":49515,"data":"","first_seen":"2025-10-13T03:41:11.839003Z","last_seen":"2026-10-07T17:50:14.799502Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/js/jquery-1.9.1.min.js","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"798fca836b229e1c91199e5ac8f0416b","sha1":"fbb7b67c55778f1f3423a6aeabf5a1ad923d38d2","sha256":"de99d5eed1c920df27a3c445d965301dd57bb9e57c951d6a5e5f508bc718cb94","sha512":"428524f97b85604576d89a4e304ef8e68b49107f80e122ac06f2a07d2f8f48a5d5b9ae02644c15d8981a25aeba3c3aff9360b31b6fb96444cbdd3c99ca6c864a","ssdeep":"3072:BzobgbAuZ3uahKYdrRNB66GnXEvXa39mBGfomFcRmkV0b4a7OOX/wMzAnlkJaluT:BUUbAxahKYdB6PX0atmBGfomFcRmkV0d","tlshash":"1ff3008ab795207a9533f37ec9bbc805f176172b22a88d57783c90a82f3145486f5f9c","size":164454,"data":"","first_seen":"2025-03-27T17:44:14.184398Z","last_seen":"2026-10-07T17:50:14.790614Z","times_seen":22,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/js/jquery.validate.min.js","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"a7666030c4d4db781a070524502bdd2d","sha1":"cfbca8efeba3aa781dd75c38802724cedec3100a","sha256":"8dbd756df0daae80886284d6f7df1449fe585c8922f7dc19f5aaab5295459906","sha512":"9432275125b32b13edeebe28e9d68401360d04584f3474777cf77c0c1bac99efeaa5fd84fe6d2e0b7213a521dc486009f28778730422271e2fbca4571b6da638","ssdeep":"768:OBTCbMKp3RT/AHkfUb6bwRrpW++hob2J5DtpuiyOFqXg4OYNrQaxjlf2er:OBTYMKpx/gkfUebwRrpW++JciyOFbb6b","tlshash":"0203300a7be5105a99737279dc6bc601f0b2073b5159a96f38bc90d81fb2ca481f5fe8","size":40321,"data":"","first_seen":"2024-08-19T13:16:06.953064Z","last_seen":"2026-10-07T17:50:14.778896Z","times_seen":28,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/js/intersection-observer.min.js","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"936a7c8159737df8dce532f9ea4d38b4","sha1":"8834ea22eff1bdfd35d2ef3f76d0e552e75e83c5","sha256":"3ea95af77e18116ed0e8b52bb2c0794d1259150671e02994ac2a8845bd1ad5b9","sha512":"54471260a278d5e740782524392249427366c56b288c302c73d643a24c96d99a487507fbe1c47e050a52144713dfeb64cd37bc6359f443ce5f8feb1a2856a70a","ssdeep":"96:+E8YzVFXsVws8HYnkfI+C4yVdbaiGkNF2LSaAuEeRzgf5j6YJR79hamaWslv0Rw:+ajsVws8Hlzg2i/N9hzWgf5jhJR79haZ","tlshash":"4db193047a32b53e83239437a23f460e7b36001de15a054d7aace4d21ef6d486a7bb3d","size":5547,"data":"","first_seen":"2023-03-07T01:03:07Z","last_seen":"2026-10-07T17:50:14.798351Z","times_seen":2908,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/js/ScrollMagic.min.js","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"955abe8cf2e241745bee38b92bebc76c","sha1":"414b13e1866a94eaef2643a5167381bbe2aa7699","sha256":"09756f2d963931cd3831e019d7dfc7a71dc6ec0e02ed4cf6232c46e3b40a9909","sha512":"0a8289ae94a67e9262adbe1198e622b78b01f031713a0c808854ee91a3c2101e3003c61586a7d4b05d5666531b8b5a51dcc8bb53af5d29fd34c36c17bfebed51","ssdeep":"384:CEKmt3JtBOgr3CSEVbMtClyCJ4qelm2JDX6r:jv395bO+t7e4qEJDM","tlshash":"8d82b4cdb341313257ebb3b4902f220ab3368a49b54f8498a429e1f47d79a9e1537f5c","size":18500,"data":"","first_seen":"2023-03-08T14:45:25Z","last_seen":"2026-10-07T17:50:14.786291Z","times_seen":26,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/js/complaint.js","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"f1c5f46620c964392dd12b78a5716052","sha1":"7148593c9bcaaab7ef1dad7f1ba56423ca5d013e","sha256":"11447ea9974f149e82f22409082e9fd6243c7aeeda2fa4f4679d59da537278c2","sha512":"c8e245c28c04fbb440639a96dae91bb80fb2e04b72fe388043d40d2c5bf236d26566ea5360d13914a2c7d8ebc11fe423cfa165b8900e6688f92b805c1a92485b","ssdeep":"","tlshash":"a9710f8dfafb6b40053734b92fef41166c37141f544dcd54b98c0ad0ef9aa289199f8a","size":3485,"data":"","first_seen":"2025-06-24T07:53:16.270267Z","last_seen":"2026-10-07T17:50:14.778282Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/js/jquery.metadata.js","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"90cec60a499620cd97176be2f405a5e1","sha1":"f87cc8f9523a0b97b41eccf8551901104dcea25a","sha256":"d878ec7c8af94db88b03ddd07ce7d3024b129aaa2b834e09000b7c734ac804c8","sha512":"15f3e895cf7d8d909bbc76c1ec6075a8086abd7fcd5d7b7e1a9aa5a8bc7aeda2a66859e92b518d3ff27dfe418e3e92d8ddf0966299f6a9f60cac8fe8db65d8c0","ssdeep":"96:u3CcNEKc8/ZkkHPVLyjPjYgShTtCgOvoLgyvhTgI8ZTGT+4zFUaVKYiCDIH:nCPGnYrAF4CaAB","tlshash":"05a1cb1a398a632344727239a6cad348e254b7271312a8627cac4da5bf30de166b4fd4","size":4956,"data":"","first_seen":"2024-08-19T13:16:06.918953Z","last_seen":"2026-10-07T17:50:14.782235Z","times_seen":32,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"google.js.cn/images/hero-img_desktop.webp","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://google.js.cn/","date":"2026-10-07T05:51:16.448Z","timestamp":1791352276448,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET /images/hero-img_desktop.webp HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://google.js.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 07 Oct 2026 05:51:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 15254\r\nlast-modified: Wed, 09 Oct 2024 14:01:00 GMT\r\netag: \"67068c9c-3b96\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15254,"size_decoded":15694,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"02b45e37724f726277463d0179ea9933","sha1":"461aed119a1f16e52acee8629dbda13265b1e1d0","sha256":"3366ae5fd33d4cb86f228a108a4cd143d8c81724a481bfd1cce48a713b4f06f9","sha512":"964d8affc7628edc17be0b0361410ea8080572823857e79b00a59090c344e6a5868f25491c60d1a60b37425fa3be8c3ec6d4e7657f79556fb7806dcdf21395dc","ssdeep":"384:c2V/zIw/BOSVnBf/OwXIBzmTqEhKg1oy9qBJOHVhk5RY4TX4Nw4Q2W:cWNBOSVnR/O3BuFcBJgVhk5RY4TX4w4e","tlshash":"6862bf4f80f8d9efd092598f06dad88d30ce79a212677f573a484c30a3527b503ada58","first_seen":"2023-11-03T18:23:01Z","last_seen":"2026-10-07T17:50:14.80068Z","times_seen":22,"resource_available":false,"data":null}},"time_used":1101,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1101,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/js/intersection-observer.min.js","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://google.js.cn/","date":"2026-10-07T05:51:16.422Z","timestamp":1791352276422,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET /js/intersection-observer.min.js HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://google.js.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 07 Oct 2026 05:51:16 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 09 Oct 2024 14:01:02 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67068c9e-15ab\"\r\nexpires: Wed, 07 Oct 2026 17:51:16 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5547,"size_decoded":2875,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (533)","md5":"936a7c8159737df8dce532f9ea4d38b4","sha1":"8834ea22eff1bdfd35d2ef3f76d0e552e75e83c5","sha256":"3ea95af77e18116ed0e8b52bb2c0794d1259150671e02994ac2a8845bd1ad5b9","sha512":"54471260a278d5e740782524392249427366c56b288c302c73d643a24c96d99a487507fbe1c47e050a52144713dfeb64cd37bc6359f443ce5f8feb1a2856a70a","ssdeep":"96:+E8YzVFXsVws8HYnkfI+C4yVdbaiGkNF2LSaAuEeRzgf5j6YJR79hamaWslv0Rw:+ajsVws8Hlzg2i/N9hzWgf5jhJR79haZ","tlshash":"4db193047a32b53e83239437a23f460e7b36001de15a054d7aace4d21ef6d486a7bb3d","first_seen":"2023-03-07T01:03:07Z","last_seen":"2026-10-07T17:50:14.798351Z","times_seen":2908,"resource_available":true,"data":null}},"time_used":746,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":746,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/js/jquery.validate.min.js","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://google.js.cn/","date":"2026-10-07T05:51:16.432Z","timestamp":1791352276432,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET /js/jquery.validate.min.js HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://google.js.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 07 Oct 2026 05:51:16 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 09 Oct 2024 14:01:02 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67068c9e-9d82\"\r\nexpires: Wed, 07 Oct 2026 17:51:16 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":40322,"size_decoded":10996,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (601), with CRLF line terminators","md5":"a7666030c4d4db781a070524502bdd2d","sha1":"cfbca8efeba3aa781dd75c38802724cedec3100a","sha256":"8dbd756df0daae80886284d6f7df1449fe585c8922f7dc19f5aaab5295459906","sha512":"9432275125b32b13edeebe28e9d68401360d04584f3474777cf77c0c1bac99efeaa5fd84fe6d2e0b7213a521dc486009f28778730422271e2fbca4571b6da638","ssdeep":"768:OBTCbMKp3RT/AHkfUb6bwRrpW++hob2J5DtpuiyOFqXg4OYNrQaxjlf2er:OBTYMKpx/gkfUebwRrpW++JciyOFbb6b","tlshash":"0203300a7be5105a99737279dc6bc601f0b2073b5159a96f38bc90d81fb2ca481f5fe8","first_seen":"2024-08-19T13:16:06.953064Z","last_seen":"2026-10-07T17:50:14.778896Z","times_seen":28,"resource_available":true,"data":null}},"time_used":1033,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1033,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/images/favicon16x16.png","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://google.js.cn/","date":"2026-10-07T05:51:17.807Z","timestamp":1791352277807,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET /images/favicon16x16.png HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://google.js.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 07 Oct 2026 05:51:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 774\r\nlast-modified: Wed, 09 Oct 2024 14:00:59 GMT\r\netag: \"67068c9b-306\"\r\nexpires: Fri, 06 Nov 2026 05:51:17 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":774,"size_decoded":1282,"mime_type":"image/png","magic":"PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced","md5":"68146cb787da1f97d881b7443c00895b","sha1":"4e3e3eb3a055f1eb35e210696ac6ecb40606c990","sha256":"ae5e67924dd853bec5b8bfc18a48e4dd6b0818d4da61dc8d56c16a7c98706f5d","sha512":"9ee522e20f7fd835454c96d9e2fd11d06a63856c670e0abd5e1a6e9dc65c6b90998c3a3e68c5fe0b4e5d47fe43ece9c10f32689a9e57f121c655f914d9e642f0","ssdeep":"","tlshash":"5001b5e4214ee8acc84c932ac560e111ffe7379f2cd8a839350904d42e01944b748f3a","first_seen":"2025-01-30T04:45:26.551207Z","last_seen":"2026-10-07T17:50:14.7939Z","times_seen":26,"resource_available":false,"data":null}},"time_used":263,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":263,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/js/analytics.js","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://google.js.cn/","date":"2026-10-07T05:51:16.419Z","timestamp":1791352276419,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET /js/analytics.js HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://google.js.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 07 Oct 2026 05:51:16 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 09 Oct 2024 14:01:01 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67068c9d-cb72\"\r\nexpires: Wed, 07 Oct 2026 17:51:16 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":52082,"size_decoded":23246,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1573)","md5":"4507839525a19180914799b08fb5fa5b","sha1":"738d7e47e47a102e67d09efa63408d21aaf02245","sha256":"e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44","sha512":"124bb24b26ede426ac7ef14db40ff894ddea6eb9c7a5bf408fd83b116bd55ec86b51b6839d5eec7ec0f481aab940795006005b4534dff6cc0f3a6560f7cf9bea","ssdeep":"768:L5zaBkiBCwsZtisP5XqYlpL+CyfiHOlTjdGoz2enV6KD1CgYUD0ZTXEwyVfZsk:BaBki125hziD8O9dGozFGUwyVL","tlshash":"8c330af9b7523466c3a271e4403f1007907aadc5f449d8a4f58ad6d46d38eab02fbf68","first_seen":"2023-04-22T06:25:39Z","last_seen":"2026-10-07T17:50:14.795057Z","times_seen":96,"resource_available":true,"data":null}},"time_used":638,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":638,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/js/ScrollMagic.min.js","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://google.js.cn/","date":"2026-10-07T05:51:16.424Z","timestamp":1791352276424,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET /js/ScrollMagic.min.js HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://google.js.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 07 Oct 2026 05:51:16 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 09 Oct 2024 14:01:03 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67068c9f-4844\"\r\nexpires: Wed, 07 Oct 2026 17:51:16 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":18500,"size_decoded":7797,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (17276)","md5":"955abe8cf2e241745bee38b92bebc76c","sha1":"414b13e1866a94eaef2643a5167381bbe2aa7699","sha256":"09756f2d963931cd3831e019d7dfc7a71dc6ec0e02ed4cf6232c46e3b40a9909","sha512":"0a8289ae94a67e9262adbe1198e622b78b01f031713a0c808854ee91a3c2101e3003c61586a7d4b05d5666531b8b5a51dcc8bb53af5d29fd34c36c17bfebed51","ssdeep":"384:CEKmt3JtBOgr3CSEVbMtClyCJ4qelm2JDX6r:jv395bO+t7e4qEJDM","tlshash":"8d82b4cdb341313257ebb3b4902f220ab3368a49b54f8498a429e1f47d79a9e1537f5c","first_seen":"2023-03-08T14:45:25Z","last_seen":"2026-10-07T17:50:14.786291Z","times_seen":26,"resource_available":true,"data":null}},"time_used":797,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":797,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/images/hero-anim-top-right.png","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://google.js.cn/","date":"2026-10-07T05:51:16.444Z","timestamp":1791352276444,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET /images/hero-anim-top-right.png HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://google.js.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T10:43:34.880533Z","times_seen":19024794,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/images/homepage_tools.webp","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://google.js.cn/","date":"2026-10-07T05:51:17.521Z","timestamp":1791352277521,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET /images/homepage_tools.webp HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://google.js.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 07 Oct 2026 05:51:17 GMT\r\ncontent-type: image/webp\r\ncontent-length: 20850\r\nlast-modified: Wed, 09 Oct 2024 14:01:00 GMT\r\netag: \"67068c9c-5172\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":20850,"size_decoded":21290,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"bfd39b59439518fc62e928982b16f7a2","sha1":"05a3aa142a8aa5cf9ed442362d2ef5e3f24a90c5","sha256":"13e0ccc16931e328b4b929ecdb33e6c250620dc4388f72043e7d1ef957a3b49b","sha512":"8106965b71a213de03a6e22a6157c632853135fc040cc75576b04c75f7afd3f144cd97893944744413c28fabc964e0059dca44afbe1585e76426ea1be7237e65","ssdeep":"384:ZvU19+qt2Os0MfffffR+NQ/dDq8ZGh+UrHXdzBXGVKr4Jb0b7EizS5:xIp2Os0MfffffeQlD7ZGnzXd1XGVKrkv","tlshash":"cc92ae06972e64c5e62539f552ba68ecbb15441ce3f2895eb0400bdcd5c2af37333a87","first_seen":"2024-12-13T16:33:56.397802Z","last_seen":"2026-10-07T17:50:14.781634Z","times_seen":20,"resource_available":false,"data":null}},"time_used":283,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":278,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/images/big_pixel_phone.webp","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://google.js.cn/","date":"2026-10-07T05:51:16.455Z","timestamp":1791352276455,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET /images/big_pixel_phone.webp HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://google.js.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 07 Oct 2026 05:51:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 18626\r\nlast-modified: Wed, 09 Oct 2024 14:00:58 GMT\r\netag: \"67068c9a-48c2\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18626,"size_decoded":19066,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c7be276c59c6e4cc53006dce3163c255","sha1":"77a28a96602f2219db9d2ed85fb6cdc92cf53576","sha256":"f6106639dfdad60d0430149132dedb8b6358d4b660570e3ccb34642c0f30b714","sha512":"4780994a55ff18eb8ad3b0a43128d41310e970380d25c323436f59b3d66eec531fcc88ad4c7c8156d894c89b29a35850005969193c75321bce896fd765e9948b","ssdeep":"384:H0Ov4//7YGf+iLG7Z4JL6+AN94YC6JLePAOWn4w6GgjoNdWGWEYf7Nwj:H0Ov4H7rf+iLG7G6+44X6t0AOWn4VGgi","tlshash":"2c82c0d1c15e6c172c229628d976e14a2a074da5f5d81d9d3e03426e9d0cafeef2f43c","first_seen":"2024-12-13T16:33:56.399328Z","last_seen":"2026-10-07T17:50:14.781064Z","times_seen":19,"resource_available":false,"data":null}},"time_used":1244,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1224,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-07T05:51:14.169Z","timestamp":1791352274169,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 07 Oct 2026 05:51:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Sun, 07 Jun 2026 03:43:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a24e8f2-49db\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"jQuery:1.9.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18907,"size_decoded":5068,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (341)","md5":"7b964f02cb9e870b02b88fc0591408e4","sha1":"da73aba0794a1adeb36571896c8b06a87fd8c87c","sha256":"47d3d5151c6b38dadb16a41276678d6c3215f528150ba276a2c3693d51467c32","sha512":"eea25444f3640154cc80d57f2283dbfd5ef9b578302d4a015cd721e30488ec56313a06157f920d7d5afd82a5b63a0577c9295cf7a147433f7c8d458487e79ed9","ssdeep":"384:S6NG9WkW4B6W5zMzYPuuIS/t7unpRtFtwxz:lGtB6GzMzQIjniz","tlshash":"0d827615a4f5babb157758b0722b5806bfe4f917ca26c20073bc014caf92ef6870b597","first_seen":"2025-11-07T02:55:25.17512Z","last_seen":"2026-10-07T17:50:14.787932Z","times_seen":9,"resource_available":true,"data":null}},"time_used":1946,"timings":{"blocked":-1,"dns":885,"connect":264,"send":0,"wait":266,"receive":0,"ssl":531},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/css/style.css","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://google.js.cn/","date":"2026-10-07T05:51:16.398Z","timestamp":1791352276398,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET /css/style.css HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://google.js.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 07 Oct 2026 05:51:16 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 09 Oct 2024 14:00:58 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67068c9a-152cd\"\r\nexpires: Wed, 07 Oct 2026 17:51:16 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":86733,"size_decoded":13101,"mime_type":"text/css","magic":"ASCII text","md5":"7a43fdd3863b6bf52353b12782a3e359","sha1":"fa1c8d24a8b6cd5936ad9b56c96af507805ef0d1","sha256":"49990d62237fa7e30bc4759fa045286be5723b8d14e1c4a7088bb80f03f96819","sha512":"1ed136e51365fdd6d94f733a3a67331ad35ef71deb9168c261a90542105ac46478272d56d4c7cf0701acb40e404caf57ce145327fe2d008a38eadd561fa5c685","ssdeep":"768:it+SV8CrhRc+3UaMI9H0aJOdp3aTURto4K+uEX8c1eCNMbGFoSl0HK+gV1IBjQJq:itTV88Rl6p3aTk8j","tlshash":"7483876e18ab140d751b4869bfee1603a3347073298e9d64bd8d5648cfc87bcb7e4b09","first_seen":"2025-06-24T07:53:16.276237Z","last_seen":"2026-10-07T17:50:14.777686Z","times_seen":17,"resource_available":true,"data":null}},"time_used":333,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":333,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/images/chrome-logo-m100.svg","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://google.js.cn/","date":"2026-10-07T05:51:16.447Z","timestamp":1791352276447,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET /images/chrome-logo-m100.svg HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://google.js.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 07 Oct 2026 05:51:16 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Wed, 09 Oct 2024 14:00:58 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67068c9a-8ff\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2303,"size_decoded":1471,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c978f2a2d0110b5d47e01bcf6576bcf0","sha1":"dcb7f341dfbeccb3d7dd850d2b07a33a522838ba","sha256":"1357dd965397a99cbc937ddd2345a9897d527f7229c8b0f2aeebac97680cc66d","sha512":"3564c4ddba4489a5262ddb8580c95a425470afdfc3166c44f76df92c85d94c57082f0ade34d4c6c3a1f73a1c357fb9e4c9e76d4564d8da46b6973f26cbd378e6","ssdeep":"","tlshash":"2a4142abd79ab4b7c58ec7f8ceb0946eb12a51efa1b1017a97d0e74909595c30804f38","first_seen":"2023-05-11T17:23:08Z","last_seen":"2026-10-11T02:56:33.14359Z","times_seen":893,"resource_available":false,"data":null}},"time_used":1067,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1067,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/images/tips.webp","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://google.js.cn/","date":"2026-10-07T05:51:16.452Z","timestamp":1791352276452,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET /images/tips.webp HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://google.js.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 07 Oct 2026 05:51:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 11644\r\nlast-modified: Wed, 09 Oct 2024 14:01:01 GMT\r\netag: \"67068c9d-2d7c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11644,"size_decoded":12084,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a008cf3519481f0fe7e08e2636dd3bbe","sha1":"bfe144e666fa84c8ddb9891ff2d5ad293609313f","sha256":"e60c43f480500c345d414b47637623701041c920fd96088879b86e923cacd35c","sha512":"55f9108689a249485b68ea5f39dc521bc89700edd01e8e94a0786f5f9f9944500a5dfff338b26ccdf9ecf798dc598251ab5363960f8827fee2dbebf43cd794ab","ssdeep":"192:NuMNM3uYowf11Tfl8dDDXRBmKEmfmuT9fRLUjlkLLIqOMNTdhujPfH0Nn1Rbvi:0MNM3t/Zl8FXG7mfJclKsqT9dhuLH0Rj","tlshash":"af32afac86e3621fe0023d9672d2c7a68f07c106a1d3d149b8f6677352d9ddb79473a0","first_seen":"2024-12-13T16:33:56.394374Z","last_seen":"2026-10-07T17:50:14.783765Z","times_seen":34,"resource_available":false,"data":null}},"time_used":1179,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1179,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/images/hero-anim-top-right.png","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://google.js.cn/","date":"2026-10-07T05:51:17.497Z","timestamp":1791352277497,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET /images/hero-anim-top-right.png HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://google.js.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 07 Oct 2026 05:51:17 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 09 Oct 2024 14:00:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67068c9b-1463\"\r\nexpires: Fri, 06 Nov 2026 05:51:17 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5219,"size_decoded":5673,"mime_type":"image/png","magic":"PNG image data, 540 x 540, 8-bit colormap, non-interlaced","md5":"b1e38c38bfe1598a615a5cd29a8a6934","sha1":"bd32eaf0ba944329967b96268fbb2f4771152054","sha256":"0bc177ab9cdfe4d264e5111c552d58db89c477a4112dd4d1091f9f3338c8f1af","sha512":"dfaa36caa1514696e34031a6e8050c7d4aadba84529b5abda1f46976d35b709ed45b05b7e9f26a8446c986f9faecf546260d255ebb1f295d35ee98a9534fed24","ssdeep":"96:tFUJG+wWh9w0PkErG1ELYPjitEufzKptINAcrth66XF8LlW:vUJG+wlKXrM6EpGALmyW","tlshash":"e0b18ed4b3547ce5151f1287c86c7b749e490f2e86f4e9370224395749b6289eeb3205","first_seen":"2023-08-15T16:29:55Z","last_seen":"2026-10-07T17:50:14.784886Z","times_seen":660,"resource_available":false,"data":null}},"time_used":273,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":273,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/css/complaint.css","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://google.js.cn/","date":"2026-10-07T05:51:16.417Z","timestamp":1791352276417,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET /css/complaint.css HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://google.js.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 07 Oct 2026 05:51:16 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 09 Oct 2024 14:00:58 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67068c9a-ab4\"\r\nexpires: Wed, 07 Oct 2026 17:51:16 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2740,"size_decoded":1455,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"858048d175e97e067fcb237d01bda65e","sha1":"a2be84adcb572e6d4c7da97864a7587b9422c180","sha256":"861204fa22f7f01447b1c9d3f97160670ba7469ba574b3d5c2abcfcad05d878f","sha512":"3438d4d2efd19a020db59d4a66bf82543e6ed471277cb7e44a2b739f4f1cd9847f32a98017708a11433dd47096f137b715833b01268c8fc93762894da907f0b9","ssdeep":"","tlshash":"ef519b6bd211b201b12be8a93be45746122bc263799ef9f1f1cb1824cbc719d153a3d4","first_seen":"2025-06-24T07:53:16.277105Z","last_seen":"2026-10-07T17:50:14.797435Z","times_seen":17,"resource_available":true,"data":null}},"time_used":543,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":543,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/js/animation.gsap.min.js","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://google.js.cn/","date":"2026-10-07T05:51:16.425Z","timestamp":1791352276425,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET /js/animation.gsap.min.js HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://google.js.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 07 Oct 2026 05:51:16 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 09 Oct 2024 14:01:01 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67068c9d-96b\"\r\nexpires: Wed, 07 Oct 2026 17:51:16 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2411,"size_decoded":1843,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1187)","md5":"fbc6fd5e2fc6409c75f602320cb5909e","sha1":"a37d2d19425526b6f9dc1873525afb437cefe25f","sha256":"eca64f6a9419a07b0638c88ac89f7b1c7b8d6f16865291df6f668d200064a233","sha512":"1092f44a35a17423ae8f70d554b5204b8a0ffe41355706567b09469d42d60f6a174434da921d8a21b73ef6862b6fc8d6ead14ff2b85a373ad4e5b090c39c5801","ssdeep":"","tlshash":"9e41085d3a006b5315cf2364543f84c9fa36d026ba4f0ac6a426f0d07e28e5d99fbf80","first_seen":"2023-03-08T14:45:25Z","last_seen":"2026-10-07T17:50:14.787409Z","times_seen":24,"resource_available":true,"data":null}},"time_used":795,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":795,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/js/jquery.metadata.js","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://google.js.cn/","date":"2026-10-07T05:51:16.433Z","timestamp":1791352276433,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET /js/jquery.metadata.js HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://google.js.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 07 Oct 2026 05:51:16 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 09 Oct 2024 14:01:02 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67068c9e-135c\"\r\nexpires: Wed, 07 Oct 2026 17:51:16 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4956,"size_decoded":2285,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"90cec60a499620cd97176be2f405a5e1","sha1":"f87cc8f9523a0b97b41eccf8551901104dcea25a","sha256":"d878ec7c8af94db88b03ddd07ce7d3024b129aaa2b834e09000b7c734ac804c8","sha512":"15f3e895cf7d8d909bbc76c1ec6075a8086abd7fcd5d7b7e1a9aa5a8bc7aeda2a66859e92b518d3ff27dfe418e3e92d8ddf0966299f6a9f60cac8fe8db65d8c0","ssdeep":"96:u3CcNEKc8/ZkkHPVLyjPjYgShTtCgOvoLgyvhTgI8ZTGT+4zFUaVKYiCDIH:nCPGnYrAF4CaAB","tlshash":"05a1cb1a398a632344727239a6cad348e254b7271312a8627cac4da5bf30de166b4fd4","first_seen":"2024-08-19T13:16:06.918953Z","last_seen":"2026-10-07T17:50:14.782235Z","times_seen":32,"resource_available":true,"data":null}},"time_used":1039,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1039,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/images/google-chrome-logo.jpg","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://google.js.cn/","date":"2026-10-07T05:51:16.443Z","timestamp":1791352276443,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET /images/google-chrome-logo.jpg HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://google.js.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 07 Oct 2026 05:51:16 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 09 Oct 2024 14:00:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67068c9b-a81\"\r\nexpires: Fri, 06 Nov 2026 05:51:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2689,"size_decoded":3198,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 160x24, components 3","md5":"f0e776a677860d4961915f2eca8d555e","sha1":"9698bf0f877a6539d6b730f32a00ad04d3880c52","sha256":"380330f93337ca6dd8fcfdab31044e3b8a1d3dbfc72cf4625bfd1eec4414857c","sha512":"42a7a1437871f044d954697e9a0e8974ae09c5f5aaf5a742d2ddde6d485f9ac35ce6b4dfb729adfa804ab930827f21dc9c4ec52f265e692dec8a9886c9b4f9d6","ssdeep":"","tlshash":"4051298c0622e189ea523478c0aa676557db0469bb0d0c37e6112744fceac4a3cb2ac3","first_seen":"2023-10-13T02:05:24Z","last_seen":"2026-10-07T17:50:14.782721Z","times_seen":491,"resource_available":false,"data":null}},"time_used":1037,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1037,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/images/homepage_tools.webp","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://google.js.cn/","date":"2026-10-07T05:51:16.449Z","timestamp":1791352276449,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET /images/homepage_tools.webp HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://google.js.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T10:43:34.880533Z","times_seen":19024794,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/images/homepage_privacy.webp","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://google.js.cn/","date":"2026-10-07T05:51:16.450Z","timestamp":1791352276450,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET /images/homepage_privacy.webp HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://google.js.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 07 Oct 2026 05:51:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 9122\r\nlast-modified: Wed, 09 Oct 2024 14:01:00 GMT\r\netag: \"67068c9c-23a2\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9122,"size_decoded":9561,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"8665bc68932b068569bfd361c75522ef","sha1":"18669baea4bc17500b09ffc0eba4d1b166a9f5c3","sha256":"1025781302da49abf03e5b0ce76106caeae5b0cd15e215a09ce2c844da430a4b","sha512":"eee3e24ef282db8ac1762e18d80b625bfe171bb80f3a2ae39bd78ef484539018aa1e7b54e0c0176f59b0d312e06608a9e67ba8b1bbd94866602118ce1eeb81ca","ssdeep":"192:xLqhBF6Hx7oTFZFllFpcf5wgsWpYA3039XAQu7ylC4oFlyxaKTMy21Ra:xjHx7oTzlOmgsSCeQuelslydMyiw","tlshash":"1c12af65b266dc83c5fd3b4ce3d4558707547a25378ca3b236c44a7abc81a6310f11ed","first_seen":"2024-12-13T16:33:56.383238Z","last_seen":"2026-10-07T17:50:14.79212Z","times_seen":22,"resource_available":false,"data":null}},"time_used":1153,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/images/hero-anim-middle.png","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://google.js.cn/","date":"2026-10-07T05:51:17.501Z","timestamp":1791352277501,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET /images/hero-anim-middle.png HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://google.js.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 07 Oct 2026 05:51:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 886\r\nlast-modified: Wed, 09 Oct 2024 14:00:59 GMT\r\netag: \"67068c9b-376\"\r\nexpires: Fri, 06 Nov 2026 05:51:17 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":886,"size_decoded":1394,"mime_type":"image/png","magic":"PNG image data, 120 x 119, 8-bit colormap, non-interlaced","md5":"7dc4991880c08d2e4ba8c7084f3e84ac","sha1":"dd38319d7e7bee0edb715bc6e3fd13ddccb9edcd","sha256":"7f85e4ec9841cd9011f8cca307134654da2684cf45872439960d31b0d2e0c7e8","sha512":"031b824ab1b32b586c67bbdbe4da3d6bddfcf1a87cbc7089b0adc97b22108fe9f57f07191860c72a1a82c9944a14b996d3f6b38ea0ee48118bd62eeebabf7b2c","ssdeep":"","tlshash":"5911b7923ab77d037018011d172ed1569003f0ec02d31e715320371978aa201fd7d2a0","first_seen":"2023-08-15T16:29:55Z","last_seen":"2026-10-07T17:50:14.803008Z","times_seen":666,"resource_available":false,"data":null}},"time_used":276,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":276,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/images/hero-anim-bottom-left.png","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://google.js.cn/","date":"2026-10-07T05:51:16.445Z","timestamp":1791352276445,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET /images/hero-anim-bottom-left.png HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://google.js.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T10:43:34.880533Z","times_seen":19024794,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/images/hero-anim-middle.png","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://google.js.cn/","date":"2026-10-07T05:51:16.446Z","timestamp":1791352276446,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET /images/hero-anim-middle.png HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://google.js.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T10:43:34.880533Z","times_seen":19024794,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/images/pixel_phone.webp","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://google.js.cn/","date":"2026-10-07T05:51:16.454Z","timestamp":1791352276454,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET /images/pixel_phone.webp HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://google.js.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 07 Oct 2026 05:51:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 14216\r\nlast-modified: Wed, 09 Oct 2024 14:01:01 GMT\r\netag: \"67068c9d-3788\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14216,"size_decoded":14656,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a0a705975a0ec80757a3c853be25bf74","sha1":"4c6377f6f06f1f2b91982b7b79c589ef07cabf04","sha256":"e8d27ada6151f6c6341af924f0d583832fd9b0741ed30db3088f58111f885dc6","sha512":"f381c99d3299c862a61c9231770a30da74193820618729c959eb387d5ae5444f1b1da6387623a5dd910999d441b34c9cf423efdebaeade517088eb3ea429482f","ssdeep":"384:wLmwBPPC0pdGI31GRP6dT9k4ZIrmmoWXM5RmEPD22ZhPiJ:wL1BPPC0pT3kRb4wIb22ZY","tlshash":"b552d07e9835ef44ce784efad57d0b3882089468f338137531b66a9650c21673af4e4e","first_seen":"2024-12-13T16:33:56.396226Z","last_seen":"2026-10-07T17:50:14.795718Z","times_seen":20,"resource_available":false,"data":null}},"time_used":1202,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1202,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/images/pixel_tablet.webp","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://google.js.cn/","date":"2026-10-07T05:51:16.456Z","timestamp":1791352276456,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET /images/pixel_tablet.webp HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://google.js.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 07 Oct 2026 05:51:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 15428\r\nlast-modified: Wed, 09 Oct 2024 14:01:01 GMT\r\netag: \"67068c9d-3c44\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15428,"size_decoded":15868,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"3174e92a3d55210d4f1dd41b3f765248","sha1":"0d39312ca65bae81bd31a380d5dd29ee27898c61","sha256":"91467dabc81e45e8409da923d9533fbb8f0de2046f6759332301f802739582a2","sha512":"28374be6fd4b6b62eff3c998f42e0d5b7c039e789472afb55452504f776384527e3864a1868ebdb26aa75e3db84246e20bd141482ccde392e4dacf8ab83bc635","ssdeep":"384:42PMXGcuPVjEhg9B8KdDQCfoFpHzDCqd8Qi0zbKDZ/SoH:4202c1emLnhaSoH","tlshash":"6e62c083bab15a3877acd1fc718925170ab1785bb3f903dde033489994d16edc5ac0b9","first_seen":"2024-12-13T16:33:56.387054Z","last_seen":"2026-10-07T17:50:14.801834Z","times_seen":19,"resource_available":false,"data":null}},"time_used":1245,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1242,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/js/autotrack.js","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://google.js.cn/","date":"2026-10-07T05:51:16.420Z","timestamp":1791352276420,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET /js/autotrack.js HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://google.js.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 07 Oct 2026 05:51:16 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 09 Oct 2024 14:01:02 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67068c9e-629f\"\r\nexpires: Wed, 07 Oct 2026 17:51:16 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":25247,"size_decoded":9717,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (524)","md5":"5e6539fd0b1c0778a5254a4ed1305db8","sha1":"6dfe476e85112334a53d16c11e319a7422d8396e","sha256":"449f80795c70e94fa7457ba00a62eeae62ce7efe0abab9681b379833aafed838","sha512":"003d9e211cca5c2ff77eb9a2c275796697c931ef1361d7013b010ecd41e304c33bd3f538105241c3a69224853b5aa45021596b3766fa13b9143ca82aaa23fc60","ssdeep":"768:Rt9hXjJ9UP+8qeyDVrQi7xD21qTOxcVB9yNGm:L9hXjJYyDVrQi7xD21qTfBu","tlshash":"64b2c89c3352357a45a7a1b3663f134a723aa499f484d05c7688d8f12c74a6e123bf7c","first_seen":"2023-03-08T14:45:25Z","last_seen":"2026-10-07T17:50:14.789759Z","times_seen":29,"resource_available":true,"data":null}},"time_used":733,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":733,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/js/main.min.js","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://google.js.cn/","date":"2026-10-07T05:51:16.427Z","timestamp":1791352276427,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET /js/main.min.js HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://google.js.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 07 Oct 2026 05:51:16 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 09 Oct 2024 14:01:03 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67068c9f-c16b\"\r\nexpires: Wed, 07 Oct 2026 17:51:16 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":49515,"size_decoded":19712,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (1815)","md5":"c52a88aeeda0d097669f274edc4ce764","sha1":"5499369fd321e912e313dc66069351e85e3f682e","sha256":"bd1e7b7dfac88514366b79b50bddbb7c546c2efac6f74b0ca948bc729c6db9e2","sha512":"3d9d964aba1bf5e4a8c33a6bce48bf808b6fda7a8545e9a374a2978e95ade3d1f030b83ee739e1e66e573434c08f595cb9631326692e314dceead28a98b09924","ssdeep":"768:KGZFBWaZNhnunBR1N69pLivGXQdM7UnXuVqgFIQtjlWVLk2qKNtNPP6DiUz:hnWaZNsnT5XmjsVLIIiuUz","tlshash":"0623f99cb7327072067a61b1512f054ab139a5adf98884acb088d8e53c78dbd077bf7d","first_seen":"2025-10-13T03:41:11.839003Z","last_seen":"2026-10-07T17:50:14.799502Z","times_seen":12,"resource_available":true,"data":null}},"time_used":852,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":852,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/js/jquery-1.9.1.min.js","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://google.js.cn/","date":"2026-10-07T05:51:16.429Z","timestamp":1791352276429,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET /js/jquery-1.9.1.min.js HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://google.js.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 07 Oct 2026 05:51:16 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 09 Oct 2024 14:01:02 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67068c9e-28266\"\r\nexpires: Wed, 07 Oct 2026 17:51:16 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":164454,"size_decoded":44668,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (795), with CRLF line terminators","md5":"798fca836b229e1c91199e5ac8f0416b","sha1":"fbb7b67c55778f1f3423a6aeabf5a1ad923d38d2","sha256":"de99d5eed1c920df27a3c445d965301dd57bb9e57c951d6a5e5f508bc718cb94","sha512":"428524f97b85604576d89a4e304ef8e68b49107f80e122ac06f2a07d2f8f48a5d5b9ae02644c15d8981a25aeba3c3aff9360b31b6fb96444cbdd3c99ca6c864a","ssdeep":"3072:BzobgbAuZ3uahKYdrRNB66GnXEvXa39mBGfomFcRmkV0b4a7OOX/wMzAnlkJaluT:BUUbAxahKYdB6PX0atmBGfomFcRmkV0d","tlshash":"1ff3008ab795207a9533f37ec9bbc805f176172b22a88d57783c90a82f3145486f5f9c","first_seen":"2025-03-27T17:44:14.184398Z","last_seen":"2026-10-07T17:50:14.790614Z","times_seen":22,"resource_available":true,"data":null}},"time_used":918,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":918,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/images/homepage_features.webp","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://google.js.cn/","date":"2026-10-07T05:51:16.451Z","timestamp":1791352276451,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET /images/homepage_features.webp HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://google.js.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 07 Oct 2026 05:51:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 7450\r\nlast-modified: Wed, 09 Oct 2024 14:01:00 GMT\r\netag: \"67068c9c-1d1a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7450,"size_decoded":7889,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"1c436a56fdf2cdb7d31231cfdf0e8e51","sha1":"c8117ec5553aed874a0fd7d39b3ecceebfe64fbc","sha256":"6af2bad8806b999377cdc60792cc9e4189b0ec35310903b22ae2c95940e3fde7","sha512":"400b4b77902d1bc9aada06b82920b0d33752359108faf56dc5d83ffb47a4b330011c64854bef16961c111ffdde6e5b53f17e0ab54ae5808a9337c5e3254f2670","ssdeep":"192:apV95fCy75gc3yUNZ/KrUSb2Rnm1q6MYj4yz:u9rF/rZ/IPb2Rnm1UYj4yz","tlshash":"20e19ec235a02bb1d5d250e7deb47e800df8bc6613de97e547389ac1218ef6522116a5","first_seen":"2024-12-13T16:33:56.392538Z","last_seen":"2026-10-07T17:50:14.786887Z","times_seen":20,"resource_available":false,"data":null}},"time_used":1161,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1161,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/images/hero-anim-bottom-left.png","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://google.js.cn/","date":"2026-10-07T05:51:17.500Z","timestamp":1791352277500,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET /images/hero-anim-bottom-left.png HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://google.js.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 07 Oct 2026 05:51:17 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 09 Oct 2024 14:00:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67068c9b-f34\"\r\nexpires: Fri, 06 Nov 2026 05:51:17 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3892,"size_decoded":4354,"mime_type":"image/png","magic":"PNG image data, 400 x 400, 8-bit colormap, non-interlaced","md5":"d5484f84888d5d422c3214e0d058dd09","sha1":"84d5f337d3c3c0024f4afaf1b89fe87273fcd977","sha256":"eb9c623c4651f1c7acdd25a5a7104ee9a460a3751446d4bf14f5853924628f6e","sha512":"9509fda3eab3cc7817cc3b421144fd89a92ed526c260ad44d49994d1e6d00f445e3abc0d99e22ffeb20214b6427307838405dfc55f1784cc8c580996469dc6e4","ssdeep":"","tlshash":"ae814d722532bb872b89acb69b8c84d99c5e48350ff40e354870381d7cb131bf1e4991","first_seen":"2023-08-15T16:29:55Z","last_seen":"2026-10-07T17:50:14.793328Z","times_seen":663,"resource_available":false,"data":null}},"time_used":275,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":275,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/css/main.min.css","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://google.js.cn/","date":"2026-10-07T05:51:16.414Z","timestamp":1791352276414,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET /css/main.min.css HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://google.js.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 07 Oct 2026 05:51:16 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 09 Oct 2024 14:00:58 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67068c9a-1c470\"\r\nexpires: Wed, 07 Oct 2026 17:51:16 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":115824,"size_decoded":19458,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"95bff2d2903f9a24f4dd109f47b9aaab","sha1":"6656a86131c8fb1c3202b4cb2ca0ac20258bfda3","sha256":"92a6278a76cefb564809beb9762cb6af9693d232667b01ca0d9368861dfbad93","sha512":"10ee3a9e0b645e02fd0ec50fb0c8978833c519d3d027d58fc5d8cfd7dea1012d177147ed3b808c43cfa227975a57af6c58e4f3bf9c856ff98b299d157bfef923","ssdeep":"768:TpD5lqtL/+LnNE88jzWp2NtQZV/RJjO3zE5FJtCoe:TpDgL88jzW9pCE5FJtCd","tlshash":"97b3a456988d323d646f0872d1669183833c7023f7d28be6a654b41df7861b327f6f8a","first_seen":"2025-06-24T07:53:16.261077Z","last_seen":"2026-10-07T17:50:14.78849Z","times_seen":16,"resource_available":true,"data":null}},"time_used":512,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":512,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"google.js.cn/js/complaint.js","fqdn":"google.js.cn","domain":"google.js.cn","tld":"js.cn"},"ip":{"addr":"38.95.75.43","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://google.js.cn/","date":"2026-10-07T05:51:16.431Z","timestamp":1791352276431,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"google.js.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 02 Sep 2026 08:11:59 GMT","end":"Tue, 01 Dec 2026 08:11:58 GMT"},"fingerprint":{"sha1":"66:DE:4C:1D:CE:F6:50:5C:BD:F6:CC:D6:5B:58:E7:FC:C8:AF:2C:4F","sha256":"CF:D2:C9:A2:90:1A:EF:A1:BF:45:B2:0A:5A:1F:9A:6D:E6:26:09:C8:E6:A4:DA:56:AD:8D:08:D5:BE:D4:AD:AA"}}},"request":{"raw":"GET /js/complaint.js HTTP/1.1\r\nHost: google.js.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://google.js.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Wed, 07 Oct 2026 05:51:16 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 09 Oct 2024 14:08:03 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67068e43-d9d\"\r\nexpires: Wed, 07 Oct 2026 17:51:16 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3485,"size_decoded":2005,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"f1c5f46620c964392dd12b78a5716052","sha1":"7148593c9bcaaab7ef1dad7f1ba56423ca5d013e","sha256":"11447ea9974f149e82f22409082e9fd6243c7aeeda2fa4f4679d59da537278c2","sha512":"c8e245c28c04fbb440639a96dae91bb80fb2e04b72fe388043d40d2c5bf236d26566ea5360d13914a2c7d8ebc11fe423cfa165b8900e6688f92b805c1a92485b","ssdeep":"","tlshash":"a9710f8dfafb6b40053734b92fef41166c37141f544dcd54b98c0ad0ef9aa289199f8a","first_seen":"2025-06-24T07:53:16.270267Z","last_seen":"2026-10-07T17:50:14.778282Z","times_seen":16,"resource_available":true,"data":null}},"time_used":1002,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1002,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-07","alert":"Phishing Block","trigger":"google.js.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-07","alert":"Sinkholed","trigger":"google.js.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}