{"report_id":"3e7805b6-0c4d-49f9-81a6-f4a19598a0b6","version":0,"status":"done","tags":[],"date":"2026-08-02T00:21:24Z","url":{"schema":"http","addr":"whatsapp-pc.zn-chat-whatapps.hi.cn","fqdn":"whatsapp-pc.zn-chat-whatapps.hi.cn","domain":"zn-chat-whatapps.hi.cn","tld":"hi.cn"},"ip":{"addr":"156.239.9.106","port":0,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"whatsapp-pc.zn-chat-whatapps.hi.cn/","fqdn":"whatsapp-pc.zn-chat-whatapps.hi.cn","domain":"zn-chat-whatapps.hi.cn","tld":"hi.cn"},"title":"WhatsApp网页版 - 摆脱手机频繁掉线WhatsApp的WhatsApp网页版","dom":{"size":37235,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (4157)","md5":"a2510750cd3b9d27d92d598822f29eac","sha1":"e0ca78debbbfe59a5a258491cf3d5182b5a3542a","sha256":"0aa8a024af7619c296e73158cb73035fe2018488c9908cdb9c543f33316e42f4","sha512":"7095fb44eac690ee268773b1ae7fc5b7dddb6ba4a14f3521c5a0ec1c8fcbe3ab357d15a4cfa003a49333e4abc6eb61fab175bf3a4e7795ce10e6965edb579aad","ssdeep":"768:ki5+UMsyFXW0YjikxzSZvKc4uvIvkf9kpQvfvT:n5+UMsqXWbjikFSRKc4uvIvkf9kpQvfr","tlshash":"01f2d735a5b326a3381381e463e363997ea8d517cc06cd39bfdd5260cfca5a4a89374c","dom_hash":"domhash8a74ffcfaca5781faea1a84b1a5eaa2c","first_seen":"2026-08-02T00:21:28.962706Z","last_seen":"2026-08-02T00:21:28.962706Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"whatsapp-pc.zn-chat-whatapps.hi.cn","fqdn":"whatsapp-pc.zn-chat-whatapps.hi.cn","domain":"zn-chat-whatapps.hi.cn","tld":"hi.cn"},"ip":{"addr":"156.239.9.106","port":0,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-06T00:21:24Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"whatsapp-pc.zn-chat-whatapps.hi.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-02","alert":"Phishing Block","trigger":"whatsapp-pc.zn-chat-whatapps.hi.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"whatsapp-pc.zn-chat-whatapps.hi.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"whatsapp-pc.zn-chat-whatapps.hi.cn","ip":{"addr":"156.239.9.106","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":6,"request_count":2,"received_data":42418,"sent_data":1047,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"whatsapp-pc.zn-chat-whatapps.hi.cn/","fqdn":"whatsapp-pc.zn-chat-whatapps.hi.cn","domain":"zn-chat-whatapps.hi.cn","tld":"hi.cn"},"ip":{"addr":"156.239.9.106","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-02T00:20:55.356Z","timestamp":1785630055356,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wap-whatapp.gd.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 30 Jun 2026 23:54:31 GMT","end":"Mon, 28 Sep 2026 23:54:30 GMT"},"fingerprint":{"sha1":"A5:DA:F8:BF:69:3F:10:C1:8D:50:66:47:DC:9B:21:94:72:10:94:D8","sha256":"74:BA:C5:2E:C9:AC:B8:48:C6:34:EE:9A:ED:84:B4:27:B3:EF:B4:D9:05:2E:B4:7C:E9:40:88:27:F7:55:A5:8C"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: whatsapp-pc.zn-chat-whatapps.hi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 02 Aug 2026 00:20:57 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":37304,"size_decoded":9359,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (4157)","md5":"e7f1af87981d9d32144296f54e6a428d","sha1":"56c454e1a7b1d81b145795993972d99d859d4d4a","sha256":"6f5cffc6acb3c1a1722f4b3e95b88d44b0cf46c4be0478c47274cbb00a249b63","sha512":"bb8186d433e52445fa67dda29bf42092762c9d38b8a449ca6066095fcfcf6289f10a9b2b2daf0cebc1fae99b86005952525c183d9b274f2f8fe3d7d6199164c6","ssdeep":"768:Iv5+UMsyFXW0qjikxzSZvPc4uvIvkf9kpQvfvB:65+UMsqXWxjikFSRPc4uvIvkf9kpQvf5","tlshash":"3bf2e835a5b326a3381381e463e363997ea8d517cc06cd39bfdd5260cfca5a4a89374c","first_seen":"2026-08-02T00:21:28.966777Z","last_seen":"2026-08-02T00:21:28.966777Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2528,"timings":{"blocked":-1,"dns":1054,"connect":295,"send":0,"wait":586,"receive":0,"ssl":593},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"whatsapp-pc.zn-chat-whatapps.hi.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-02","alert":"Phishing Block","trigger":"whatsapp-pc.zn-chat-whatapps.hi.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"whatsapp-pc.zn-chat-whatapps.hi.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"whatsapp-pc.zn-chat-whatapps.hi.cn/favicon.ico","fqdn":"whatsapp-pc.zn-chat-whatapps.hi.cn","domain":"zn-chat-whatapps.hi.cn","tld":"hi.cn"},"ip":{"addr":"156.239.9.106","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://whatsapp-pc.zn-chat-whatapps.hi.cn/","date":"2026-08-02T00:20:58.137Z","timestamp":1785630058137,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wap-whatapp.gd.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 30 Jun 2026 23:54:31 GMT","end":"Mon, 28 Sep 2026 23:54:30 GMT"},"fingerprint":{"sha1":"A5:DA:F8:BF:69:3F:10:C1:8D:50:66:47:DC:9B:21:94:72:10:94:D8","sha256":"74:BA:C5:2E:C9:AC:B8:48:C6:34:EE:9A:ED:84:B4:27:B3:EF:B4:D9:05:2E:B4:7C:E9:40:88:27:F7:55:A5:8C"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: whatsapp-pc.zn-chat-whatapps.hi.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://whatsapp-pc.zn-chat-whatapps.hi.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 02 Aug 2026 00:20:58 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 4286\r\nlast-modified: Wed, 01 Jul 2026 00:54:04 GMT\r\netag: \"6a44652c-10be\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4286,"size_decoded":4727,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel","md5":"8a7e51ecc755de991dae7d39b83b20f0","sha1":"e87ca358c45201919adf4d7e460ed67ca4ae7fac","sha256":"6d782c896932b96eee734d5f8ce40680f990ea18ac85d4ea1f1781c1f5ef9410","sha512":"db7e51f6f301437f432cd250a94841ac19ebd538922f5a122fd55dd53b52c60ebcb149448ed8ffabfa1d4846e3f07031f4b1bed453eb2e870d373cc82f1b678f","ssdeep":"48:TiiiiiK2piiiiiiiiiiiiiiiiiiiiiihaPiiiiiiiiiiiiiiiiiiiiii6fiiiiiW:x26f7d+YRPjq6V0CDFxa6Lg","tlshash":"2991cb46a1512164e1cc6a36cba7e85d81724d537c999a02b13e30df4f377c95cda38a","first_seen":"2026-06-21T01:22:31.785702Z","last_seen":"2026-08-19T23:23:16.212281Z","times_seen":223,"resource_available":false,"data":null}},"time_used":297,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":297,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-02","alert":"Phishing Block","trigger":"whatsapp-pc.zn-chat-whatapps.hi.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"whatsapp-pc.zn-chat-whatapps.hi.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-02","alert":"Sinkholed","trigger":"whatsapp-pc.zn-chat-whatapps.hi.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}}]}