{"report_id":"637492a9-108e-48b1-8cbf-cfbadbe9ce6f","version":6,"status":"done","tags":[],"date":"2025-11-08T19:16:01Z","url":{"schema":"http","addr":"kmqu.cn","fqdn":"kmqu.cn","domain":"kmqu.cn","tld":"cn"},"ip":{"addr":"154.201.76.110","port":0,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"kmqu.cn/","fqdn":"kmqu.cn","domain":"kmqu.cn","tld":"cn"},"title":"欧易官网——欧意APP下载注册_欧易交易所官方注册入口","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-11T11:57:30.813986Z","times_seen":17835961,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"kmqu.cn","fqdn":"kmqu.cn","domain":"kmqu.cn","tld":"cn"},"ip":{"addr":"154.201.76.110","port":0,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98","country_code":"zz"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-12-13T19:16:01Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-08","alert":"Phishing Block","trigger":"kmqu.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-08","alert":"Sinkholed","trigger":"kmqu.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null},"summary":[{"fqdn":"kmqu.cn","ip":{"addr":"154.201.76.110","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"domain_registered":"2025-02-07","domain_rank":0,"first_seen":"2025-11-08T19:16:01.976479Z","last_seen":"2025-11-08T19:16:01.976479Z","alert_count":24,"request_count":12,"received_data":651950,"sent_data":5231,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"kmqu.cn/1.js","fqdn":"kmqu.cn","domain":"kmqu.cn","tld":"cn"},"ip":{"addr":"154.201.76.110","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"dab0cf212984d2a132983960a2dbc673","sha1":"bcc06c3f10d8556d0557e0946180ceedc7b7b045","sha256":"da8230d6def3dc0544b14d125f59d5071348d17ca0bcd355f5e6fd5f0b1d4637","sha512":"39b7fbf5088457c4d733698af6db388068270d439a2b2c148f3ecff49027db0081ee8a276df53ffaa4f6d40d084298e2c124d170efcd7750a78617bd0b0b0e46","ssdeep":"","tlshash":"86f0c2abf5416c1c136f15eed92ffb0e3a57ab09bcdac805102cd5b0b424e83810ad8a","size":556,"data":"","first_seen":"2025-11-06T07:14:55.198873Z","last_seen":"2025-11-21T19:33:22.310771Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"kmqu.cn/images/02.webp","fqdn":"kmqu.cn","domain":"kmqu.cn","tld":"cn"},"ip":{"addr":"154.201.76.110","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kmqu.cn/","date":"2025-11-08T19:15:41.286Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.srasom.cn","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 05 Nov 2025 07:28:22 GMT","end":"Tue, 03 Feb 2026 07:28:21 GMT"},"fingerprint":{"sha1":"05:31:AB:E6:28:AA:34:61:4A:48:7E:65:0C:F4:B3:5C:C4:83:32:1C","sha256":"21:4F:96:D1:A6:49:BA:DE:DA:ED:44:75:9C:14:CB:91:91:40:7F:DF:20:22:BC:AF:67:C3:F6:DF:A1:21:46:73"}}},"request":{"raw":"GET /images/02.webp HTTP/1.1\r\nHost: kmqu.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kmqu.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 08 Nov 2025 19:15:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 5424\r\nlast-modified: Tue, 24 Dec 2024 05:42:22 GMT\r\netag: \"676a49be-1530\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5424,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"8a45a8de0bcfdc0398e66dc65e958b56","sha1":"5eb2f31e215e199abc60d2379667cbe016a4112d","sha256":"afaa42cb9bab84a8ef8758cee96db2276fdbe367206197450bf7fd64bd405ffc","sha512":"ddbb19f0103a0385bc9a2cc480a18690fa5adbbb55a71709043d2d0b86ca269c622e4b89df055ad3459def3f5b06e91e1088d7e5827618f660b366dd05ff9815","ssdeep":"96:WPGa6Ay606I/A8Fk8VMKMYNzNRkI/+mHJ/aO3yahdgo/vHy2wEypbxKQSEboro8:W+axX0B/Aok5K/Nzrko+mHJ/aO35dgoz","tlshash":"68b17c0be6d79a812b3ee5e06212772f9bc8930595bf870d388ec6aa4b10348c033c46","first_seen":"2025-07-26T07:28:31.511383Z","last_seen":"2026-08-06T01:15:41.60381Z","times_seen":821,"resource_available":false,"data":null}},"time_used":693,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":500,"receive":193,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-08","alert":"Phishing Block","trigger":"kmqu.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-08","alert":"Sinkholed","trigger":"kmqu.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kmqu.cn/images/03.webp","fqdn":"kmqu.cn","domain":"kmqu.cn","tld":"cn"},"ip":{"addr":"154.201.76.110","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kmqu.cn/","date":"2025-11-08T19:15:41.288Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.srasom.cn","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 05 Nov 2025 07:28:22 GMT","end":"Tue, 03 Feb 2026 07:28:21 GMT"},"fingerprint":{"sha1":"05:31:AB:E6:28:AA:34:61:4A:48:7E:65:0C:F4:B3:5C:C4:83:32:1C","sha256":"21:4F:96:D1:A6:49:BA:DE:DA:ED:44:75:9C:14:CB:91:91:40:7F:DF:20:22:BC:AF:67:C3:F6:DF:A1:21:46:73"}}},"request":{"raw":"GET /images/03.webp HTTP/1.1\r\nHost: kmqu.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kmqu.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 08 Nov 2025 19:15:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 4402\r\nlast-modified: Tue, 24 Dec 2024 05:42:22 GMT\r\netag: \"676a49be-1132\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4402,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"6b80e5166cb4d0d7dd1be31e36fa5f5b","sha1":"0f929c99807c54298cec53f595d38d44c08bb9ff","sha256":"530be2c66d935bae2ca2de96b67d85a697b580abd5956f12b267921b88ce9c95","sha512":"0350430a05e0b74ef482aaebf7830146252a299d40d5c35821581257612e16ffc1263eaa9802ae0da22df52f1472345f85c2a6871ac5faef4f62d728e55358ac","ssdeep":"96:N+HFDTntqAOA3w87IdRWj69TVVff+ocnOBGe2MOu4XZzOju2:N+lDTntgAA8UdRKaTbfq+G/MOiJ","tlshash":"cc917c34782b5536f95acef02bae8b08070ec91457f8a63cd2a454bdc99470b99364ee","first_seen":"2025-07-26T07:28:31.500825Z","last_seen":"2026-08-06T01:15:41.604909Z","times_seen":815,"resource_available":false,"data":null}},"time_used":654,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":461,"receive":193,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-08","alert":"Phishing Block","trigger":"kmqu.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-08","alert":"Sinkholed","trigger":"kmqu.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kmqu.cn/images/09C939789ACC435F.webm","fqdn":"kmqu.cn","domain":"kmqu.cn","tld":"cn"},"ip":{"addr":"154.201.76.110","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://kmqu.cn/","date":"2025-11-08T19:15:41.520Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.srasom.cn","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 05 Nov 2025 07:28:22 GMT","end":"Tue, 03 Feb 2026 07:28:21 GMT"},"fingerprint":{"sha1":"05:31:AB:E6:28:AA:34:61:4A:48:7E:65:0C:F4:B3:5C:C4:83:32:1C","sha256":"21:4F:96:D1:A6:49:BA:DE:DA:ED:44:75:9C:14:CB:91:91:40:7F:DF:20:22:BC:AF:67:C3:F6:DF:A1:21:46:73"}}},"request":{"raw":"GET /images/09C939789ACC435F.webm HTTP/1.1\r\nHost: kmqu.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kmqu.cn/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 Partial Content\r\nserver: nginx\r\ndate: Sat, 08 Nov 2025 19:15:41 GMT\r\ncontent-type: video/webm\r\ncontent-length: 475896\r\nlast-modified: Tue, 19 Mar 2024 09:52:07 GMT\r\netag: \"65f96047-742f8\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-range: bytes 0-475895/475896\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":475896,"size_decoded":0,"mime_type":"video/webm","magic":"WebM","md5":"ee9a1be909c939789acc435fd8f12abd","sha1":"c3612a70cdfd759aafd85ab4c8c200adccfa3472","sha256":"a4b0e743f968997fbee0dd24bcf3e5c224209230a60f2ce87bcd2973129e08f1","sha512":"d572ca51bd004cac12d73b2dddc3b089235d44ffc67f80ea67fb2e54c1e4ffe1034fab82b0b040e2209dbef90c4cb9d2b8549dd1b68418585090e63d9c32dda1","ssdeep":"12288:tYrq3/LtGrS0sMEej+QBtqMH4DgWXK9jz8s:tY2hGrSWEej5MMH4NK9j3","tlshash":"60a423466511ed80d32b9eb9cb1b66fa7b7e0670e0f6e326c7158072fca0e141a5f11b","first_seen":"2025-07-26T07:28:31.506833Z","last_seen":"2026-08-06T01:15:41.605967Z","times_seen":1009,"resource_available":false,"data":null}},"time_used":894,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":220,"receive":674,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-08","alert":"Phishing Block","trigger":"kmqu.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-08","alert":"Sinkholed","trigger":"kmqu.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kmqu.cn/okx.ico","fqdn":"kmqu.cn","domain":"kmqu.cn","tld":"cn"},"ip":{"addr":"154.201.76.110","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kmqu.cn/","date":"2025-11-08T19:15:42.059Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.srasom.cn","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 05 Nov 2025 07:28:22 GMT","end":"Tue, 03 Feb 2026 07:28:21 GMT"},"fingerprint":{"sha1":"05:31:AB:E6:28:AA:34:61:4A:48:7E:65:0C:F4:B3:5C:C4:83:32:1C","sha256":"21:4F:96:D1:A6:49:BA:DE:DA:ED:44:75:9C:14:CB:91:91:40:7F:DF:20:22:BC:AF:67:C3:F6:DF:A1:21:46:73"}}},"request":{"raw":"GET /okx.ico HTTP/1.1\r\nHost: kmqu.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kmqu.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 08 Nov 2025 19:15:42 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 4286\r\nlast-modified: Fri, 31 Oct 2025 13:05:53 GMT\r\netag: \"6904b431-10be\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4286,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel","md5":"35ca1d0eef6f431da7ffbca5f906e3f5","sha1":"6f2b8c51c29c80ce712eadc3165735dc7aec291a","sha256":"76b7b15543d2b882d09ef7e4f2423cc84bcf8af35cbd9e50f34bd1c73c5ce1b0","sha512":"ba0732dec5f8279240e597b3f1ade6e57ef2d829b0b6b03ddb5e19a8e592f0e729667b759cacbe297f08df38279c4801be77f0cbfb4634276327be4dada59371","ssdeep":"6:sfylprV4lSlGia6a6a6a6a6a6a6a6a6a6a6a/aaaaaaaaPKa6a6a6a6a6a6a6a6T:suZV4o4eFX4otZlLn","tlshash":"1591c5013241c068c01802310c27c6fe29a5bd9aefb4a22376ea3fdf3c721b82521b60","first_seen":"2025-04-13T03:01:47.203846Z","last_seen":"2026-06-21T09:05:04.635586Z","times_seen":198,"resource_available":false,"data":null}},"time_used":359,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":359,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-08","alert":"Sinkholed","trigger":"kmqu.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-08","alert":"Phishing Block","trigger":"kmqu.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kmqu.cn/images/logo.png","fqdn":"kmqu.cn","domain":"kmqu.cn","tld":"cn"},"ip":{"addr":"154.201.76.110","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kmqu.cn/","date":"2025-11-08T19:15:41.281Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.srasom.cn","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 05 Nov 2025 07:28:22 GMT","end":"Tue, 03 Feb 2026 07:28:21 GMT"},"fingerprint":{"sha1":"05:31:AB:E6:28:AA:34:61:4A:48:7E:65:0C:F4:B3:5C:C4:83:32:1C","sha256":"21:4F:96:D1:A6:49:BA:DE:DA:ED:44:75:9C:14:CB:91:91:40:7F:DF:20:22:BC:AF:67:C3:F6:DF:A1:21:46:73"}}},"request":{"raw":"GET /images/logo.png HTTP/1.1\r\nHost: kmqu.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kmqu.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 08 Nov 2025 19:15:41 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 24 Dec 2024 05:42:22 GMT\r\nvary: Accept-Encoding\r\netag: W/\"676a49be-104b\"\r\nexpires: Mon, 08 Dec 2025 19:15:41 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4171,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 196 x 60, 8-bit/color RGBA, non-interlaced","md5":"e78dd4349f9c2abe958b3f4ee63884f0","sha1":"eaf705c319d5fb048e8ea060d95c98efaf297afb","sha256":"579f69493179560d98548550246f20adbbfe30d47b97b78298ea0fdc085a1a8b","sha512":"8ff47a703bf429cb72fb6f95fd3199df616062ed8b13f6649c603dfe52038db7fe48dab402499c8c12910a68b0f26e6212d757851fdddfc4114c1c817fd4952d","ssdeep":"48:XwqQNn2xWJ3j3YJVJStWYQw7HAIiQuTUBfpm7Cw14NMytPoameu4KzlHuDJLuqhy:RY2+OVBwgsfpAVyiamr4uhuldhLruB","tlshash":"45815b6abe569f504a495a3025d94012e11249c8a9c0b42bdcbed47a4ea0efd2e8f5cb","first_seen":"2025-07-26T07:28:31.51627Z","last_seen":"2026-08-08T15:38:38.772395Z","times_seen":796,"resource_available":false,"data":null}},"time_used":160,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":160,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-08","alert":"Sinkholed","trigger":"kmqu.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-08","alert":"Phishing Block","trigger":"kmqu.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kmqu.cn/1.js","fqdn":"kmqu.cn","domain":"kmqu.cn","tld":"cn"},"ip":{"addr":"154.201.76.110","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://kmqu.cn/","date":"2025-11-08T19:15:41.282Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.srasom.cn","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 05 Nov 2025 07:28:22 GMT","end":"Tue, 03 Feb 2026 07:28:21 GMT"},"fingerprint":{"sha1":"05:31:AB:E6:28:AA:34:61:4A:48:7E:65:0C:F4:B3:5C:C4:83:32:1C","sha256":"21:4F:96:D1:A6:49:BA:DE:DA:ED:44:75:9C:14:CB:91:91:40:7F:DF:20:22:BC:AF:67:C3:F6:DF:A1:21:46:73"}}},"request":{"raw":"GET /1.js HTTP/1.1\r\nHost: kmqu.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kmqu.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 08 Nov 2025 19:15:41 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 556\r\nlast-modified: Mon, 03 Nov 2025 12:15:38 GMT\r\netag: \"69089cea-22c\"\r\nexpires: Sun, 09 Nov 2025 07:15:41 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":556,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"dab0cf212984d2a132983960a2dbc673","sha1":"bcc06c3f10d8556d0557e0946180ceedc7b7b045","sha256":"da8230d6def3dc0544b14d125f59d5071348d17ca0bcd355f5e6fd5f0b1d4637","sha512":"39b7fbf5088457c4d733698af6db388068270d439a2b2c148f3ecff49027db0081ee8a276df53ffaa4f6d40d084298e2c124d170efcd7750a78617bd0b0b0e46","ssdeep":"","tlshash":"86f0c2abf5416c1c136f15eed92ffb0e3a57ab09bcdac805102cd5b0b424e83810ad8a","first_seen":"2025-11-06T07:14:55.198873Z","last_seen":"2025-11-21T19:33:22.310771Z","times_seen":9,"resource_available":true,"data":null}},"time_used":161,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":161,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-08","alert":"Phishing Block","trigger":"kmqu.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-08","alert":"Sinkholed","trigger":"kmqu.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kmqu.cn/images/9204652673aa0339.png","fqdn":"kmqu.cn","domain":"kmqu.cn","tld":"cn"},"ip":{"addr":"154.201.76.110","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kmqu.cn/","date":"2025-11-08T19:15:41.284Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.srasom.cn","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 05 Nov 2025 07:28:22 GMT","end":"Tue, 03 Feb 2026 07:28:21 GMT"},"fingerprint":{"sha1":"05:31:AB:E6:28:AA:34:61:4A:48:7E:65:0C:F4:B3:5C:C4:83:32:1C","sha256":"21:4F:96:D1:A6:49:BA:DE:DA:ED:44:75:9C:14:CB:91:91:40:7F:DF:20:22:BC:AF:67:C3:F6:DF:A1:21:46:73"}}},"request":{"raw":"GET /images/9204652673aa0339.png HTTP/1.1\r\nHost: kmqu.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kmqu.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 08 Nov 2025 19:15:41 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 24 Dec 2024 05:42:22 GMT\r\nvary: Accept-Encoding\r\netag: W/\"676a49be-16baf\"\r\nexpires: Mon, 08 Dec 2025 19:15:41 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":93103,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1474 x 970, 8-bit colormap, non-interlaced","md5":"807b474260fb09263ac7e006ec232314","sha1":"09c7b81ce477c62a486b7cc5669fd6e6531af21e","sha256":"6b71b53b239ff80dbc2c623c6ca8b5fb26561e044d620486cf2c0d34582f2969","sha512":"45cb89d4f83e3ffa695d65236807fa5920a80faa139c1200275e6b058e1cc224f70a89500b4d84b4b40a9d06f50e762cb22a8bc4b4506aab29e93e435e94a67b","ssdeep":"1536:lPD8v40aEp7NvbXlVGO/4Puf20f2ZJreg+qql2mh7bCkX2i3lOcSLOn88EzEwvds:lPD8A0RpXlV+uf20fxXbCI2i1ObLOLue","tlshash":"b19302f5825423f1b8b1e7bcb2bdc64e95751f93749c29260badfcd0be4084943a21b2","first_seen":"2025-09-03T16:56:19.482263Z","last_seen":"2026-08-01T16:23:50.320855Z","times_seen":107,"resource_available":false,"data":null}},"time_used":461,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":461,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-08","alert":"Sinkholed","trigger":"kmqu.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-08","alert":"Phishing Block","trigger":"kmqu.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kmqu.cn/images/04.webp","fqdn":"kmqu.cn","domain":"kmqu.cn","tld":"cn"},"ip":{"addr":"154.201.76.110","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kmqu.cn/","date":"2025-11-08T19:15:41.289Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.srasom.cn","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 05 Nov 2025 07:28:22 GMT","end":"Tue, 03 Feb 2026 07:28:21 GMT"},"fingerprint":{"sha1":"05:31:AB:E6:28:AA:34:61:4A:48:7E:65:0C:F4:B3:5C:C4:83:32:1C","sha256":"21:4F:96:D1:A6:49:BA:DE:DA:ED:44:75:9C:14:CB:91:91:40:7F:DF:20:22:BC:AF:67:C3:F6:DF:A1:21:46:73"}}},"request":{"raw":"GET /images/04.webp HTTP/1.1\r\nHost: kmqu.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kmqu.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 08 Nov 2025 19:15:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 3776\r\nlast-modified: Tue, 24 Dec 2024 05:42:22 GMT\r\netag: \"676a49be-ec0\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3776,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"66a7323c8247556e17d38383bd8763a0","sha1":"7f0c5428a5030cf697feabf3592bb9540f628602","sha256":"02c376ae58158bbee63a2c513ab22d955a6f5d891a293357f3eeb771e2ab9808","sha512":"0dcbdf1f60cf82e6f862e3b2eaed338d619750074b680d457ea49251e8396dafc1490b7baf6659a6f9d5d708044ceeb38c3305a5b1b75a4575c1f772c65e079b","ssdeep":"","tlshash":"e9716cd97b960075eb32b9a3b0d816004df9998b498a3dd2d4f9c0706224e503687a0d","first_seen":"2025-07-26T07:28:31.510404Z","last_seen":"2026-08-06T01:15:41.592006Z","times_seen":813,"resource_available":false,"data":null}},"time_used":653,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":460,"receive":193,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-08","alert":"Sinkholed","trigger":"kmqu.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-08","alert":"Phishing Block","trigger":"kmqu.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kmqu.cn/","fqdn":"kmqu.cn","domain":"kmqu.cn","tld":"cn"},"ip":{"addr":"154.201.76.110","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-11-08T19:15:40.198Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.srasom.cn","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 05 Nov 2025 07:28:22 GMT","end":"Tue, 03 Feb 2026 07:28:21 GMT"},"fingerprint":{"sha1":"05:31:AB:E6:28:AA:34:61:4A:48:7E:65:0C:F4:B3:5C:C4:83:32:1C","sha256":"21:4F:96:D1:A6:49:BA:DE:DA:ED:44:75:9C:14:CB:91:91:40:7F:DF:20:22:BC:AF:67:C3:F6:DF:A1:21:46:73"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: kmqu.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 08 Nov 2025 19:15:40 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 05 Nov 2025 08:26:25 GMT\r\nvary: Accept-Encoding\r\netag: W/\"690b0a31-1ca9\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7337,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (3173)","md5":"21ab6f9fcc5e107ec854dba0468d2829","sha1":"72aedc4b03ef4ac3c6aaf1b6175b894da711d1fb","sha256":"0181c36fb44d59f5c084efb069da2ff548575fd19a72b8307913556a89672ba6","sha512":"51568bb3d9639444b86239698c71d70a3f92fa9a3365f257883ea47f2c9135440bf4751a539820095c6a0035a0ef15f3adb79b10535802a50f064eed73633366","ssdeep":"96:NT9Flf7Mf8kFLymDdIurzIKRLnS1X7IQ8V+b/7Qb3LNum:5m8YLFfz3RLnS1X7h0lLsm","tlshash":"a8e155a072c13c6e813b899df96aff5bb0e3e61fc59558287b6d248515e8e32480dfd0","first_seen":"2025-11-07T09:22:54.568668Z","last_seen":"2025-11-13T02:58:35.486959Z","times_seen":3,"resource_available":false,"data":null}},"time_used":1489,"timings":{"blocked":667,"dns":350,"connect":155,"send":0,"wait":155,"receive":0,"ssl":160},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-08","alert":"Phishing Block","trigger":"kmqu.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-08","alert":"Sinkholed","trigger":"kmqu.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kmqu.cn/css/procss.css","fqdn":"kmqu.cn","domain":"kmqu.cn","tld":"cn"},"ip":{"addr":"154.201.76.110","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://kmqu.cn/","date":"2025-11-08T19:15:41.279Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.srasom.cn","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 05 Nov 2025 07:28:22 GMT","end":"Tue, 03 Feb 2026 07:28:21 GMT"},"fingerprint":{"sha1":"05:31:AB:E6:28:AA:34:61:4A:48:7E:65:0C:F4:B3:5C:C4:83:32:1C","sha256":"21:4F:96:D1:A6:49:BA:DE:DA:ED:44:75:9C:14:CB:91:91:40:7F:DF:20:22:BC:AF:67:C3:F6:DF:A1:21:46:73"}}},"request":{"raw":"GET /css/procss.css HTTP/1.1\r\nHost: kmqu.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kmqu.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 08 Nov 2025 19:15:41 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 25 Feb 2025 08:21:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67bd7d96-3f0c\"\r\nexpires: Sun, 09 Nov 2025 07:15:41 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16140,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CR line terminators","md5":"07f24766304f0df6bc904cb76b24e8b0","sha1":"48e3ba9eb2187267dcc75b451d349abf8fbd8f56","sha256":"05bdd8424d2bd9989dd849d198d41569f5bf242b9ac8fc97a1ae892a9a66c898","sha512":"1b9c273731c508a525519edcf0d0e96387e8116088f39d98ed772b451626dbddfb373e4136b9c2023c9906aaabf45ac86c0edd4eb15b2ae36116d516d7e69673","ssdeep":"96:pOkhHn4R3tvpnOPI62OrQdVF5tvSWdftQLS5S56c91dEZOkhHnF83CvpiVP2NoOf:xhHvzrWpvdv6qBhH0UrhML6RlHsMhSC9","tlshash":"dd72fe379291602db66b91ba7a636b8c721f8417fb430778fa673231c1470a32677bc4","first_seen":"2025-07-26T07:28:31.503425Z","last_seen":"2026-07-04T03:07:36.536602Z","times_seen":124,"resource_available":false,"data":null}},"time_used":156,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":156,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-08","alert":"Phishing Block","trigger":"kmqu.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-08","alert":"Sinkholed","trigger":"kmqu.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kmqu.cn/images/EA578E55E5B7AE57.png?x-oss-process=image/format,webp","fqdn":"kmqu.cn","domain":"kmqu.cn","tld":"cn"},"ip":{"addr":"154.201.76.110","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kmqu.cn/","date":"2025-11-08T19:15:41.283Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.srasom.cn","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 05 Nov 2025 07:28:22 GMT","end":"Tue, 03 Feb 2026 07:28:21 GMT"},"fingerprint":{"sha1":"05:31:AB:E6:28:AA:34:61:4A:48:7E:65:0C:F4:B3:5C:C4:83:32:1C","sha256":"21:4F:96:D1:A6:49:BA:DE:DA:ED:44:75:9C:14:CB:91:91:40:7F:DF:20:22:BC:AF:67:C3:F6:DF:A1:21:46:73"}}},"request":{"raw":"GET /images/EA578E55E5B7AE57.png?x-oss-process=image/format,webp HTTP/1.1\r\nHost: kmqu.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kmqu.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 08 Nov 2025 19:15:41 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 20 Mar 2024 06:02:01 GMT\r\nvary: Accept-Encoding\r\netag: W/\"65fa7bd9-6ec4\"\r\nexpires: Mon, 08 Dec 2025 19:15:41 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":28356,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 480 x 1000, 8-bit colormap, non-interlaced","md5":"45a656ca87d47e046e17367a085072c5","sha1":"e2c260b21c2dee8eb0539aa7682ea2b97ec1b98f","sha256":"021e104b7a231bc0da7b392c24151b8dd3c307155830258c0b5e08f5c01d32d8","sha512":"52cf6606b470d5bb032a9880bb577ec9a50e5358f6f61a994ac24b4a53857815c40daa419aa6984736d670b205cfa0fa47a4752e69c866a2b614c2c98937e055","ssdeep":"768:iqsdL2oCnZb11mSi/d4TDL4tQ6osPt1EP67rlG:iqQhCNSHF4LwQbyt1EP67rg","tlshash":"a8d2e18838ce2d3df914452636b760cee0565404f8c1eef319ec72ba2874e958aef579","first_seen":"2025-09-09T17:41:01.018789Z","last_seen":"2026-04-20T23:48:01.358538Z","times_seen":15,"resource_available":false,"data":null}},"time_used":312,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":312,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-08","alert":"Sinkholed","trigger":"kmqu.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-08","alert":"Phishing Block","trigger":"kmqu.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"kmqu.cn/images/01.webp","fqdn":"kmqu.cn","domain":"kmqu.cn","tld":"cn"},"ip":{"addr":"154.201.76.110","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://kmqu.cn/","date":"2025-11-08T19:15:41.285Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.srasom.cn","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 05 Nov 2025 07:28:22 GMT","end":"Tue, 03 Feb 2026 07:28:21 GMT"},"fingerprint":{"sha1":"05:31:AB:E6:28:AA:34:61:4A:48:7E:65:0C:F4:B3:5C:C4:83:32:1C","sha256":"21:4F:96:D1:A6:49:BA:DE:DA:ED:44:75:9C:14:CB:91:91:40:7F:DF:20:22:BC:AF:67:C3:F6:DF:A1:21:46:73"}}},"request":{"raw":"GET /images/01.webp HTTP/1.1\r\nHost: kmqu.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://kmqu.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 08 Nov 2025 19:15:41 GMT\r\ncontent-type: image/webp\r\ncontent-length: 4808\r\nlast-modified: Tue, 24 Dec 2024 05:42:22 GMT\r\netag: \"676a49be-12c8\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4808,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"4ad8d0b49b67cf6a90e81d53b6bd0b18","sha1":"ef1efb7187dac7e15cc2366c3e09488961da4b3c","sha256":"d96e56b6ab27c1b72b7002f0a121c235c95cbac95f1f7e26092d4a1df82c31ed","sha512":"798ab78467fed29c1401f49b759bbd0b818b8e10c3a9f58c066c34a961f4d0060e9ac32edcd4c0583f96a947cf0b4c15d58ada4bb6b6f9d4c5e55cc383b651dd","ssdeep":"96:r3oeV72nUtPYJdQLWfVUHW7tzqirs70/7H/0xCTRJOTJOiDL9:rfVsU1UfOHW7dqMs70L00OTJD9","tlshash":"10a15c56eab5a0c1fe07adc5c4f01c0d0c2ad81b13e4a3e9787abd60a7125ff917919b","first_seen":"2025-07-26T07:28:31.512929Z","last_seen":"2026-08-06T01:15:41.602472Z","times_seen":820,"resource_available":false,"data":null}},"time_used":694,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":501,"receive":193,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-08","alert":"Phishing Block","trigger":"kmqu.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-08","alert":"Sinkholed","trigger":"kmqu.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}}]}