{"report_id":"4e9b315b-bc48-4b09-a27b-1820476ffd42","version":0,"status":"done","tags":[],"date":"2026-07-31T15:54:17Z","url":{"schema":"https","addr":"www.store-steampowered-zhcn.com.cn/","fqdn":"www.store-steampowered-zhcn.com.cn","domain":"store-steampowered-zhcn.com.cn","tld":"com.cn"},"ip":{"addr":"154.91.90.242","port":0,"asn":399077,"as":"TERAEXCH","country":"Seychelles","country_code":"SC"},"final":{"url":{"schema":"https","addr":"www.store-steampowered-zhcn.com.cn/","fqdn":"www.store-steampowered-zhcn.com.cn","domain":"store-steampowered-zhcn.com.cn","tld":"com.cn"},"title":"Steam平台下载 - 游戏分发客户端","dom":{"size":20535,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (2364)","md5":"5524f90ed0b2df20bdbd8edd6bef764a","sha1":"df85279351e34230a2949846a732cb7c43298193","sha256":"58d90fafc7699c8e8ec23df7e9064561eb5ea280862ceae8349c5bb26f705fd3","sha512":"d9c422b52e1a78de7ac4ab5c4480fdfcd41d95c15bb7e82b4d039275ba9ba098cc024f1e5fe5c3bd2248562b6d0d40bce236e1a482fda3ff0e4382c4d30c4c41","ssdeep":"384:TuymMKAkHT5QvMjbcZ5bMN/G5Qyr7dm5/6YE:TuRMawMncfbMN/kQyr7o5c","tlshash":"3e928471b041b03b253fc8d6a0a5936f70f1c207ea134a14e7fa53e49fc6dd6ab26946","dom_hash":"domhash3ef35749b53c6e2c0dda476665d7d68a","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"www.store-steampowered-zhcn.com.cn/","fqdn":"www.store-steampowered-zhcn.com.cn","domain":"store-steampowered-zhcn.com.cn","tld":"com.cn"},"ip":{"addr":"154.91.90.242","port":0,"asn":399077,"as":"TERAEXCH","country":"Seychelles","country_code":"SC"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-04T15:54:17Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-31","alert":"Sinkholed","trigger":"www.store-steampowered-zhcn.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-31","alert":"Phishing Block","trigger":"www.store-steampowered-zhcn.com.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-31","alert":"Sinkholed","trigger":"www.store-steampowered-zhcn.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"www.store-steampowered-zhcn.com.cn","ip":{"addr":"154.91.90.242","port":443,"asn":399077,"as":"TERAEXCH","country":"Seychelles","country_code":"SC"},"domain_registered":"2026-06-01","domain_rank":0,"first_seen":"2026-07-31T15:54:17.399684Z","last_seen":"2026-07-31T15:54:17.399684Z","alert_count":6,"request_count":2,"received_data":21417,"sent_data":1047,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"www.store-steampowered-zhcn.com.cn/","fqdn":"www.store-steampowered-zhcn.com.cn","domain":"store-steampowered-zhcn.com.cn","tld":"com.cn"},"ip":{"addr":"154.91.90.242","port":443,"asn":399077,"as":"TERAEXCH","country":"Seychelles","country_code":"SC"},"introduction_type":"scriptElement","is_inline":true,"md5":"e15bb017989220e188813d13a6e54aad","sha1":"23228c15ae1719fab3309b1b749465d787bf531f","sha256":"8cd1df478a7e63dd7ffe700cb81c32ab3821353407ca9d43926f27f77da9a867","sha512":"0cd5ad64eef94266230e2bfac73134c6a43007e9392befddb236c4b27356001f0a98330cd6c067b92f0b4e0b4b68f8cc79dd105625c3680e4cdc4ebf17171de9","ssdeep":"","tlshash":"6ad0a755b148113a48af5f9990ff1bf835106488d184282b2a99d98a06a50814b636d8","size":226,"data":"","first_seen":"2026-06-05T13:21:44.653529Z","last_seen":"2026-07-31T16:15:36.89218Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"www.store-steampowered-zhcn.com.cn/","fqdn":"www.store-steampowered-zhcn.com.cn","domain":"store-steampowered-zhcn.com.cn","tld":"com.cn"},"ip":{"addr":"154.91.90.242","port":443,"asn":399077,"as":"TERAEXCH","country":"Seychelles","country_code":"SC"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-31T15:53:41.387Z","timestamp":1785513221387,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cn.store-steampowered-zhcn.com.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 30 Jul 2026 20:47:21 GMT","end":"Wed, 28 Oct 2026 20:47:20 GMT"},"fingerprint":{"sha1":"77:7C:DE:CA:9A:9C:27:7F:18:AD:34:B4:81:F8:5F:67:76:F9:8B:B8","sha256":"BF:4D:49:52:06:20:20:3E:4B:2A:7D:00:9A:AC:B2:09:4E:71:BD:5B:E3:C3:C0:E4:BD:DD:0A:8C:99:DA:7D:D7"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: www.store-steampowered-zhcn.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 31 Jul 2026 15:53:44 GMT\r\ncontent-type: text/html\r\nlast-modified: Mon, 08 Jun 2026 15:23:25 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a26de6d-5172\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":20850,"size_decoded":5941,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (2424)","md5":"1bcb21e495454a6e16adc541a56fe147","sha1":"3822436701b749310d84a12b8822a962775705c8","sha256":"8d4ee1f787d816bd166b9b070b24cba31f1f2b970bf193d963ef71db21503624","sha512":"660a2fa9c19bdf9f191ecd0d50b4b51c0f29a13229988d5b804a287ab04953ea3d782fe246e011eb46564f37c63b63f004f90b0101ced2c4957a3747c67e354d","ssdeep":"384:3uHmMKAkHT5Qk0bcu5NT3vxGQyrGEm5H6dS:3uGMatYcENT3vMQyrGX5v","tlshash":"e6928371b001a03b243fc8d6a1a5936f70f1c207ea134a54f7fa53e49fc6dd6ab26946","first_seen":"2026-07-31T15:54:20.495709Z","last_seen":"2026-07-31T16:15:36.887929Z","times_seen":4,"resource_available":false,"data":null}},"time_used":3747,"timings":{"blocked":-1,"dns":1352,"connect":267,"send":0,"wait":530,"receive":0,"ssl":1598},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-31","alert":"Sinkholed","trigger":"www.store-steampowered-zhcn.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-31","alert":"Phishing Block","trigger":"www.store-steampowered-zhcn.com.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-31","alert":"Sinkholed","trigger":"www.store-steampowered-zhcn.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.store-steampowered-zhcn.com.cn/favicon.ico","fqdn":"www.store-steampowered-zhcn.com.cn","domain":"store-steampowered-zhcn.com.cn","tld":"com.cn"},"ip":{"addr":"154.91.90.242","port":443,"asn":399077,"as":"TERAEXCH","country":"Seychelles","country_code":"SC"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.store-steampowered-zhcn.com.cn/","date":"2026-07-31T15:53:45.380Z","timestamp":1785513225380,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cn.store-steampowered-zhcn.com.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 30 Jul 2026 20:47:21 GMT","end":"Wed, 28 Oct 2026 20:47:20 GMT"},"fingerprint":{"sha1":"77:7C:DE:CA:9A:9C:27:7F:18:AD:34:B4:81:F8:5F:67:76:F9:8B:B8","sha256":"BF:4D:49:52:06:20:20:3E:4B:2A:7D:00:9A:AC:B2:09:4E:71:BD:5B:E3:C3:C0:E4:BD:DD:0A:8C:99:DA:7D:D7"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: www.store-steampowered-zhcn.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.store-steampowered-zhcn.com.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Fri, 31 Jul 2026 15:53:45 GMT\r\ncontent-type: text/html\r\ncontent-length: 138\r\netag: \"6a1d877e-8a\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":138,"size_decoded":292,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"7389d931c86b3d7bb6b8af46d8c4172b","sha1":"8d2a4760aa0b47984d11cd1a66448719177fb791","sha256":"301bd9f16f94feedfae7a946a14bac38cb73c43efe6117bc5586835af03d7d6f","sha512":"dd6d1511e4fcd5bc09d821ffe091fb5946ac9654c48664aed504e479e9ac20c1cad44b6df90f42190d47e28f5f96bfb09d24056df6b950243d68ee8100a9a889","ssdeep":"","tlshash":"d9c09b5d755366449913155167c33641d196837f689a84510941c593f0cf69ac4c73a9","first_seen":"2023-03-13T12:56:15Z","last_seen":"2026-07-31T16:15:36.890145Z","times_seen":316364,"resource_available":true,"data":null}},"time_used":264,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":264,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-31","alert":"Sinkholed","trigger":"www.store-steampowered-zhcn.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-31","alert":"Sinkholed","trigger":"www.store-steampowered-zhcn.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-31","alert":"Phishing Block","trigger":"www.store-steampowered-zhcn.com.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}