{"report_id":"447e17d8-7633-4a7f-ac32-d0ea29957259","version":0,"status":"done","tags":[],"date":"2026-07-31T15:56:04Z","url":{"schema":"https","addr":"www.cn-store-steampowered.com.cn/","fqdn":"www.cn-store-steampowered.com.cn","domain":"cn-store-steampowered.com.cn","tld":"com.cn"},"ip":{"addr":"154.91.90.242","port":0,"asn":399077,"as":"TERAEXCH","country":"Seychelles","country_code":"SC"},"final":{"url":{"schema":"https","addr":"www.cn-store-steampowered.com.cn/","fqdn":"www.cn-store-steampowered.com.cn","domain":"cn-store-steampowered.com.cn","tld":"com.cn"},"title":"Steam官方下载站 - 游戏平台客户端","dom":{"size":20509,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (2364)","md5":"56492d26f410fef05dd60e0fefdafa63","sha1":"fb299d4da9db4bfbce765ed4096eb5e049b3df0c","sha256":"b1ba99466dc97b2ee73ec5636d2f58ac755bbf2dd85ca13c6763d2eb3bf8deb3","sha512":"f1e4f8e1e73806b071808953f5a738834577a225718a48cc46f6d55bf46ef42db3222fc478db946b0f663da4f21a91edbb8d438b722e0cb2bbdc417bb389c16d","ssdeep":"384:yJFA06hakawzQmA6vQZ5bMN/GtQyr7dm5/64E:4d6DbAmQfbMN/oQyr7o5s","tlshash":"7a929571b209b037643fc8d6a0a5936f30f1c217eb134a54e7fa53a4afc5cd6ab22546","dom_hash":"domhash3ef35749b53c6e2c0dda476665d7d68a","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"www.cn-store-steampowered.com.cn/","fqdn":"www.cn-store-steampowered.com.cn","domain":"cn-store-steampowered.com.cn","tld":"com.cn"},"ip":{"addr":"154.91.90.242","port":0,"asn":399077,"as":"TERAEXCH","country":"Seychelles","country_code":"SC"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-04T15:56:04Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-31","alert":"Phishing Block","trigger":"www.cn-store-steampowered.com.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-31","alert":"Sinkholed","trigger":"www.cn-store-steampowered.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"www.cn-store-steampowered.com.cn","ip":{"addr":"154.91.90.242","port":443,"asn":399077,"as":"TERAEXCH","country":"Seychelles","country_code":"SC"},"domain_registered":"2026-06-01","domain_rank":0,"first_seen":"2026-07-31T15:56:04.374183Z","last_seen":"2026-07-31T15:56:04.374183Z","alert_count":4,"request_count":2,"received_data":21421,"sent_data":1041,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"www.cn-store-steampowered.com.cn/","fqdn":"www.cn-store-steampowered.com.cn","domain":"cn-store-steampowered.com.cn","tld":"com.cn"},"ip":{"addr":"154.91.90.242","port":443,"asn":399077,"as":"TERAEXCH","country":"Seychelles","country_code":"SC"},"introduction_type":"scriptElement","is_inline":true,"md5":"e15bb017989220e188813d13a6e54aad","sha1":"23228c15ae1719fab3309b1b749465d787bf531f","sha256":"8cd1df478a7e63dd7ffe700cb81c32ab3821353407ca9d43926f27f77da9a867","sha512":"0cd5ad64eef94266230e2bfac73134c6a43007e9392befddb236c4b27356001f0a98330cd6c067b92f0b4e0b4b68f8cc79dd105625c3680e4cdc4ebf17171de9","ssdeep":"","tlshash":"6ad0a755b148113a48af5f9990ff1bf835106488d184282b2a99d98a06a50814b636d8","size":226,"data":"","first_seen":"2026-06-05T13:21:44.653529Z","last_seen":"2026-07-31T16:15:36.89218Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"www.cn-store-steampowered.com.cn/favicon.ico","fqdn":"www.cn-store-steampowered.com.cn","domain":"cn-store-steampowered.com.cn","tld":"com.cn"},"ip":{"addr":"154.91.90.242","port":443,"asn":399077,"as":"TERAEXCH","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.cn-store-steampowered.com.cn/","date":"2026-07-31T15:55:38.261Z","timestamp":1785513338261,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cn-store-steampowered.com.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 30 Jul 2026 20:38:32 GMT","end":"Wed, 28 Oct 2026 20:38:31 GMT"},"fingerprint":{"sha1":"EA:18:9C:EC:1E:E0:E9:B1:80:3F:E8:E5:AB:03:65:5E:88:07:47:60","sha256":"32:79:BF:F8:D4:70:59:B2:B1:CC:7B:A6:31:20:E6:08:4B:14:F7:53:44:EC:6A:79:0A:73:AA:CC:5E:3F:2A:0C"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: www.cn-store-steampowered.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.cn-store-steampowered.com.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Fri, 31 Jul 2026 15:55:39 GMT\r\ncontent-type: text/html\r\ncontent-length: 138\r\netag: \"6a1d876f-8a\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":138,"size_decoded":292,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"7389d931c86b3d7bb6b8af46d8c4172b","sha1":"8d2a4760aa0b47984d11cd1a66448719177fb791","sha256":"301bd9f16f94feedfae7a946a14bac38cb73c43efe6117bc5586835af03d7d6f","sha512":"dd6d1511e4fcd5bc09d821ffe091fb5946ac9654c48664aed504e479e9ac20c1cad44b6df90f42190d47e28f5f96bfb09d24056df6b950243d68ee8100a9a889","ssdeep":"","tlshash":"d9c09b5d755366449913155167c33641d196837f689a84510941c593f0cf69ac4c73a9","first_seen":"2023-03-13T12:56:15Z","last_seen":"2026-07-31T16:15:36.890145Z","times_seen":316364,"resource_available":true,"data":null}},"time_used":1006,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1006,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-31","alert":"Phishing Block","trigger":"www.cn-store-steampowered.com.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-31","alert":"Sinkholed","trigger":"www.cn-store-steampowered.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.cn-store-steampowered.com.cn/","fqdn":"www.cn-store-steampowered.com.cn","domain":"cn-store-steampowered.com.cn","tld":"com.cn"},"ip":{"addr":"154.91.90.242","port":443,"asn":399077,"as":"TERAEXCH","country":"Seychelles","country_code":"SC"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-31T15:55:36.344Z","timestamp":1785513336344,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cn-store-steampowered.com.cn","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 30 Jul 2026 20:38:32 GMT","end":"Wed, 28 Oct 2026 20:38:31 GMT"},"fingerprint":{"sha1":"EA:18:9C:EC:1E:E0:E9:B1:80:3F:E8:E5:AB:03:65:5E:88:07:47:60","sha256":"32:79:BF:F8:D4:70:59:B2:B1:CC:7B:A6:31:20:E6:08:4B:14:F7:53:44:EC:6A:79:0A:73:AA:CC:5E:3F:2A:0C"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: www.cn-store-steampowered.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 31 Jul 2026 15:55:37 GMT\r\ncontent-type: text/html\r\nlast-modified: Mon, 08 Jun 2026 15:23:25 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a26de6d-5176\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":20854,"size_decoded":5951,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (2424)","md5":"2c0f9507ae225f22b04de14da0d1c776","sha1":"8d9adcece920cbe97597c044cf739b89e53e60b7","sha256":"a8fc0a0e2c3e3679d0966b6af4dad7d0d0c26f6c90f740191603d32ced90ac5f","sha512":"a6d95552267fc89dffcba9bc5c32ad65d10dfe78f8930f67f96601e1143d218015deaf8f146adbeb4813be3287f8c9682d23816a319aa5d46e91d3813663bd99","ssdeep":"384:mJFJ06hakawzQX9vQu5NT3vxOQyrGEm5H6pS:0S6DwJQENT3vcQyrGX5b","tlshash":"3b928471b209b037203fc8d6a0a5936f30f1c217ea134a54f7fa53a4afc5dd6ab26546","first_seen":"2026-07-31T15:56:09.559236Z","last_seen":"2026-07-31T15:56:18.631989Z","times_seen":3,"resource_available":false,"data":null}},"time_used":1645,"timings":{"blocked":-1,"dns":855,"connect":262,"send":0,"wait":259,"receive":0,"ssl":269},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-31","alert":"Sinkholed","trigger":"www.cn-store-steampowered.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-31","alert":"Phishing Block","trigger":"www.cn-store-steampowered.com.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}