{"report_id":"566e5d7a-bde6-4fc1-b606-13e7f4fee98a","version":0,"status":"done","tags":[],"date":"2026-08-07T03:43:42Z","url":{"schema":"https","addr":"www.bobaoapp.com.cn/","fqdn":"www.bobaoapp.com.cn","domain":"bobaoapp.com.cn","tld":"com.cn"},"ip":{"addr":"94.154.43.128","port":0,"asn":208485,"as":"Moon Dc","country":"United Kingdom","country_code":"GB"},"final":{"url":{"schema":"https","addr":"www.bobaoapp.com.cn/","fqdn":"www.bobaoapp.com.cn","domain":"bobaoapp.com.cn","tld":"com.cn"},"title":"TronLink钱包官网 - 波宝钱包 | TRON生态去中心化自托管钱包","dom":{"size":137,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"5069ae5ba7662051a8d27184c55dba54","sha1":"df42dfb9decb3b58c3cfaaa329ae52454abb9370","sha256":"b397fa9962efd76e5ee42ce027eab7e86742e163f1aa64dec3cf255fde584e2b","sha512":"82f93a9c14934897bc5dbab690b84d4c8962ebfd652a58cbf362e5aa980f0d1fe8b29182739aaaa5d5cb451298395d068bc6df34cf84a57701a23a3f800fd909","ssdeep":"","tlshash":"99c02b0d3463614cdd03116017c33240c088c33f685ac01008018483b0cf2aac4c23a5","dom_hash":"domhash18da208b3b39949e9ba09528a720f5c0","first_seen":"2025-10-26T14:40:32.793591Z","last_seen":"2026-09-22T11:58:33.451752Z","times_seen":21853,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"www.bobaoapp.com.cn/","fqdn":"www.bobaoapp.com.cn","domain":"bobaoapp.com.cn","tld":"com.cn"},"ip":{"addr":"94.154.43.128","port":0,"asn":208485,"as":"Moon Dc","country":"United Kingdom","country_code":"GB"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-11T03:43:42Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-07","alert":"Sinkholed","trigger":"www.bobaoapp.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-07","alert":"Sinkholed","trigger":"www.bobaoapp.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-07","alert":"Sinkholed","trigger":"www.bobaoapp.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null},"summary":[{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-08-02T22:23:34.841384Z","alert_count":0,"request_count":1,"received_data":5571,"sent_data":565,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"sdk.51.la","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2005-01-17","domain_rank":347679,"first_seen":"2021-03-08T16:03:51Z","last_seen":"2026-08-04T16:16:21.618133Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":461,"comment":"","tags":null,"fingerprints":null},{"fqdn":"www.bobaoapp.com.cn","ip":{"addr":"94.154.43.130","port":443,"asn":208485,"as":"Moon Dc","country":"United Kingdom","country_code":"GB"},"domain_registered":"2026-07-09","domain_rank":0,"first_seen":"2026-08-07T03:41:52.609832Z","last_seen":"2026-08-07T03:41:52.609832Z","alert_count":24,"request_count":8,"received_data":546959,"sent_data":4248,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"WordPress:6.9.4","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"Yoast SEO:28.0","description":"Yoast SEO is a search engine optimisation plugin for WordPress and other platforms.","website":"https://yoast.com/wordpress/plugins/seo/","common_platform_enumeration":"","icon":"Yoast SEO.png","categories":["SEO","WordPress plugins"]},{"name":"WordPress Site Editor","description":"Full Site Editing enables users to design and customize their entire WordPress website with a block-based editor.","website":"https://wordpress.org/documentation/article/site-editor/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"WordPress Block Editor","description":"Sites using the WordPress Block Editor, also known as Gutenberg.","website":"https://wordpress.org/gutenberg/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"www.bobaoapp.com.cn/tiao.js","fqdn":"www.bobaoapp.com.cn","domain":"bobaoapp.com.cn","tld":"com.cn"},"ip":{"addr":"94.154.43.130","port":443,"asn":208485,"as":"Moon Dc","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"dd508ee2e74e1535ea1cccd230ca17dc","sha1":"d7acc424bdcc23518771d9132eb3329233730482","sha256":"733b761f21ac74ad0ffe084fffa266b2d332d3153aff3ec6c24a616513db838b","sha512":"ab34fe01b04d09f2ff03cbd887e4e8ad7029bc2c2cf9c0499b991c67fdbaa0d73d44debfa51a1d616b7cd298f82c20c9b1cf1c4c5f5e536065818712a2476d96","ssdeep":"","tlshash":"bd014c5fb1af200598230898e676100875b1e876b8ef9b2530eec6c65b5d4a609735cf","size":755,"data":"","first_seen":"2025-07-17T16:17:55.602377Z","last_seen":"2026-09-11T05:33:42.7911Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.bobaoapp.com.cn/wp-includes/js/dist/script-modules/interactivity/index.min.js?ver=66c613f68580994bb00a","fqdn":"www.bobaoapp.com.cn","domain":"bobaoapp.com.cn","tld":"com.cn"},"ip":{"addr":"94.154.43.130","port":443,"asn":208485,"as":"Moon Dc","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"4dc1083fadc3146eef9e178a635322d7","sha1":"4e30da47cbbd6c3b4bc243ef9196fdb54b8a5648","sha256":"222102c59fbeb8df4f97e143c264d83d794d74a6123486b03b9ecf32a5471918","sha512":"aa096ebe4c95e43225ee1f09450521632db53c9cd732d01e1492747a1f45cb0254cc2a443cd1f024314c86fa0eec441f20ae33c5ef4a55d6cb95bcb7b84d3384","ssdeep":"768:HeW4693pQRsx45G/0vTVhtFiBa7jJEbYlrEdORuHhYlxuQLSZEXdYqAOmp9mI66f:HeQ93u6/0vxh17thuhyQpgFbonUWqeou","tlshash":"bc03c7a4b065f03047e614a6907b051bf3356618344fc0e0f769e8ea78b919f6567f3e","size":41194,"data":"","first_seen":"2026-02-04T02:31:53.531475Z","last_seen":"2026-09-23T00:44:52.732803Z","times_seen":6028,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Inter:ital,opsz,wght@0,14..32,100..900;1,14..32,100..900\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.bobaoapp.com.cn/","date":"2026-08-07T03:43:07.532Z","timestamp":1786074187532,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 20 Jul 2026 18:07:43 GMT","end":"Mon, 12 Oct 2026 18:07:42 GMT"},"fingerprint":{"sha1":"3C:2E:4A:58:D0:DB:8D:00:50:7D:0E:E6:87:DE:CA:95:B3:BA:1B:89","sha256":"C2:4F:05:DF:4B:24:E4:A9:E4:2A:30:66:F4:78:E7:75:AC:AE:71:43:E7:DA:3E:24:4B:A3:AA:9A:39:4E:E2:E1"}}},"request":{"raw":"GET /css2?family=Inter:ital,opsz,wght@0,14..32,100..900;1,14..32,100..900\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.bobaoapp.com.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Fri, 07 Aug 2026 03:43:07 GMT\r\ndate: Fri, 07 Aug 2026 03:43:07 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4887,"size_decoded":1390,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"3fd96ba77783845730c343cf00ac7a93","sha1":"bc4f7f4f71aeae387232155c55c4f031c5f3f769","sha256":"27b95b2fcbc857ba25f7e5a707c5c4c06c5cf93415519b7669c19f4045edca37","sha512":"20b137cf9c61842c7bad62dd6c36125833022552379ad97324dbee2c2e9cb0303b17a9aee813ea2bcdbb68541c8c6edbfecfcfb2858cf27c2cff480d756d80cd","ssdeep":"96:aYg4aMzqYg4aybFZHYg4agkYg4aUJ3vYg4aERYg4aYGJc+uTYg4aR6NDO4a3qO4L:vywfydyGy63gy/yFVyR73xpmj3U8fHN","tlshash":"37a1ed91006f9104ea431dd627cf7e32ad8e51956082e27d6ffd2dca6cdbd23122874c","first_seen":"2025-09-10T21:50:06.177565Z","last_seen":"2026-09-23T05:51:22.289629Z","times_seen":22144,"resource_available":true,"data":null}},"time_used":84,"timings":{"blocked":-1,"dns":0,"connect":16,"send":0,"wait":34,"receive":0,"ssl":34},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sdk.51.la/js-sdk-pro.min.js","fqdn":"sdk.51.la","domain":"51.la","tld":"la"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.bobaoapp.com.cn/","date":"2026-08-07T03:43:07.537Z","timestamp":1786074187537,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /js-sdk-pro.min.js HTTP/1.1\r\nHost: sdk.51.la\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.bobaoapp.com.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-23T06:48:25.611119Z","times_seen":18613706,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.bobaoapp.com.cn/404.html","fqdn":"www.bobaoapp.com.cn","domain":"bobaoapp.com.cn","tld":"com.cn"},"ip":{"addr":"94.154.43.130","port":443,"asn":208485,"as":"Moon Dc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://www.bobaoapp.com.cn/","date":"2026-08-07T03:43:07.585Z","timestamp":1786074187585,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bobaoapp.com.cn","organization":""},"issuer":{"commonName":"ZeroSSL RSA DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Thu, 09 Jul 2026 00:00:00 GMT","end":"Wed, 07 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C8:D1:EB:2E:53:65:7E:F8:4F:2D:6A:4F:F2:0F:38:A5:73:14:EC:BE","sha256":"91:16:3F:36:54:99:05:8B:AA:7A:23:88:DC:E9:F9:6F:33:B9:46:27:FA:BF:02:96:D1:5E:BE:B0:54:F0:45:02"}}},"request":{"raw":"GET /404.html HTTP/1.1\r\nHost: www.bobaoapp.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.bobaoapp.com.cn/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 07 Aug 2026 03:43:07 GMT\r\ncontent-type: text/html\r\ncontent-length: 138\r\nlast-modified: Thu, 09 Jul 2026 15:31:48 GMT\r\netag: \"6a4fbee4-8a\"\r\nstrict-transport-security: max-age=31536000\r\nserver: nginx\r\nx-cache-status: EXPIRED\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":138,"size_decoded":430,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"7389d931c86b3d7bb6b8af46d8c4172b","sha1":"8d2a4760aa0b47984d11cd1a66448719177fb791","sha256":"301bd9f16f94feedfae7a946a14bac38cb73c43efe6117bc5586835af03d7d6f","sha512":"dd6d1511e4fcd5bc09d821ffe091fb5946ac9654c48664aed504e479e9ac20c1cad44b6df90f42190d47e28f5f96bfb09d24056df6b950243d68ee8100a9a889","ssdeep":"","tlshash":"d9c09b5d755366449913155167c33641d196837f689a84510941c593f0cf69ac4c73a9","first_seen":"2023-03-13T12:56:15Z","last_seen":"2026-09-23T06:36:59.723672Z","times_seen":329631,"resource_available":true,"data":null}},"time_used":212,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":212,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-07","alert":"Sinkholed","trigger":"www.bobaoapp.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-07","alert":"Sinkholed","trigger":"www.bobaoapp.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-07","alert":"Sinkholed","trigger":"www.bobaoapp.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.bobaoapp.com.cn/wp-content/uploads/2026/07/cropped-cropped-unnamed-300x300-1-192x192.png","fqdn":"www.bobaoapp.com.cn","domain":"bobaoapp.com.cn","tld":"com.cn"},"ip":{"addr":"94.154.43.130","port":443,"asn":208485,"as":"Moon Dc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.bobaoapp.com.cn/","date":"2026-08-07T03:43:07.768Z","timestamp":1786074187768,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bobaoapp.com.cn","organization":""},"issuer":{"commonName":"ZeroSSL RSA DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Thu, 09 Jul 2026 00:00:00 GMT","end":"Wed, 07 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C8:D1:EB:2E:53:65:7E:F8:4F:2D:6A:4F:F2:0F:38:A5:73:14:EC:BE","sha256":"91:16:3F:36:54:99:05:8B:AA:7A:23:88:DC:E9:F9:6F:33:B9:46:27:FA:BF:02:96:D1:5E:BE:B0:54:F0:45:02"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/cropped-cropped-unnamed-300x300-1-192x192.png HTTP/1.1\r\nHost: www.bobaoapp.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.bobaoapp.com.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 07 Aug 2026 03:43:07 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 09 Jul 2026 15:31:49 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a4fbee5-3393\"\r\nexpires: Tue, 18 Aug 2026 19:30:18 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13203,"size_decoded":13599,"mime_type":"image/png","magic":"PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced","md5":"021bfbb077f7cae1a1aae07be08387c1","sha1":"4bd1138dd30e886ff3ca0715bad981c22bf47111","sha256":"1db6088eccf9a44aa3c859c42e2ac4d4ce7f0269f0de7e5ab546654abd1a2d37","sha512":"2742d5016a9083a1b3298c9ef4783575b438794b6fb74939d6d14304d883329488edd6428e53ac1451282f7855918a75f4e805f54873c85c8af2b161b64ec5b1","ssdeep":"192:ItpRT3nKk96uv47QbmjYVtZfVwz4nELWBLmh5cQgtpjK1/2y+OQnpwhyFEbZAm0D:Cpdd9TUVYBSUELWBH7yQSZlVNlb7I95","tlshash":"5252c037604045cc1734ab2fa5899adcd4eb0a3e3f574d535d82afa9cf64e1f1512047","first_seen":"2026-04-24T07:36:32.405152Z","last_seen":"2026-09-11T05:33:42.787705Z","times_seen":6,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-07","alert":"Sinkholed","trigger":"www.bobaoapp.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-07","alert":"Sinkholed","trigger":"www.bobaoapp.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-07","alert":"Sinkholed","trigger":"www.bobaoapp.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.bobaoapp.com.cn/wp-content/uploads/2026/07/cropped-cropped-unnamed-300x300-1-32x32.png","fqdn":"www.bobaoapp.com.cn","domain":"bobaoapp.com.cn","tld":"com.cn"},"ip":{"addr":"94.154.43.130","port":443,"asn":208485,"as":"Moon Dc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.bobaoapp.com.cn/","date":"2026-08-07T03:43:07.770Z","timestamp":1786074187770,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bobaoapp.com.cn","organization":""},"issuer":{"commonName":"ZeroSSL RSA DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Thu, 09 Jul 2026 00:00:00 GMT","end":"Wed, 07 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C8:D1:EB:2E:53:65:7E:F8:4F:2D:6A:4F:F2:0F:38:A5:73:14:EC:BE","sha256":"91:16:3F:36:54:99:05:8B:AA:7A:23:88:DC:E9:F9:6F:33:B9:46:27:FA:BF:02:96:D1:5E:BE:B0:54:F0:45:02"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/cropped-cropped-unnamed-300x300-1-32x32.png HTTP/1.1\r\nHost: www.bobaoapp.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.bobaoapp.com.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 07 Aug 2026 03:43:07 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 09 Jul 2026 15:31:49 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a4fbee5-525\"\r\nexpires: Tue, 18 Aug 2026 19:30:18 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1317,"size_decoded":1712,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"60b4976f9c1a07517bf662fea998af02","sha1":"d6ffa6019d57e589b5fc09cb8535fb5cacd578d0","sha256":"634fae8ec4371e20bf47b64e52cc12173529074cae8f856861f91135cb94cc8c","sha512":"61f0385b3f221a77142cd222ae57edc4c4534d70171b3d9e03691add420e425f0ed0c28a55c9130544197e0d338b6e1dbddc0c03addf9013b31b75858c148280","ssdeep":"","tlshash":"3821f8190724a8bd4ef0927361cabf03c8019fd817a13e246f8558ea967a3f648e8860","first_seen":"2026-04-24T07:36:32.396177Z","last_seen":"2026-09-11T05:33:42.794934Z","times_seen":6,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-07","alert":"Sinkholed","trigger":"www.bobaoapp.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-07","alert":"Sinkholed","trigger":"www.bobaoapp.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-07","alert":"Sinkholed","trigger":"www.bobaoapp.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.bobaoapp.com.cn/","fqdn":"www.bobaoapp.com.cn","domain":"bobaoapp.com.cn","tld":"com.cn"},"ip":{"addr":"94.154.43.130","port":443,"asn":208485,"as":"Moon Dc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-07T03:43:05.663Z","timestamp":1786074185663,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bobaoapp.com.cn","organization":""},"issuer":{"commonName":"ZeroSSL RSA DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Thu, 09 Jul 2026 00:00:00 GMT","end":"Wed, 07 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C8:D1:EB:2E:53:65:7E:F8:4F:2D:6A:4F:F2:0F:38:A5:73:14:EC:BE","sha256":"91:16:3F:36:54:99:05:8B:AA:7A:23:88:DC:E9:F9:6F:33:B9:46:27:FA:BF:02:96:D1:5E:BE:B0:54:F0:45:02"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: www.bobaoapp.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 07 Aug 2026 03:43:07 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nlink: \u003chttps://www.bobaoapp.com.cn/wp-json/\u003e; rel=\"https://api.w.org/\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"WordPress:6.9.4","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.","website":"https://wordpress.org","common_platform_enumeration":"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","icon":"WordPress.svg","categories":["CMS","Blogs"]},{"name":"MySQL","description":"MySQL is an open-source relational database management system.","website":"https://mysql.com","common_platform_enumeration":"cpe:2.3:a:mysql:mysql:*:*:*:*:*:*:*:*","icon":"MySQL.svg","categories":["Databases"]},{"name":"Yoast SEO:28.0","description":"Yoast SEO is a search engine optimisation plugin for WordPress and other platforms.","website":"https://yoast.com/wordpress/plugins/seo/","common_platform_enumeration":"","icon":"Yoast SEO.png","categories":["SEO","WordPress plugins"]},{"name":"WordPress Site Editor","description":"Full Site Editing enables users to design and customize their entire WordPress website with a block-based editor.","website":"https://wordpress.org/documentation/article/site-editor/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]},{"name":"WordPress Block Editor","description":"Sites using the WordPress Block Editor, also known as Gutenberg.","website":"https://wordpress.org/gutenberg/","common_platform_enumeration":"","icon":"WordPress.svg","categories":["Page builders"]}],"data":{"size":152528,"size_decoded":27199,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (20397)","md5":"3358c048ef6e457fba265b889bfdc3c7","sha1":"fd44115659bf20947fea9bf57a1f13fd3b60ecb2","sha256":"cd01dbe634236c849e43223c8b6ddcbec7ece719cecb208209e865ec929100bb","sha512":"ed1c6a650091121ba92d7f76b1e03f8938d8bbdc4fcc0105bf1f59fc7a145003fc94e5f803ba2e2a5fece0d680a44dc529ab67eef542fe3e1b24f5ad3a6da725","ssdeep":"3072:KbBuclkbAeVdJZPpX4wvSAIe8Vvjc2B/vVz6:6uclkbrVdJZPpX4wvSAIe8Vbb4","tlshash":"65e3e66053b048f5357bc3aa9a44a319b556e903ce0666d1b1fed2906bccde70ea370b","first_seen":"2026-08-07T03:41:57.20368Z","last_seen":"2026-08-07T03:48:17.560634Z","times_seen":3,"resource_available":false,"data":null}},"time_used":1522,"timings":{"blocked":-1,"dns":264,"connect":20,"send":0,"wait":1194,"receive":0,"ssl":44},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-07","alert":"Sinkholed","trigger":"www.bobaoapp.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-07","alert":"Sinkholed","trigger":"www.bobaoapp.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-07","alert":"Sinkholed","trigger":"www.bobaoapp.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.bobaoapp.com.cn/tiao.js","fqdn":"www.bobaoapp.com.cn","domain":"bobaoapp.com.cn","tld":"com.cn"},"ip":{"addr":"94.154.43.130","port":443,"asn":208485,"as":"Moon Dc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.bobaoapp.com.cn/","date":"2026-08-07T03:43:07.356Z","timestamp":1786074187356,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bobaoapp.com.cn","organization":""},"issuer":{"commonName":"ZeroSSL RSA DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Thu, 09 Jul 2026 00:00:00 GMT","end":"Wed, 07 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C8:D1:EB:2E:53:65:7E:F8:4F:2D:6A:4F:F2:0F:38:A5:73:14:EC:BE","sha256":"91:16:3F:36:54:99:05:8B:AA:7A:23:88:DC:E9:F9:6F:33:B9:46:27:FA:BF:02:96:D1:5E:BE:B0:54:F0:45:02"}}},"request":{"raw":"GET /tiao.js HTTP/1.1\r\nHost: www.bobaoapp.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.bobaoapp.com.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 07 Aug 2026 03:43:07 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 755\r\nlast-modified: Tue, 14 Jul 2026 06:40:17 GMT\r\netag: \"6a55d9d1-2f3\"\r\nexpires: Thu, 06 Aug 2026 15:46:26 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nserver: nginx\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":755,"size_decoded":1127,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text","md5":"dd508ee2e74e1535ea1cccd230ca17dc","sha1":"d7acc424bdcc23518771d9132eb3329233730482","sha256":"733b761f21ac74ad0ffe084fffa266b2d332d3153aff3ec6c24a616513db838b","sha512":"ab34fe01b04d09f2ff03cbd887e4e8ad7029bc2c2cf9c0499b991c67fdbaa0d73d44debfa51a1d616b7cd298f82c20c9b1cf1c4c5f5e536065818712a2476d96","ssdeep":"","tlshash":"bd014c5fb1af200598230898e676100875b1e876b8ef9b2530eec6c65b5d4a609735cf","first_seen":"2025-07-17T16:17:55.602377Z","last_seen":"2026-09-11T05:33:42.7911Z","times_seen":7,"resource_available":true,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-07","alert":"Sinkholed","trigger":"www.bobaoapp.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-07","alert":"Sinkholed","trigger":"www.bobaoapp.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-07","alert":"Sinkholed","trigger":"www.bobaoapp.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.bobaoapp.com.cn/wp-content/uploads/2026/07/cropped-unnamed-300x300-1-150x150.png","fqdn":"www.bobaoapp.com.cn","domain":"bobaoapp.com.cn","tld":"com.cn"},"ip":{"addr":"94.154.43.130","port":443,"asn":208485,"as":"Moon Dc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://www.bobaoapp.com.cn/","date":"2026-08-07T03:43:07.539Z","timestamp":1786074187539,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bobaoapp.com.cn","organization":""},"issuer":{"commonName":"ZeroSSL RSA DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Thu, 09 Jul 2026 00:00:00 GMT","end":"Wed, 07 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C8:D1:EB:2E:53:65:7E:F8:4F:2D:6A:4F:F2:0F:38:A5:73:14:EC:BE","sha256":"91:16:3F:36:54:99:05:8B:AA:7A:23:88:DC:E9:F9:6F:33:B9:46:27:FA:BF:02:96:D1:5E:BE:B0:54:F0:45:02"}}},"request":{"raw":"GET /wp-content/uploads/2026/07/cropped-unnamed-300x300-1-150x150.png HTTP/1.1\r\nHost: www.bobaoapp.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.bobaoapp.com.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 07 Aug 2026 03:43:07 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 09 Jul 2026 15:31:49 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a4fbee5-2110\"\r\nexpires: Tue, 18 Aug 2026 19:30:17 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8464,"size_decoded":8860,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced","md5":"872f2da8837d5c0993fd12251e18c308","sha1":"f70e5c083052b73af102a763d4b1fafd450108c5","sha256":"992d10dcfedea26979ff6cdb297d06213b9302d00bc710e46a9dbfacfa15553a","sha512":"d8e721d95d619155101e71c74754ccc42905239d4c420581df10380be874d2fcf9516306397f2f7db1fbfedc9bc125c0d35686e4d6736aed7019be4c7b6a6776","ssdeep":"192:tTfALrg6VR0cEnkYG+wIIwfWpHiuHXlLVfvG+OO7:tTYLvc+YG9QWku3lLVb7","tlshash":"3d02afe9e5f9d717fa9f8031a07c3c608c25b851061e15e02b37e8d854719eed36de29","first_seen":"2026-08-07T03:41:57.210132Z","last_seen":"2026-09-11T05:33:42.79254Z","times_seen":5,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-07","alert":"Sinkholed","trigger":"www.bobaoapp.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-07","alert":"Sinkholed","trigger":"www.bobaoapp.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-07","alert":"Sinkholed","trigger":"www.bobaoapp.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.bobaoapp.com.cn/wp-includes/js/dist/script-modules/interactivity/index.min.js?ver=66c613f68580994bb00a","fqdn":"www.bobaoapp.com.cn","domain":"bobaoapp.com.cn","tld":"com.cn"},"ip":{"addr":"94.154.43.130","port":443,"asn":208485,"as":"Moon Dc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.bobaoapp.com.cn/","date":"2026-08-07T03:43:07.540Z","timestamp":1786074187540,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bobaoapp.com.cn","organization":""},"issuer":{"commonName":"ZeroSSL RSA DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Thu, 09 Jul 2026 00:00:00 GMT","end":"Wed, 07 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C8:D1:EB:2E:53:65:7E:F8:4F:2D:6A:4F:F2:0F:38:A5:73:14:EC:BE","sha256":"91:16:3F:36:54:99:05:8B:AA:7A:23:88:DC:E9:F9:6F:33:B9:46:27:FA:BF:02:96:D1:5E:BE:B0:54:F0:45:02"}}},"request":{"raw":"GET /wp-includes/js/dist/script-modules/interactivity/index.min.js?ver=66c613f68580994bb00a HTTP/1.1\r\nHost: www.bobaoapp.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.bobaoapp.com.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 07 Aug 2026 03:43:07 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 09 Jul 2026 15:31:49 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a4fbee5-a0ea\"\r\nexpires: Thu, 06 Aug 2026 15:46:27 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":41194,"size_decoded":15446,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (41194), with no line terminators","md5":"4dc1083fadc3146eef9e178a635322d7","sha1":"4e30da47cbbd6c3b4bc243ef9196fdb54b8a5648","sha256":"222102c59fbeb8df4f97e143c264d83d794d74a6123486b03b9ecf32a5471918","sha512":"aa096ebe4c95e43225ee1f09450521632db53c9cd732d01e1492747a1f45cb0254cc2a443cd1f024314c86fa0eec441f20ae33c5ef4a55d6cb95bcb7b84d3384","ssdeep":"768:HeW4693pQRsx45G/0vTVhtFiBa7jJEbYlrEdORuHhYlxuQLSZEXdYqAOmp9mI66f:HeQ93u6/0vxh17thuhyQpgFbonUWqeou","tlshash":"bc03c7a4b065f03047e614a6907b051bf3356618344fc0e0f769e8ea78b919f6567f3e","first_seen":"2026-02-04T02:31:53.531475Z","last_seen":"2026-09-23T00:44:52.732803Z","times_seen":6028,"resource_available":true,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-07","alert":"Sinkholed","trigger":"www.bobaoapp.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-07","alert":"Sinkholed","trigger":"www.bobaoapp.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-07","alert":"Sinkholed","trigger":"www.bobaoapp.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.bobaoapp.com.cn/wp-content/themes/twentytwentyfour/assets/fonts/inter/Inter-VariableFont_slnt,wght.woff2","fqdn":"www.bobaoapp.com.cn","domain":"bobaoapp.com.cn","tld":"com.cn"},"ip":{"addr":"94.154.43.130","port":443,"asn":208485,"as":"Moon Dc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.bobaoapp.com.cn/","date":"2026-08-07T03:43:07.587Z","timestamp":1786074187587,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bobaoapp.com.cn","organization":""},"issuer":{"commonName":"ZeroSSL RSA DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Thu, 09 Jul 2026 00:00:00 GMT","end":"Wed, 07 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"C8:D1:EB:2E:53:65:7E:F8:4F:2D:6A:4F:F2:0F:38:A5:73:14:EC:BE","sha256":"91:16:3F:36:54:99:05:8B:AA:7A:23:88:DC:E9:F9:6F:33:B9:46:27:FA:BF:02:96:D1:5E:BE:B0:54:F0:45:02"}}},"request":{"raw":"GET /wp-content/themes/twentytwentyfour/assets/fonts/inter/Inter-VariableFont_slnt,wght.woff2 HTTP/1.1\r\nHost: www.bobaoapp.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.bobaoapp.com.cn/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 07 Aug 2026 03:43:07 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 326628\r\nlast-modified: Thu, 09 Jul 2026 15:31:49 GMT\r\netag: \"6a4fbee5-4fbe4\"\r\nstrict-transport-security: max-age=31536000\r\nserver: nginx\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":326628,"size_decoded":326923,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 326628, version 1.0","md5":"9c9cff93a0d5a209225c1bae18d80a9d","sha1":"40546dbfd5c467c3257d8f3a4ad8af0d9995aeb6","sha256":"e931823ffd0b6cfd1624e3a7c1c49861ed3420297862e727f07e04c8be1cc89b","sha512":"6d60eba8b9ae8b8b85ac93d4da1f3ecac3d8472e9821f9a580ede27ed778b5aa590a5083ccb960602cc2b9d345fa17ed67355cac4a1d07427b1b4330a63abff1","ssdeep":"6144:xfpkCcEWnNlAharQ/P8TVcEbGEDyfVxBe3n/uhWxWFrzW/K/M/4GP:xf2CcnNlAwrqP8TVcEbgV63nqWV/6M4U","tlshash":"7b6423d7562e01f6ee6e19a700855e73f8ee2a326f7cf65c7c43a8f938a1c1464421e1","first_seen":"2023-05-10T07:09:06Z","last_seen":"2026-09-22T23:55:41.980511Z","times_seen":16272,"resource_available":false,"data":null}},"time_used":82,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":59,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-07","alert":"Sinkholed","trigger":"www.bobaoapp.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-07","alert":"Sinkholed","trigger":"www.bobaoapp.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-07","alert":"Sinkholed","trigger":"www.bobaoapp.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}