{"report_id":"44e2326f-6154-4f54-af86-2115931bae75","version":0,"status":"done","tags":[],"date":"2026-07-17T13:52:46Z","url":{"schema":"https","addr":"zjygh.eh.xznkjzx.cn/","fqdn":"zjygh.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.126","port":0,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"zjygh.eh.xznkjzx.cn/","fqdn":"zjygh.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"title":"压缩包-压缩和解压缩利器","dom":{"size":6566,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"83bae9f17ad9095fc84e8cdaca3690aa","sha1":"1ab23e14e897ccd85ed7136f84e5fba964103d5f","sha256":"7b2e2d10ff2a63d78209c329a2622ba3b266513d696e450c4591e0692d52b148","sha512":"6e3fa56e80ee3216936cc97f654243b23d050f4bd1f0ce1db04cdc7914c94fccc94ebc95d2c5e475bcdcac62fca1a68e451ecf51cd183230dcfa1ad09eab9e17","ssdeep":"48:ILPivTGzPILTD/IwE8ZOKQmGB0TGzkK5wI90F6DTGz69TGzM2TGzgvjiN9AjcuP1:Ijtt7gC0zeNmvEaTlu7hsDa6","tlshash":"abd1552504f1e11711b3b080ae266b1e7ed1f207cd2a89847aee0be29fc6ed6cc4755d","dom_hash":"domhash56f95751d30bd9998f32c30b42dd6d9a","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"zjygh.eh.xznkjzx.cn/","fqdn":"zjygh.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.126","port":0,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-21T13:52:46Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null},"summary":[{"fqdn":"zjygh.eh.xznkjzx.cn","ip":{"addr":"65.75.210.120","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":60,"request_count":20,"received_data":940320,"sent_data":10027,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery:1.10.2","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]},{"fqdn":"s1.pstatp.com","ip":{"addr":"138.113.181.188","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"domain_registered":"2011-12-27","domain_rank":2838773,"first_seen":"2017-01-31T08:50:20Z","last_seen":"2026-07-08T10:18:13.55997Z","alert_count":0,"request_count":1,"received_data":94309,"sent_data":505,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"zjygh.eh.xznkjzx.cn/","fqdn":"zjygh.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.120","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"2fe97a8a3108811525fb3d8c9f754348","sha1":"b9e992fdc482b72a5643f1b6f7581d4c24d9a10a","sha256":"0ace06567d82d07c76076a749ecca1c4192292fe64f4c704e09553fa4748bd19","sha512":"19e157cbbb6c0e33589221e97078a96dfd23c50937e3317f7692581d7c3c06a474aac3414de7430aedfc2a97b546b5b27586e3b6d0e14884656a08988ca5a8d2","ssdeep":"","tlshash":"16e097ca20823309e92330327e2f60383902702b0965cd407f4faee14fc83380643108","size":301,"data":"","first_seen":"2026-07-17T13:52:53.926643Z","last_seen":"2026-07-17T13:56:29.395574Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zjygh.eh.xznkjzx.cn/","fqdn":"zjygh.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.120","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"5bac004f86f42bbe1ba39d8386ae329c","sha1":"8a09f363ae7032857c22434d930a7c6f98742918","sha256":"cd6563e4133de5c86a4e04d1592532df5fcc49dfe8bef973d24e88b08aebc182","sha512":"354d886b4db5393ab3175ad98e96f0d9c548452bda631a6b3885a602899a01a342c9109d60255ba1bc504a6f701db59591d40c38130f4a4b86111440f8acceeb","ssdeep":"","tlshash":"b7d0134b958191071a6f31785f5f31046663305797cdd54c7c1e97714f1427f82476dd","size":228,"data":"","first_seen":"2026-07-17T09:22:40.697027Z","last_seen":"2026-07-17T13:56:29.396533Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s1.pstatp.com/cdn/expire-1-M/jquery/1.10.2/jquery.min.js","fqdn":"s1.pstatp.com","domain":"pstatp.com","tld":"com"},"ip":{"addr":"138.113.181.188","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"introduction_type":"scriptElement","is_inline":false,"md5":"e0e0559014b222245deb26b6ae8bd940","sha1":"e2f3603e23711f6446f278a411d905623d65201e","sha256":"89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e","sha512":"60740da8f871b8263675db2421b0e565fc18e95c772f7c3d5916f224263cd71a6a2e6acceab2f6f8ba1c0607951f0198f525d87d0589fa57045b1d5f292dacf0","ssdeep":"1536:q4mCgi8DyCuXXFiJ+L0kJQsJVPEKLQRZdC/RlfDknv+p0WzH/IoSZ7qABZnu0sFv:qGsKXlI2p0WPSbDrstfam","tlshash":"ba93f8ddb2d1b06257bb21bd006f540ff236195e280d8850f129e8eabc74a4d9277fad","size":93100,"data":"","first_seen":"2023-03-07T01:02:01Z","last_seen":"2026-07-17T13:56:29.389195Z","times_seen":21665,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zjygh.eh.xznkjzx.cn/static/js/external_load.js","fqdn":"zjygh.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.120","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"19fd91d917238ea5c1431630e95161c3","sha1":"f7ee6273e1e4aa4f7aded4ba05b4e67eca353803","sha256":"35a6d5f58fdc1389f79d40ef5d81ac5ecf6840d799c3da9de48a2d5d9a29a728","sha512":"de764db65d51b148bc9b701035962c7ffe7c0128f446e3da253e8eff87f55d9dca65a086ffa37d2b2b58c7c7be06d07c07ba9ba4136dc988cca4dde1874e1605","ssdeep":"","tlshash":"5f41da7f6a41cc29d37a108a3b6ff346b006111a38069115a47c1d58f931ee3edeaadb","size":2072,"data":"","first_seen":"2026-07-17T09:22:40.664739Z","last_seen":"2026-07-17T13:56:29.386237Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zjygh.eh.xznkjzx.cn/static/js/jquery-2.2.4.min.js","fqdn":"zjygh.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.120","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"710458dd559c957714ac4a8e95357eb5","sha1":"f694238d616f579a0690001f37984af430c19963","sha256":"b409c14a10b4caad6b54844aa63a5faf748b83eecc2dd0d4fb1d913f8de55365","sha512":"282d65828a43bfe50fe0f9aea8bca3838ac1b5250e7c7c359c066e0428aa723f001d31c2463681b2ad6816a49a8571bf9f3ae29b2dc53adf1bbd7d5c4471322b","ssdeep":"1536:fYE1JVoiB9JqZdXXe2pD3PgoIiulrUn6Z6a4tfOR7WpfWBZPBJda4w9W3qG9a98N:u4J+rlfOhWpgCW6G9a98Hrp","tlshash":"3583c6d9b2d6706297b734b850bf410bb17a98dab44c8c60f059d4e47eb4a8e507bf2c","size":85582,"data":"","first_seen":"2023-03-07T01:03:07Z","last_seen":"2026-07-17T14:41:41.044957Z","times_seen":12764,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"error","text":"map[actor:server1.conn0.watcher14.process7//obj25 class:Object extensible:true frozen:false isError:false ownPropertyLength:2 preview:map[kind:Object ownProperties:map[message:map[configurable:true enumerable:true value:Failed to load the script ./assets/download/filename.js?v=20267171352194v5W2 writable:true] status:map[configurable:true enumerable:true value:false writable:true]] ownPropertiesLength:2] sealed:false type:object]","filename":"https://zjygh.eh.xznkjzx.cn/static/js/external_load.js","line_number":1,"column_number":2061}]},"http":[{"url":{"schema":"https","addr":"zjygh.eh.xznkjzx.cn/static/css/page.css","fqdn":"zjygh.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.120","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://zjygh.eh.xznkjzx.cn/","date":"2026-07-17T13:52:19.499Z","timestamp":1784296339499,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zjygh.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:32:05 GMT","end":"Tue, 13 Oct 2026 11:32:04 GMT"},"fingerprint":{"sha1":"7E:1F:CF:36:93:A9:11:BD:9D:E6:4B:E6:42:35:12:BF:0E:73:0F:00","sha256":"31:41:B1:D3:F7:E3:F4:72:67:9B:D4:32:15:4D:68:D8:D8:E6:AB:AF:F5:EA:24:F7:11:F3:1D:F1:F5:71:20:61"}}},"request":{"raw":"GET /static/css/page.css HTTP/1.1\r\nHost: zjygh.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zjygh.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:52:19 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 03 Oct 2024 08:17:19 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66fe530f-8cd\"\r\nexpires: Fri, 17 Jul 2026 18:27:17 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2253,"size_decoded":1182,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"c84ed88ad10ee4fac434b1f0b90b6e1d","sha1":"712a77713905afc8710d9d357a47d8f3d1fc14cd","sha256":"ee864b373be372957dcdd7b0310d369624cef854a687a5ba9d536880791bc101","sha512":"4092468382b27bebcc6083e255236d4390e591c6839eff6e53563cbe5c8b50cc5d1302bb4de02131b753f7572c955e3830f7cc876da8eb1a7d07518832cc5f1e","ssdeep":"","tlshash":"36412320856a3181667ab3e3f9616f097b2fe151616266f4bcc5360cc60f897343b754","first_seen":"2023-04-07T11:55:10Z","last_seen":"2026-07-17T13:56:29.390377Z","times_seen":36,"resource_available":false,"data":null}},"time_used":161,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":161,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zjygh.eh.xznkjzx.cn/static/images/xing.png","fqdn":"zjygh.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.120","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://zjygh.eh.xznkjzx.cn/","date":"2026-07-17T13:52:19.516Z","timestamp":1784296339516,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zjygh.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:32:05 GMT","end":"Tue, 13 Oct 2026 11:32:04 GMT"},"fingerprint":{"sha1":"7E:1F:CF:36:93:A9:11:BD:9D:E6:4B:E6:42:35:12:BF:0E:73:0F:00","sha256":"31:41:B1:D3:F7:E3:F4:72:67:9B:D4:32:15:4D:68:D8:D8:E6:AB:AF:F5:EA:24:F7:11:F3:1D:F1:F5:71:20:61"}}},"request":{"raw":"GET /static/images/xing.png HTTP/1.1\r\nHost: zjygh.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zjygh.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:52:19 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 04 Jun 2026 15:22:52 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a21984c-18277\"\r\nexpires: Sat, 15 Aug 2026 02:59:35 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":98935,"size_decoded":99192,"mime_type":"image/png","magic":"PNG image data, 500 x 421, 8-bit/color RGBA, non-interlaced","md5":"18528f1a1faf4049aecce411d72093d2","sha1":"fc7fc19f2adc9a93fd341bf01566baa837936671","sha256":"364cfe9758183b46634f23ab41dbdbc77d45cf4303b54a2867465bd4caf1b93d","sha512":"0385be3719c6d1131364458060d1646837323279018d07144f24d1b35e81adf3159f5ff7e6abce30acb792bb910c50ff8992c9de8e1da789e65b6e993d671758","ssdeep":"1536:sgJpOky1jhjOeQExngq6Zn2jh73ReLjYYx8iCI4KhjwA80VI/04VoqEo:sS1yjEangqM2jZRGNL4Kd80VIs4VoqEo","tlshash":"aea302dbee23bbe6e6c450fc5c25e43c50e4665ad9343708f7aba012011ad298e25f97","first_seen":"2026-07-17T13:52:53.914836Z","last_seen":"2026-07-17T13:56:29.386834Z","times_seen":2,"resource_available":false,"data":null}},"time_used":387,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":387,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zjygh.eh.xznkjzx.cn/static/picture/zip_logo.png","fqdn":"zjygh.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.120","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://zjygh.eh.xznkjzx.cn/","date":"2026-07-17T13:52:19.521Z","timestamp":1784296339521,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zjygh.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:32:05 GMT","end":"Tue, 13 Oct 2026 11:32:04 GMT"},"fingerprint":{"sha1":"7E:1F:CF:36:93:A9:11:BD:9D:E6:4B:E6:42:35:12:BF:0E:73:0F:00","sha256":"31:41:B1:D3:F7:E3:F4:72:67:9B:D4:32:15:4D:68:D8:D8:E6:AB:AF:F5:EA:24:F7:11:F3:1D:F1:F5:71:20:61"}}},"request":{"raw":"GET /static/picture/zip_logo.png HTTP/1.1\r\nHost: zjygh.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zjygh.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:52:19 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 03 Oct 2024 08:17:23 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66fe5313-21728\"\r\nexpires: Sat, 15 Aug 2026 02:59:36 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":137000,"size_decoded":136645,"mime_type":"image/png","magic":"PNG image data, 375 x 375, 8-bit/color RGBA, non-interlaced","md5":"60a6af60eff54d80070f5114d3ee5475","sha1":"e8a95e4d23ece3dfed76474fb7a0a5581f1d7c25","sha256":"60b049cd4675e8091f12b12cdb608041c43c4c4c1a42f2235a5b0efe3927e784","sha512":"f831f64efbc31914f5dc5dd95e227dd75282e1684b1e909fb764699d5c7cfc39251f9130c2a237c901ea16669e2f91212e14dc11b2c394ad3329934a9f180db8","ssdeep":"3072:4zQ0XYV+PJLwjqQt8DW2hxDxVCX6Ik+xAn1cWCBY3:4EpQlkBQxDxeve1cWX3","tlshash":"27d322c1135594f9529ff6c61bdcb22ba3aa3638b293f4c2f387c5754691fa4c0a115c","first_seen":"2026-07-17T09:22:40.688288Z","last_seen":"2026-07-17T13:56:29.393954Z","times_seen":3,"resource_available":false,"data":null}},"time_used":556,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":556,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zjygh.eh.xznkjzx.cn/static/picture/kuaizip_logo.png","fqdn":"zjygh.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.120","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://zjygh.eh.xznkjzx.cn/","date":"2026-07-17T13:52:19.522Z","timestamp":1784296339522,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zjygh.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:32:05 GMT","end":"Tue, 13 Oct 2026 11:32:04 GMT"},"fingerprint":{"sha1":"7E:1F:CF:36:93:A9:11:BD:9D:E6:4B:E6:42:35:12:BF:0E:73:0F:00","sha256":"31:41:B1:D3:F7:E3:F4:72:67:9B:D4:32:15:4D:68:D8:D8:E6:AB:AF:F5:EA:24:F7:11:F3:1D:F1:F5:71:20:61"}}},"request":{"raw":"GET /static/picture/kuaizip_logo.png HTTP/1.1\r\nHost: zjygh.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zjygh.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:52:19 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 03 Oct 2024 08:17:20 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66fe5310-cd18\"\r\nexpires: Sat, 15 Aug 2026 02:59:36 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":52504,"size_decoded":52865,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"de141dc43ced31a6bbb60cae648f8492","sha1":"85599e88b79334a87377d9c682fb987fa1aa9a11","sha256":"64254acf45dee6aeb271d44728cc67f880abe9c6f395d0fcb9e8ab2ba7597739","sha512":"99a3d5d0ecefa6d6d271ee2eaf44d99b26d4acba8bddd89c2091a46d0624971fcb7a2b730d6b51c33d40396bd0a9f8f3589aa7187948c471b3f2e9a1b612194e","ssdeep":"768:A/Ks/yNet+Rm/9/QxmdlHje1/5WZ6LgC6JMrm/R83AjRPtvHyMVTigKULxjj:AB6Net+MF/GGly957gFmq8e1tvS2hF","tlshash":"0f3302db64d62348d0464f5746827a3b38b5edc3308c385cf9e5789fa87aa30158a0be","first_seen":"2026-07-17T09:22:40.659097Z","last_seen":"2026-07-17T13:56:29.387603Z","times_seen":3,"resource_available":false,"data":null}},"time_used":555,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":555,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zjygh.eh.xznkjzx.cn/static/picture/desc-1.png","fqdn":"zjygh.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.120","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://zjygh.eh.xznkjzx.cn/","date":"2026-07-17T13:52:19.524Z","timestamp":1784296339524,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zjygh.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:32:05 GMT","end":"Tue, 13 Oct 2026 11:32:04 GMT"},"fingerprint":{"sha1":"7E:1F:CF:36:93:A9:11:BD:9D:E6:4B:E6:42:35:12:BF:0E:73:0F:00","sha256":"31:41:B1:D3:F7:E3:F4:72:67:9B:D4:32:15:4D:68:D8:D8:E6:AB:AF:F5:EA:24:F7:11:F3:1D:F1:F5:71:20:61"}}},"request":{"raw":"GET /static/picture/desc-1.png HTTP/1.1\r\nHost: zjygh.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zjygh.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:52:19 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 03 Oct 2024 08:17:21 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66fe5311-5678\"\r\nexpires: Sat, 15 Aug 2026 02:59:36 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":22136,"size_decoded":22405,"mime_type":"image/png","magic":"PNG image data, 400 x 400, 8-bit colormap, non-interlaced","md5":"0a8e5d6158d2eca924d8a36418e17cbe","sha1":"c6da7bb4bba2d87830a1360e9bede41407bcd677","sha256":"19d7af47ddbd009e055ecf805791eaeead25487573ad3aaa3c20b4b5e16374a1","sha512":"80d8cb0f5f746a847d817524749acae8a3e5d9c387067536b2e9205eba5032c25b4c6e9757459cddb06796e41aab5963164c64f4843f102e988ec4633fc6d453","ssdeep":"384:0KjpUY0PitTIW9UcFGAIzFg9Zt8nEa/q6xq8n/t19VgyCVCo8L3G+v5XuxIahVv:0k6YPTIMGJz+DGEWqKq8/ngX63h+xHHv","tlshash":"55a2e164f3e85cfa4e7449294383df3668ca1cac5945260c2b93c5bcfe4055867f9f24","first_seen":"2025-11-22T16:35:10.785225Z","last_seen":"2026-07-17T13:56:29.388596Z","times_seen":4,"resource_available":false,"data":null}},"time_used":554,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":554,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zjygh.eh.xznkjzx.cn/assets/download/filename.js?v=20267171352194v5W2","fqdn":"zjygh.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.120","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://zjygh.eh.xznkjzx.cn/","date":"2026-07-17T13:52:19.736Z","timestamp":1784296339736,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zjygh.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:32:05 GMT","end":"Tue, 13 Oct 2026 11:32:04 GMT"},"fingerprint":{"sha1":"7E:1F:CF:36:93:A9:11:BD:9D:E6:4B:E6:42:35:12:BF:0E:73:0F:00","sha256":"31:41:B1:D3:F7:E3:F4:72:67:9B:D4:32:15:4D:68:D8:D8:E6:AB:AF:F5:EA:24:F7:11:F3:1D:F1:F5:71:20:61"}}},"request":{"raw":"GET /assets/download/filename.js?v=20267171352194v5W2 HTTP/1.1\r\nHost: zjygh.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zjygh.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ndate: Fri, 17 Jul 2026 13:52:20 GMT\r\ncontent-type: text/html\r\ncontent-length: 148\r\netag: \"67bab83a-94\"\r\nserver: nginx\r\nx-cache-status: MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":148,"size_decoded":324,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"630e1f9fef1a483fe84154e2d0d046df","sha1":"f10e0cf39fb920a438116caaea80a71e0dcdc162","sha256":"9cad3cff676946810a81047247f12e4e51faccc01df4134edfd871aee8ba0956","sha512":"33f8257b60c25704f0856806337c13e8afe964c5b075d80f15abd87ffa59ff0329f12de0c4b5978d4640d5b70c0a997c0c239f422d4da5bbdcb3727c281cfcda","ssdeep":"","tlshash":"1ac02b0d346366448a03001023c33240d086833f78da8010380ec083f3cf39ac4c73ae","first_seen":"2024-07-21T17:05:04Z","last_seen":"2026-07-17T15:39:51.527729Z","times_seen":15105,"resource_available":true,"data":null}},"time_used":577,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":577,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s1.pstatp.com/cdn/expire-1-M/jquery/1.10.2/jquery.min.js","fqdn":"s1.pstatp.com","domain":"pstatp.com","tld":"com"},"ip":{"addr":"138.113.181.188","port":443,"asn":54994,"as":"ML-1432-54994","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://zjygh.eh.xznkjzx.cn/","date":"2026-07-17T13:52:19.486Z","timestamp":1784296339486,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.pstatp.com","organization":""},"issuer":{"commonName":"RapidSSL TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Mon, 19 Jan 2026 00:00:00 GMT","end":"Mon, 18 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"A9:6A:E1:A7:75:8A:53:CB:21:EE:80:98:D4:AF:64:06:5E:E0:51:06","sha256":"A1:BC:E6:8F:15:E7:B3:45:C2:FA:F6:70:64:64:31:70:82:BA:4C:BB:B5:CD:B4:1C:F8:84:E2:72:4B:EC:9D:5B"}}},"request":{"raw":"GET /cdn/expire-1-M/jquery/1.10.2/jquery.min.js HTTP/1.1\r\nHost: s1.pstatp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zjygh.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 17 Jul 2026 13:52:19 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Sat, 18 Jul 2026 06:08:01 GMT\r\nLast-Modified: Wed, 26 Jan 2022 04:18:24 GMT\r\nETag: W/\"61f0cb90-16bac\"\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nContent-Encoding: gzip\r\nx-tt-trace-host: 013c516a47b755f26745caabca11e0425ad359ce62203137fbf44990f59080aca2f1513a99e5157cdfea6ca12b10256501b17adcd8d883372878e1171e1c79928cde31274f922d98b3bcf4a8dacf559f4b75216a86cb2da8483145b15e98bf3825eb9331e53d512480961b84bf6a36e6f17c15a58d911f922069675cb10f0195f5\r\nx-tt-trace-id: 00-25022307062252ED95F3BE70BA6E1482-61E170E1443E06D6-00\r\nServer: TLB\r\nX-TT-LOGID: 2025022307062252ED95F3BE70BA6E1482\r\nX-Cache-new: HIT\r\nx-via: 1.1 PS-HFE-01Ama46:2 (Cdn Cache Server V2.0), 1.1 PSrbJP1ww66:13 (Cdn Cache Server V2.0), 1.1 PS-ARN-01C8L93:5 (Cdn Cache Server V2.0)\r\nx-response-cache: edge_hit\r\nx-upper-cache-status: hit\r\nage: 1\r\nserver-timing: cdn-cache;desc=hit,edge;dur=1\r\nx-tt-trace-tag: id=01;cdn-cache=hit;type=static\r\nx-ws-request-id: 6a5a3393_PS-ARN-01C8L93_3567-31349\r\nTiming-Allow-Origin: *\r\nx-tt-supplier-id: 0_2\r\nX-Response-Cinfo: 195.64.118.152\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":93100,"size_decoded":34031,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (32072)","md5":"e0e0559014b222245deb26b6ae8bd940","sha1":"e2f3603e23711f6446f278a411d905623d65201e","sha256":"89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e","sha512":"60740da8f871b8263675db2421b0e565fc18e95c772f7c3d5916f224263cd71a6a2e6acceab2f6f8ba1c0607951f0198f525d87d0589fa57045b1d5f292dacf0","ssdeep":"1536:q4mCgi8DyCuXXFiJ+L0kJQsJVPEKLQRZdC/RlfDknv+p0WzH/IoSZ7qABZnu0sFv:qGsKXlI2p0WPSbDrstfam","tlshash":"ba93f8ddb2d1b06257bb21bd006f540ff236195e280d8850f129e8eabc74a4d9277fad","first_seen":"2023-03-07T01:02:01Z","last_seen":"2026-07-17T13:56:29.389195Z","times_seen":21665,"resource_available":true,"data":null}},"time_used":77,"timings":{"blocked":-1,"dns":34,"connect":8,"send":0,"wait":10,"receive":0,"ssl":24},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"zjygh.eh.xznkjzx.cn/static/picture/logo_white.png","fqdn":"zjygh.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.120","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://zjygh.eh.xznkjzx.cn/","date":"2026-07-17T13:52:19.514Z","timestamp":1784296339514,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zjygh.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:32:05 GMT","end":"Tue, 13 Oct 2026 11:32:04 GMT"},"fingerprint":{"sha1":"7E:1F:CF:36:93:A9:11:BD:9D:E6:4B:E6:42:35:12:BF:0E:73:0F:00","sha256":"31:41:B1:D3:F7:E3:F4:72:67:9B:D4:32:15:4D:68:D8:D8:E6:AB:AF:F5:EA:24:F7:11:F3:1D:F1:F5:71:20:61"}}},"request":{"raw":"GET /static/picture/logo_white.png HTTP/1.1\r\nHost: zjygh.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zjygh.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:52:19 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 03 Oct 2024 08:17:22 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66fe5312-1989\"\r\nexpires: Sat, 15 Aug 2026 02:59:35 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6537,"size_decoded":6888,"mime_type":"image/png","magic":"PNG image data, 195 x 61, 8-bit/color RGBA, non-interlaced","md5":"6063dd7df9ee790197033e1fd9511fad","sha1":"a376eba2016911ac01df11dba43dd7e30005d00e","sha256":"2c5d4b26a0798258ce20bf1a65fe4aec88cce20be8a0cfc5391d9f735ca28acd","sha512":"8bd7bb1e2f289a3945ed1ff41a691f20bdde5d0cb20433736a924e46b7df57d8a4409e454332c21f03ebd2a3e4411c372afa9191b5005a22f0095ae2cb842246","ssdeep":"192:Rqs4JDeSUdRBYgPzxxeCR0sLziMY78hrF9B1:RyJUdRBYgPzxxeC9Lzh88hLf","tlshash":"c2d18f7513a8d95879b58008cc7a4259bc671149668f89389f8aceab63d3cb0c8c9f4b","first_seen":"2026-07-17T09:22:40.653272Z","last_seen":"2026-07-17T13:56:29.393248Z","times_seen":3,"resource_available":false,"data":null}},"time_used":336,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":336,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zjygh.eh.xznkjzx.cn/static/picture/360_logo.png","fqdn":"zjygh.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.120","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://zjygh.eh.xznkjzx.cn/","date":"2026-07-17T13:52:19.518Z","timestamp":1784296339518,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zjygh.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:32:05 GMT","end":"Tue, 13 Oct 2026 11:32:04 GMT"},"fingerprint":{"sha1":"7E:1F:CF:36:93:A9:11:BD:9D:E6:4B:E6:42:35:12:BF:0E:73:0F:00","sha256":"31:41:B1:D3:F7:E3:F4:72:67:9B:D4:32:15:4D:68:D8:D8:E6:AB:AF:F5:EA:24:F7:11:F3:1D:F1:F5:71:20:61"}}},"request":{"raw":"GET /static/picture/360_logo.png HTTP/1.1\r\nHost: zjygh.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zjygh.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:52:19 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 03 Oct 2024 08:17:22 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66fe5312-5f438\"\r\nexpires: Sat, 15 Aug 2026 02:59:36 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":390200,"size_decoded":390408,"mime_type":"image/png","magic":"PNG image data, 800 x 800, 8-bit/color RGBA, non-interlaced","md5":"7baf9a21ac0bec9ee63586d72147fcd9","sha1":"eb130f4290822cea6adf191257295b6859d12d94","sha256":"ffb068ae75557306d939c6cfae5c5a4e672b3f5bc230a124138f9f2cbd0781ad","sha512":"e67c801dcda177da15818c5635a882d71448ecd896662f4d9c808de8ca5584ab8000cdc5a240d5fc2b63f429a6bf17fe555a42ef9c33855120bd4abe7a74e094","ssdeep":"6144:gGWdVhkESGDKqdz3Ut2Lhdj58aaDMru7EbGUDEIG08Dnx88Ugscs:vvGDFUt2Vd6aa4ruMG0y9npUg2","tlshash":"1e84238295744ef1edf69e1e51016c0eaea4cfb1904d5b0dc81f89fb6a061a71237f3a","first_seen":"2026-07-17T09:22:40.657175Z","last_seen":"2026-07-17T13:56:29.384418Z","times_seen":3,"resource_available":false,"data":null}},"time_used":545,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":545,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zjygh.eh.xznkjzx.cn/static/images/mac_first.jpg","fqdn":"zjygh.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.120","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://zjygh.eh.xznkjzx.cn/","date":"2026-07-17T13:52:19.692Z","timestamp":1784296339692,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zjygh.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:32:05 GMT","end":"Tue, 13 Oct 2026 11:32:04 GMT"},"fingerprint":{"sha1":"7E:1F:CF:36:93:A9:11:BD:9D:E6:4B:E6:42:35:12:BF:0E:73:0F:00","sha256":"31:41:B1:D3:F7:E3:F4:72:67:9B:D4:32:15:4D:68:D8:D8:E6:AB:AF:F5:EA:24:F7:11:F3:1D:F1:F5:71:20:61"}}},"request":{"raw":"GET /static/images/mac_first.jpg HTTP/1.1\r\nHost: zjygh.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zjygh.eh.xznkjzx.cn/static/css/default.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:52:19 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Thu, 03 Oct 2024 08:17:20 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66fe5310-4fff\"\r\nexpires: Sat, 15 Aug 2026 02:59:36 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":20479,"size_decoded":16861,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 600x600, segment length 16, progressive, precision 8, 1470x980, components 3","md5":"3a2fa0653814c588b720c76e0e3213fa","sha1":"c341051eb60b5acb72b6fef749dce50ab7bd2a85","sha256":"e4cf93bf4cc26cf2233438e28d47f2162b59eec111588b5148f9a38a11e98630","sha512":"53fcc8a04aa2818c3e01082f448a93e180d25552c7133947379a31577283c400c0a84c28d031a29f0d7fa164ad13c1cdb6c05848cd197d1a35889a4758a474f2","ssdeep":"384:6N8ourOrct5xv/SWQ9qC3pWXEkYXHoHD9DD5bgDDPG3DDDIFDDD2CDDDDDDDDDDC:66ourYctr7QERXEkYXnuZIyzKhYY1pG","tlshash":"b6928deeae535f82d36df127941252602ce3ad15068bd7f786109f261adeafce02c134","first_seen":"2026-07-17T09:22:40.671Z","last_seen":"2026-07-17T13:56:29.381569Z","times_seen":3,"resource_available":false,"data":null}},"time_used":385,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":385,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zjygh.eh.xznkjzx.cn/static/css/style.css","fqdn":"zjygh.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.120","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://zjygh.eh.xznkjzx.cn/","date":"2026-07-17T13:52:19.490Z","timestamp":1784296339490,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zjygh.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:32:05 GMT","end":"Tue, 13 Oct 2026 11:32:04 GMT"},"fingerprint":{"sha1":"7E:1F:CF:36:93:A9:11:BD:9D:E6:4B:E6:42:35:12:BF:0E:73:0F:00","sha256":"31:41:B1:D3:F7:E3:F4:72:67:9B:D4:32:15:4D:68:D8:D8:E6:AB:AF:F5:EA:24:F7:11:F3:1D:F1:F5:71:20:61"}}},"request":{"raw":"GET /static/css/style.css HTTP/1.1\r\nHost: zjygh.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zjygh.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:52:19 GMT\r\ncontent-type: text/css\r\ncontent-length: 728\r\nlast-modified: Thu, 03 Oct 2024 08:17:18 GMT\r\netag: \"66fe530e-2d8\"\r\nexpires: Fri, 17 Jul 2026 18:19:58 GMT\r\ncache-control: max-age=43200\r\nserver: nginx\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":728,"size_decoded":1041,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"3a857d289c690a20d8fb3e0cf5f745bb","sha1":"91c431cb8fda2bbd9134c860d48043504ca19eed","sha256":"1465e29a9ad45aa118021f74ff38eb1ab84683879ca9f2afce7cd1979d5ef5cc","sha512":"bfdcc3c084eaa5beaa931c467dcc8c78ec0cba4e53daa6926a001eb85b9ea517628c4c3d462531762b225a916e39a7c82ebcd5c364e5f10855a8fd1f89a51ad5","ssdeep":"","tlshash":"540115400d730a7876f1414e2ee86b1774dc5b93b0cfd446e8075584cc2e305a041b5e","first_seen":"2023-04-07T11:55:10Z","last_seen":"2026-07-17T13:56:29.389786Z","times_seen":36,"resource_available":false,"data":null}},"time_used":137,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":137,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zjygh.eh.xznkjzx.cn/static/css/default.css","fqdn":"zjygh.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.120","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://zjygh.eh.xznkjzx.cn/","date":"2026-07-17T13:52:19.502Z","timestamp":1784296339502,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zjygh.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:32:05 GMT","end":"Tue, 13 Oct 2026 11:32:04 GMT"},"fingerprint":{"sha1":"7E:1F:CF:36:93:A9:11:BD:9D:E6:4B:E6:42:35:12:BF:0E:73:0F:00","sha256":"31:41:B1:D3:F7:E3:F4:72:67:9B:D4:32:15:4D:68:D8:D8:E6:AB:AF:F5:EA:24:F7:11:F3:1D:F1:F5:71:20:61"}}},"request":{"raw":"GET /static/css/default.css HTTP/1.1\r\nHost: zjygh.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zjygh.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:52:19 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 03 Oct 2024 08:17:19 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66fe530f-3802\"\r\nexpires: Fri, 17 Jul 2026 18:27:17 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14338,"size_decoded":3255,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"a940f1974836b0d596ab873af0b97504","sha1":"d15f8eee0023c4accef1807afb514e12776b72e8","sha256":"f5d1e0ecf5af8a246e0193ec07f3496f403273e097ab55b5be75b7141e71b5b7","sha512":"02e0b69df703f8648b26ca279a154a14cdcc78beb498c725c497184dc90740e42b457c93afa6ab2ad64adf73ddb7d730ab0bd4772f782ca7db8253936bb1197d","ssdeep":"192:xoATQyyxLYUMV03lhD3fQp0shUQ4a9Yj6R6D4PJJcxKKxY9J9qyrws7xIo:VTQyULYUMmPfQOxk","tlshash":"50520b64c6062187f137e6f82f7113a9ea65804bab03052c7be4b2909fb556c6d63fcd","first_seen":"2026-07-17T09:22:40.650005Z","last_seen":"2026-07-17T13:56:29.391915Z","times_seen":3,"resource_available":false,"data":null}},"time_used":177,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":177,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zjygh.eh.xznkjzx.cn/static/js/external_load.js","fqdn":"zjygh.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.120","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://zjygh.eh.xznkjzx.cn/","date":"2026-07-17T13:52:19.506Z","timestamp":1784296339506,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zjygh.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:32:05 GMT","end":"Tue, 13 Oct 2026 11:32:04 GMT"},"fingerprint":{"sha1":"7E:1F:CF:36:93:A9:11:BD:9D:E6:4B:E6:42:35:12:BF:0E:73:0F:00","sha256":"31:41:B1:D3:F7:E3:F4:72:67:9B:D4:32:15:4D:68:D8:D8:E6:AB:AF:F5:EA:24:F7:11:F3:1D:F1:F5:71:20:61"}}},"request":{"raw":"GET /static/js/external_load.js HTTP/1.1\r\nHost: zjygh.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zjygh.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:52:19 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 03 Oct 2024 08:17:20 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66fe5310-818\"\r\nexpires: Fri, 17 Jul 2026 18:27:19 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2072,"size_decoded":1133,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (2072), with no line terminators","md5":"19fd91d917238ea5c1431630e95161c3","sha1":"f7ee6273e1e4aa4f7aded4ba05b4e67eca353803","sha256":"35a6d5f58fdc1389f79d40ef5d81ac5ecf6840d799c3da9de48a2d5d9a29a728","sha512":"de764db65d51b148bc9b701035962c7ffe7c0128f446e3da253e8eff87f55d9dca65a086ffa37d2b2b58c7c7be06d07c07ba9ba4136dc988cca4dde1874e1605","ssdeep":"","tlshash":"5f41da7f6a41cc29d37a108a3b6ff346b006111a38069115a47c1d58f931ee3edeaadb","first_seen":"2026-07-17T09:22:40.664739Z","last_seen":"2026-07-17T13:56:29.386237Z","times_seen":3,"resource_available":true,"data":null}},"time_used":174,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":174,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zjygh.eh.xznkjzx.cn/static/js/jquery-2.2.4.min.js","fqdn":"zjygh.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.120","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://zjygh.eh.xznkjzx.cn/","date":"2026-07-17T13:52:19.507Z","timestamp":1784296339507,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zjygh.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:32:05 GMT","end":"Tue, 13 Oct 2026 11:32:04 GMT"},"fingerprint":{"sha1":"7E:1F:CF:36:93:A9:11:BD:9D:E6:4B:E6:42:35:12:BF:0E:73:0F:00","sha256":"31:41:B1:D3:F7:E3:F4:72:67:9B:D4:32:15:4D:68:D8:D8:E6:AB:AF:F5:EA:24:F7:11:F3:1D:F1:F5:71:20:61"}}},"request":{"raw":"GET /static/js/jquery-2.2.4.min.js HTTP/1.1\r\nHost: zjygh.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zjygh.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:52:19 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 03 Oct 2024 08:17:21 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66fe5311-14e4e\"\r\nexpires: Fri, 17 Jul 2026 18:27:19 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":85582,"size_decoded":30411,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (32065), with CRLF line terminators","md5":"710458dd559c957714ac4a8e95357eb5","sha1":"f694238d616f579a0690001f37984af430c19963","sha256":"b409c14a10b4caad6b54844aa63a5faf748b83eecc2dd0d4fb1d913f8de55365","sha512":"282d65828a43bfe50fe0f9aea8bca3838ac1b5250e7c7c359c066e0428aa723f001d31c2463681b2ad6816a49a8571bf9f3ae29b2dc53adf1bbd7d5c4471322b","ssdeep":"1536:fYE1JVoiB9JqZdXXe2pD3PgoIiulrUn6Z6a4tfOR7WpfWBZPBJda4w9W3qG9a98N:u4J+rlfOhWpgCW6G9a98Hrp","tlshash":"3583c6d9b2d6706297b734b850bf410bb17a98dab44c8c60f059d4e47eb4a8e507bf2c","first_seen":"2023-03-07T01:03:07Z","last_seen":"2026-07-17T14:41:41.044957Z","times_seen":12764,"resource_available":true,"data":null}},"time_used":270,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":270,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zjygh.eh.xznkjzx.cn/static/picture/desc-3.png","fqdn":"zjygh.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.120","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://zjygh.eh.xznkjzx.cn/","date":"2026-07-17T13:52:19.526Z","timestamp":1784296339526,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zjygh.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:32:05 GMT","end":"Tue, 13 Oct 2026 11:32:04 GMT"},"fingerprint":{"sha1":"7E:1F:CF:36:93:A9:11:BD:9D:E6:4B:E6:42:35:12:BF:0E:73:0F:00","sha256":"31:41:B1:D3:F7:E3:F4:72:67:9B:D4:32:15:4D:68:D8:D8:E6:AB:AF:F5:EA:24:F7:11:F3:1D:F1:F5:71:20:61"}}},"request":{"raw":"GET /static/picture/desc-3.png HTTP/1.1\r\nHost: zjygh.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zjygh.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:52:19 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 03 Oct 2024 08:17:22 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66fe5312-3316\"\r\nexpires: Sat, 15 Aug 2026 02:59:37 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13078,"size_decoded":13209,"mime_type":"image/png","magic":"PNG image data, 400 x 400, 8-bit colormap, non-interlaced","md5":"93b2cf84d58b39a1e3f92169ab2f224f","sha1":"a3ecde38f85e6a80d5370bd25abf90bdc2176166","sha256":"73d73a12f539dcc34032964d6c2c3c2ca7c9e64239feb20f5abe02da612dd4aa","sha512":"6c4f9aafaaadf3b7bb4303dd31c79f2a286e3b7e38c0b2dcc21ee341ecfac06d41de90217a9e9ed1bc24aa2d49e99b4a0e2a902dcb8854536f2122720a01643b","ssdeep":"384:XqXH9N+iq3yZynq+/vxupr8iO1+wkLjsrf0z:XqXHei4yZynq+/vx3iO1vk/srsz","tlshash":"c242c044656bbecfeff9e5b41d80b53146f1397a2f5f1ae4860a8c50ff0066613228a7","first_seen":"2025-11-22T16:35:10.790464Z","last_seen":"2026-07-17T13:56:29.391021Z","times_seen":4,"resource_available":false,"data":null}},"time_used":551,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":551,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zjygh.eh.xznkjzx.cn/","fqdn":"zjygh.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.120","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-17T13:52:18.226Z","timestamp":1784296338226,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zjygh.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:32:05 GMT","end":"Tue, 13 Oct 2026 11:32:04 GMT"},"fingerprint":{"sha1":"7E:1F:CF:36:93:A9:11:BD:9D:E6:4B:E6:42:35:12:BF:0E:73:0F:00","sha256":"31:41:B1:D3:F7:E3:F4:72:67:9B:D4:32:15:4D:68:D8:D8:E6:AB:AF:F5:EA:24:F7:11:F3:1D:F1:F5:71:20:61"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: zjygh.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:52:18 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 15 Jul 2026 08:36:05 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a574675-17c7\"\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"jQuery:1.10.2","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6087,"size_decoded":2166,"mime_type":"text/html","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"5d3109ec97d43bc7d24699823aaa2514","sha1":"d45758855e43ece1a4764efe1cba2de7ecf71c4d","sha256":"361ec638eff3ca359c9c8261301d6cb6e68e0c8da124ffece5f2a4b1b7e2a45d","sha512":"20036b3a6d1107e9f4b2345585cbf543694f216787e228938147bbf0eff3f869fe9e0b77d1ce25cc76dce0b5902dd01031351062cc11100e3990ecd8a9f2ea48","ssdeep":"48:ILPrwTGzPILT+JBt8gbKmGBSt5wI90F6GGnvjiN9AjcuPEjHOwCO47luyChsD1I5:IjF07VC0keNmvEaTlu7hsD1IdQM","tlshash":"adc1312504f1e15701f3a0809f266b0e7ed1e607ce2a994879ed4be68fc6ecacd0785d","first_seen":"2026-07-17T13:52:53.92347Z","last_seen":"2026-07-17T13:56:29.382889Z","times_seen":2,"resource_available":true,"data":null}},"time_used":707,"timings":{"blocked":-1,"dns":76,"connect":134,"send":0,"wait":350,"receive":0,"ssl":147},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zjygh.eh.xznkjzx.cn/static/css/base.css","fqdn":"zjygh.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.120","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://zjygh.eh.xznkjzx.cn/","date":"2026-07-17T13:52:19.492Z","timestamp":1784296339492,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zjygh.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:32:05 GMT","end":"Tue, 13 Oct 2026 11:32:04 GMT"},"fingerprint":{"sha1":"7E:1F:CF:36:93:A9:11:BD:9D:E6:4B:E6:42:35:12:BF:0E:73:0F:00","sha256":"31:41:B1:D3:F7:E3:F4:72:67:9B:D4:32:15:4D:68:D8:D8:E6:AB:AF:F5:EA:24:F7:11:F3:1D:F1:F5:71:20:61"}}},"request":{"raw":"GET /static/css/base.css HTTP/1.1\r\nHost: zjygh.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zjygh.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:52:19 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 03 Oct 2024 08:17:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66fe530e-146f\"\r\nexpires: Fri, 17 Jul 2026 18:27:16 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5231,"size_decoded":2376,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"6ba1a96109d3a33c0f83ff07dc3e67d3","sha1":"ac0d6458ff719d9c6c821e68ac839909261ce485","sha256":"fb0c191ad803ccfc9456a9c4a2cd3e2b25673611e71393f469ee09e4c5a0d994","sha512":"3e06c00e95e793169b3a6f9bd07d561228b8c2af5c03f964adc861aa712fc2c32877a07eb32c54452b6c7338916e2acaf89eed7448c2495d677fe1b89ec33b90","ssdeep":"96:sXQBOXl+9JnDop2IQ/tsyrDHmJwhLPadVq11QVOBP:kuRnDcQVZ+Jwhza2N","tlshash":"8db10d810e212519a23f66b7e8a35e7abf4f20174153b0e7b4a07d41cecb79f025276d","first_seen":"2023-04-07T11:55:10Z","last_seen":"2026-07-17T13:56:29.385025Z","times_seen":36,"resource_available":false,"data":null}},"time_used":138,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":138,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zjygh.eh.xznkjzx.cn/static/css/animate.min.css","fqdn":"zjygh.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.120","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://zjygh.eh.xznkjzx.cn/","date":"2026-07-17T13:52:19.497Z","timestamp":1784296339497,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zjygh.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:32:05 GMT","end":"Tue, 13 Oct 2026 11:32:04 GMT"},"fingerprint":{"sha1":"7E:1F:CF:36:93:A9:11:BD:9D:E6:4B:E6:42:35:12:BF:0E:73:0F:00","sha256":"31:41:B1:D3:F7:E3:F4:72:67:9B:D4:32:15:4D:68:D8:D8:E6:AB:AF:F5:EA:24:F7:11:F3:1D:F1:F5:71:20:61"}}},"request":{"raw":"GET /static/css/animate.min.css HTTP/1.1\r\nHost: zjygh.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zjygh.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:52:19 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 03 Oct 2024 08:17:19 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66fe530f-d8e2\"\r\nexpires: Fri, 17 Jul 2026 18:27:17 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":55522,"size_decoded":4319,"mime_type":"text/css","magic":"ASCII text, with very long lines (55361)","md5":"7b6990dd2abe293cce3d14bf1aefb9c9","sha1":"7446125d10abed8f04b502f7c33d64bfe8bfee82","sha256":"28b4c5c949bf53b79235cb7623e28d719e7e3b8587b1af376cadf89b7b865ac5","sha512":"a89d3f96a6529081dbfa5c29312f681a4586504962b938261ae5c85164fae3f0bbc3de964ff473575493537c9049c0462be7bcd5a6458e8460789bffb5a54c80","ssdeep":"768:3kZsIOIS86I5I6IDwk1mA3kSDL3Kyu5ZrKeB0eTcs5s3:3kZtIDwk1mA3kSDL3Kyu5ZrKeB0eTi","tlshash":"954306ae5851228991674fa2c3dc4e68872dc67714621cde73816c4b8f87faf33da607","first_seen":"2023-04-07T11:55:10Z","last_seen":"2026-07-17T13:56:29.383777Z","times_seen":1511,"resource_available":false,"data":null}},"time_used":162,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":162,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zjygh.eh.xznkjzx.cn/static/picture/desc-2.png","fqdn":"zjygh.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.120","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://zjygh.eh.xznkjzx.cn/","date":"2026-07-17T13:52:19.525Z","timestamp":1784296339525,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zjygh.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:32:05 GMT","end":"Tue, 13 Oct 2026 11:32:04 GMT"},"fingerprint":{"sha1":"7E:1F:CF:36:93:A9:11:BD:9D:E6:4B:E6:42:35:12:BF:0E:73:0F:00","sha256":"31:41:B1:D3:F7:E3:F4:72:67:9B:D4:32:15:4D:68:D8:D8:E6:AB:AF:F5:EA:24:F7:11:F3:1D:F1:F5:71:20:61"}}},"request":{"raw":"GET /static/picture/desc-2.png HTTP/1.1\r\nHost: zjygh.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zjygh.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:52:19 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 03 Oct 2024 08:17:22 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66fe5312-4388\"\r\nexpires: Sat, 15 Aug 2026 02:59:36 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17288,"size_decoded":17505,"mime_type":"image/png","magic":"PNG image data, 400 x 400, 8-bit colormap, non-interlaced","md5":"c1f7cd87a10b54997cc4de7ea399a485","sha1":"d488e581f3a19bb86de2736b96bcc9f0eabb4f5e","sha256":"1cebead433128aff7f8410fbd3243cc7d72e221524adbc997d2e79b89f970853","sha512":"a8591268307adb9b143823b9639967fda4463402b4f31c6e23c9b2ecf64be1c7442f5bb54b713efb8d99c2e531c4edc35b5b3be9f14b3f096c7b3021bbbfb37d","ssdeep":"384:gvNT3uSAh0cVbsggJF6bQHeCEeopkwJvX/nVOMtC+qf2:ETef0+ggpEHeeorPltb","tlshash":"6972d0e27383c65a4e1394570f83b5cafb9f76445a05fd00a6285e05d2e39bb2ca03ac","first_seen":"2025-11-22T16:35:10.78637Z","last_seen":"2026-07-17T13:56:29.394862Z","times_seen":4,"resource_available":false,"data":null}},"time_used":552,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":552,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zjygh.eh.xznkjzx.cn/favicon.ico","fqdn":"zjygh.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.120","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://zjygh.eh.xznkjzx.cn/","date":"2026-07-17T13:52:20.359Z","timestamp":1784296340359,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zjygh.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:32:05 GMT","end":"Tue, 13 Oct 2026 11:32:04 GMT"},"fingerprint":{"sha1":"7E:1F:CF:36:93:A9:11:BD:9D:E6:4B:E6:42:35:12:BF:0E:73:0F:00","sha256":"31:41:B1:D3:F7:E3:F4:72:67:9B:D4:32:15:4D:68:D8:D8:E6:AB:AF:F5:EA:24:F7:11:F3:1D:F1:F5:71:20:61"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: zjygh.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zjygh.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ndate: Fri, 17 Jul 2026 13:52:20 GMT\r\ncontent-type: text/html\r\ncontent-length: 148\r\netag: \"67bab83a-94\"\r\nserver: nginx\r\nx-cache-status: MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":148,"size_decoded":324,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"630e1f9fef1a483fe84154e2d0d046df","sha1":"f10e0cf39fb920a438116caaea80a71e0dcdc162","sha256":"9cad3cff676946810a81047247f12e4e51faccc01df4134edfd871aee8ba0956","sha512":"33f8257b60c25704f0856806337c13e8afe964c5b075d80f15abd87ffa59ff0329f12de0c4b5978d4640d5b70c0a997c0c239f422d4da5bbdcb3727c281cfcda","ssdeep":"","tlshash":"1ac02b0d346366448a03001023c33240d086833f78da8010380ec083f3cf39ac4c73ae","first_seen":"2024-07-21T17:05:04Z","last_seen":"2026-07-17T15:39:51.527729Z","times_seen":15105,"resource_available":true,"data":null}},"time_used":356,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":356,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zjygh.eh.xznkjzx.cn/static/css/common.css","fqdn":"zjygh.eh.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"65.75.210.120","port":443,"asn":50131,"as":"Spartan Host Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://zjygh.eh.xznkjzx.cn/","date":"2026-07-17T13:52:19.495Z","timestamp":1784296339495,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zjygh.eh.xznkjzx.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Jul 2026 11:32:05 GMT","end":"Tue, 13 Oct 2026 11:32:04 GMT"},"fingerprint":{"sha1":"7E:1F:CF:36:93:A9:11:BD:9D:E6:4B:E6:42:35:12:BF:0E:73:0F:00","sha256":"31:41:B1:D3:F7:E3:F4:72:67:9B:D4:32:15:4D:68:D8:D8:E6:AB:AF:F5:EA:24:F7:11:F3:1D:F1:F5:71:20:61"}}},"request":{"raw":"GET /static/css/common.css HTTP/1.1\r\nHost: zjygh.eh.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://zjygh.eh.xznkjzx.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 13:52:19 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 03 Oct 2024 08:17:19 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66fe530f-f8e\"\r\nexpires: Fri, 17 Jul 2026 18:27:17 GMT\r\ncache-control: max-age=43200\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3982,"size_decoded":1818,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"a3b61d3ed2da153acdee24128ab6fc9b","sha1":"683626a717778e99c29c00aae41ffbab1c793745","sha256":"010d86e997a38d289806f1cfc968241c1bde293225aefcf82705c497759eb63a","sha512":"ff635fb521abfac9cb738daaab3261386d9d8831bfdd4d01314635a92b05d75275c9e5847a0ca6be04bba14ff11fe5b84a5401b7ba59d656be2e90b9fd64f14e","ssdeep":"","tlshash":"e6815511c20230167177c6b9b792cb0eeb6be103970323b97e962694cb5d4965e72bd8","first_seen":"2026-07-17T09:22:40.676491Z","last_seen":"2026-07-17T13:56:29.385651Z","times_seen":3,"resource_available":false,"data":null}},"time_used":146,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":146,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"zjygh.eh.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}