{"report_id":"710d8207-54f1-4dfa-9db6-ab347b959c3b","version":6,"status":"done","tags":[],"date":"2025-08-29T06:53:56Z","url":{"schema":"http","addr":"telegramzh.top","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":0,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"telegramzh.top/","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"title":"中文版飞机"},"submit":{"url":{"schema":"http","addr":"telegramzh.top","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":0,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-10-03T06:53:56Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-29","alert":"Sinkholed","trigger":"telegramzh.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"telegramzh.top","ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":30,"request_count":30,"received_data":1474951,"sent_data":14595,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]},{"fqdn":"america.api.translate.zvo.cn","ip":{"addr":"45.205.24.48","port":443,"asn":0,"as":"","country":"Mauritius","country_code":"MU"},"domain_registered":"2006-07-24","domain_rank":2001024,"first_seen":"2024-01-14T15:39:22Z","last_seen":"2025-08-25T15:42:37.313515Z","alert_count":0,"request_count":2,"received_data":576,"sent_data":1114,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"api.translate.zvo.cn","ip":{"addr":"209.209.10.79","port":443,"asn":26832,"as":"RICAWEBSERVICES","country":"Canada","country_code":"CA"},"domain_registered":"2006-07-24","domain_rank":1885380,"first_seen":"2022-10-10T02:05:17Z","last_seen":"2025-08-25T15:42:37.39426Z","alert_count":0,"request_count":6,"received_data":9639,"sent_data":3331,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"telegramzh.top/template/default/style/js/translate.js","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"405106d166300e136b0816e62528f67e","sha1":"d5337abd19da1151f1b64ae4df87ffabd465478d","sha256":"89f1d0b0b95b484fb28c4438d0958b067a614c29630ef3d71374ac39b1a5ca78","sha512":"a80874858ebd17d7c754aabd94a13c591ba7041da483b7616fa8941fd74190399bb13a9e4ea0e43f3c31563a0c5c7c43a153d4394ddec2b96ad06fd2e71f7b33","ssdeep":"3072:TlIKxlV0V51ILUrvcBoMmb6g0jHEPhZ3bskitka0AOgQD82pu/4SHt0kvhr:CHNCUDcBoMmb6LjHCgQD8qSHekvV","tlshash":"3924d58033ad52bd62850114a7fa14ddec2ce937582bed70bb4da95f3be4819032de6d","size":213274,"data":"","first_seen":"2024-12-07T09:48:57.132806Z","last_seen":"2026-07-01T07:07:50.649015Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"fae56b17c9e0de23fb671b13e7e5df0e","sha1":"ef86355d4c4cb8017a18a9d122add8b0eaa1f82e","sha256":"a18a239685e8b48158562fa9e75e32180953cf652641d5fd868805c96aad94f8","sha512":"e429bc4863c16addf54a2ec5662c958900bf937b0e2238e311f31073310653f93a5afb3872424bebd59d98f59a3b4de7eb71e48cc42d8f4f47fcb2fb89b6e2da","ssdeep":"","tlshash":"ba8137a0f8141664a3f7686b749c70801d85c472ca4b448eb23f157f4fdf796b1a0b7a","size":3899,"data":"","first_seen":"2025-08-29T06:54:01.417923Z","last_seen":"2025-08-29T06:54:01.417923Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/template/default/style/js/jquery.min.js","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"60f3317e844d9d135aba49ffee394a40","sha1":"672dd49b982c5ce98bcec0cd0449487feb6fa1a8","sha256":"7b7de2f5bc4f6b4644a79b2e1e2b16072c60a2942f8d9fe6e5926ed0232f951f","sha512":"74bbf4655ede4c71904c3d24892cb7769cff98ea5fbf9b2b043ae2a94f2e0fa22a2e12e95da7229e3192a54e599470bbcde2e617bdc11e5e35c23cf3ebe8c102","ssdeep":"1536:XP1vk7i6GUHdXXeyQazBu+4HhiO2AEeLyFoqqhJ7SerN5sVI6xcBvPv7E+nzms9e:K4UddqhJvNPqcBH7MfWWca98HrK","tlshash":"9793d8d9b7d67062977730b850bf510bb13a98eab80c4c60f1a4d8e47e74a89507bf2d","size":95887,"data":"","first_seen":"2025-08-29T06:54:01.396915Z","last_seen":"2025-08-29T06:54:01.396915Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"6bd43cf0ae158526c6ab93dc3be79f28","sha1":"15c289e342bd3fdf5b1e95f7abf25a2bc78bf357","sha256":"7a13d5ae0755d86c09084ec300c4a0f1a0a06921f74d9980eba9d966ff17ad38","sha512":"5190eb107c27f5d655eab378cd468228aa031d088f59082f257f41d464a29fbdb23594043afe89a3f9b63ce86d91efad6c2901c816d85196389293a6a5a28521","ssdeep":"","tlshash":"df90040100513554711530d00134c3dd157df075dc4dd335754f57004040405c53c401","size":40,"data":"","first_seen":"2023-03-07T01:02:07Z","last_seen":"2026-08-09T20:01:21.932359Z","times_seen":30692,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"86b79856c36f9e060207a8dedb7dd3bf","sha1":"dedb57fd0f68bc969fa60c35163d8b804b4ddcdb","sha256":"cf7604dc95e9c0a9b28860eee32dabc410f4583b62e6883e8fa5bfdd78d6e3dc","sha512":"849b9fa0dfdeda6c543e6cc9c7b8481a0d4e4743d892cd4c5d1ac5c667e14826ba269ea2eef62f3d89caa1d9c6f0efd6369d2d1d8256f4a48b1006ee8832ef4e","ssdeep":"","tlshash":"1b51850883b5217c30e6229dfdeb3d4065d880934022edd5bfdda2967fc79686b8c2b5","size":2886,"data":"","first_seen":"2025-08-29T06:54:01.433014Z","last_seen":"2025-08-29T06:54:01.433014Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":[{"md5":"312351bff07989769097660a56395065","sha1":"004be89dd9e070ecb080b9b759e5be29ec24881b","sha256":"b2b2f104d32c638903e151a9b20d6e27b41d8c0c84cf8458738f83ca2f1dd744","sha512":"454935a0b9fe288a70896e9e0548537ed09c564e47d771b91202f70ddc94946fa6b209e205034983ebe3160633bf5401df01cdfc54b7f98c4bfbd5845a89124f","ssdeep":"","tlshash":"1f3000000000000000cc00000000000000000000000000000000000000000000000c00","size":4,"data":"","first_seen":"2023-03-13T00:05:53Z","last_seen":"2026-06-07T07:17:39.905306Z","times_seen":32226,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"console":null},"http":[{"url":{"schema":"https","addr":"telegramzh.top/template/default/style/picture/6aef09f5af1f484297f5bfb2ff120175.gif","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:36.681Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegramzh.top","organization":""},"issuer":{"commonName":"sslTrus (RSA) DV CA","organization":"sslTrus"},"validity":{"start":"Fri, 24 Jan 2025 00:00:00 GMT","end":"Sat, 24 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:CC:94:72:16:54:90:DF:91:7C:06:58:6C:18:FC:29:A5:5D:EB:96","sha256":"DB:C0:38:DD:60:AF:CF:66:0D:80:3D:F0:15:30:0B:C1:12:C8:14:ED:60:5E:DF:93:1F:AB:F4:EB:FF:D9:2D:FF"}}},"request":{"raw":"GET /template/default/style/picture/6aef09f5af1f484297f5bfb2ff120175.gif HTTP/1.1\r\nHost: telegramzh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nCookie: lg=cn\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 29 Aug 2025 06:53:36 GMT\r\ncontent-type: image/gif\r\nlast-modified: Fri, 20 Dec 2024 06:52:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67651422-4051\"\r\nexpires: Sun, 28 Sep 2025 06:53:36 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16465,"size_decoded":0,"mime_type":"image/gif","magic":"PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced","md5":"77ffe8b3dff795ea0734bf4b35a94357","sha1":"2d545ffb0877993dd227d528638a336cd3b9e32c","sha256":"ad37907e335e7c5d2692b682401f4520753ab539fadedf74962c6a004b3a179f","sha512":"fb4692716badcb1fce73addb8ecbd16c7158a8d0618b3bf3b1833661a3813d48500f8c96972c9cbc2f5ee9dbec1ce6f0450a6445a3ca9635fe2b3ada9a50b206","ssdeep":"384:4/zugvMc/z6Gaq5iFvJBOqikYcWOFKOX7AtgqHJVw:4qW6UgvJHikXW27X7kJm","tlshash":"5f72d07623938eb70eb9680d3f58eba84f17c540be5897a43176950c1532fe5ac4893e","first_seen":"2023-05-09T05:29:39Z","last_seen":"2026-08-01T14:23:34.055954Z","times_seen":1203,"resource_available":false,"data":null}},"time_used":450,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":450,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-29","alert":"Sinkholed","trigger":"telegramzh.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"america.api.translate.zvo.cn/connectTest.json","fqdn":"america.api.translate.zvo.cn","domain":"zvo.cn","tld":"cn"},"ip":{"addr":"45.205.24.48","port":443,"asn":0,"as":"","country":"Mauritius","country_code":"MU"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:37.499Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"ECDSA-P521-SHA512","protocol":"TLSv1.2","cert":{"subject":{"commonName":"america.api.translate.zvo.cn","organization":""},"issuer":{"commonName":"E5","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 03:15:41 GMT","end":"Sun, 02 Nov 2025 03:15:40 GMT"},"fingerprint":{"sha1":"B9:57:19:17:F4:1A:5B:EF:70:5E:1A:39:35:AE:A0:72:19:14:CB:92","sha256":"F6:7D:6C:B1:29:D7:C3:E9:B3:2D:A3:23:15:79:45:21:C0:FF:65:35:AE:20:C3:2D:89:DC:68:CC:8C:7D:CB:94"}}},"request":{"raw":"OPTIONS /connectTest.json HTTP/1.1\r\nHost: america.api.translate.zvo.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: currentpage\r\nReferer: https://telegramzh.top/\r\nOrigin: https://telegramzh.top\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0\r\nDate: Fri, 29 Aug 2025 06:53:38 GMT\r\nContent-Type: application/json\r\nContent-Length: 59\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Headers: currentpage\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"f13a736e8c1ac6238aa9291cc1c0194c","sha1":"c5d222186d2c836d062918797ecab5146ec5b542","sha256":"f3ea102f42eea7f05e2f8d529c848751928f259a7a729c249d82205afbeacf30","sha512":"27ca379febb4ebbaebb7d4911ae35d59f582267a62f7d3c8a250af4d5d28fb0062ee712039f8bf0818ef2ce448d4fcbbb6f05578c6900df8e009badbc0cc5b58","ssdeep":"","tlshash":"fca002d35ad15d06aa81158a994d51c66405624b0f6bdd036a26844a1cb0494171f614","first_seen":"2024-01-21T01:54:45Z","last_seen":"2026-07-18T08:21:27.803408Z","times_seen":654,"resource_available":false,"data":null}},"time_used":1046,"timings":{"blocked":444,"dns":1,"connect":148,"send":0,"wait":148,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/template/default/style/css/bootstrap.min.css","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:36.665Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegramzh.top","organization":""},"issuer":{"commonName":"sslTrus (RSA) DV CA","organization":"sslTrus"},"validity":{"start":"Fri, 24 Jan 2025 00:00:00 GMT","end":"Sat, 24 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:CC:94:72:16:54:90:DF:91:7C:06:58:6C:18:FC:29:A5:5D:EB:96","sha256":"DB:C0:38:DD:60:AF:CF:66:0D:80:3D:F0:15:30:0B:C1:12:C8:14:ED:60:5E:DF:93:1F:AB:F4:EB:FF:D9:2D:FF"}}},"request":{"raw":"GET /template/default/style/css/bootstrap.min.css HTTP/1.1\r\nHost: telegramzh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nCookie: lg=cn\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 29 Aug 2025 06:53:36 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 20 Dec 2024 07:54:34 GMT\r\nvary: Accept-Encoding\r\netag: W/\"676522ba-a475\"\r\nexpires: Fri, 29 Aug 2025 18:53:36 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":42101,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (42101), with no line terminators","md5":"5e3302759e3c47d89acd89c7d61c4a67","sha1":"bccfb3cdf1a6afe16e3ef1cc9d74752de77768aa","sha256":"ef4c825a95d41011bb81fb9001a335e56fc1e0c418b3b0d12ce5159b7d817aa0","sha512":"c34d7e6a3119fa2447c528f394c72aa8c2fb5de1c54389a83674e35f413e9e317fb447e55762894a627686ac3ab9786235be28936162b852abbfb765fa82b98a","ssdeep":"384:AvBBVkrJxvcwYBUQ7X85AUfvDUNeFUBOgBmjeYP4PSvSdlb1bGjpXJNNRyIrOM:kk0p38OBmjeYP4xb1bG/bRyIH","tlshash":"4c13c711f27031aa2167c61c65d0aad63f256020da8e0fbbf97376e88b8d6c91773f05","first_seen":"2023-12-10T23:05:35Z","last_seen":"2026-06-09T16:14:05.048482Z","times_seen":6,"resource_available":false,"data":null}},"time_used":153,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-29","alert":"Sinkholed","trigger":"telegramzh.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/template/default/style/picture/logo.png","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:36.671Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegramzh.top","organization":""},"issuer":{"commonName":"sslTrus (RSA) DV CA","organization":"sslTrus"},"validity":{"start":"Fri, 24 Jan 2025 00:00:00 GMT","end":"Sat, 24 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:CC:94:72:16:54:90:DF:91:7C:06:58:6C:18:FC:29:A5:5D:EB:96","sha256":"DB:C0:38:DD:60:AF:CF:66:0D:80:3D:F0:15:30:0B:C1:12:C8:14:ED:60:5E:DF:93:1F:AB:F4:EB:FF:D9:2D:FF"}}},"request":{"raw":"GET /template/default/style/picture/logo.png HTTP/1.1\r\nHost: telegramzh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nCookie: lg=cn\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 29 Aug 2025 06:53:36 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 20 Dec 2024 08:28:49 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67652ac1-1ca7\"\r\nexpires: Sun, 28 Sep 2025 06:53:36 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7335,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 140 x 140, 8-bit/color RGBA, non-interlaced","md5":"bd5b0ea0d85bd6811455233fd0910a94","sha1":"93548a638f180cfde3afd690b391d65c2e67924c","sha256":"7667354d07e7ef89f2c503dc0b31e6c5f99db7d036e5c1d809255a44cf046cd8","sha512":"38e494b311284ed6e6738d0ac3721eda9de452c79effe0ed0e2f907a7ba87d5c98ff29fcc0a4505543b9b736f977dd05b76be502c4dc4c79865ac86629240218","ssdeep":"192:d9EdXxtkPTaU9rsQ0lELJqagYgwJsyqWNDriWol:d2dXxt4ptalrascsybNXTY","tlshash":"60e19ef5bd1ba26a1d0e5e00c098371d343f4d9a5b72230b77eea298222c419634a36b","first_seen":"2025-08-29T06:54:01.352061Z","last_seen":"2025-08-29T06:54:01.352061Z","times_seen":1,"resource_available":false,"data":null}},"time_used":454,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":454,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-29","alert":"Sinkholed","trigger":"telegramzh.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/template/default/style/js/translate.js","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:36.690Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegramzh.top","organization":""},"issuer":{"commonName":"sslTrus (RSA) DV CA","organization":"sslTrus"},"validity":{"start":"Fri, 24 Jan 2025 00:00:00 GMT","end":"Sat, 24 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:CC:94:72:16:54:90:DF:91:7C:06:58:6C:18:FC:29:A5:5D:EB:96","sha256":"DB:C0:38:DD:60:AF:CF:66:0D:80:3D:F0:15:30:0B:C1:12:C8:14:ED:60:5E:DF:93:1F:AB:F4:EB:FF:D9:2D:FF"}}},"request":{"raw":"GET /template/default/style/js/translate.js HTTP/1.1\r\nHost: telegramzh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nCookie: lg=cn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 29 Aug 2025 06:53:36 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 19 Dec 2024 12:11:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67640d89-3435e\"\r\nexpires: Fri, 29 Aug 2025 18:53:36 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":213854,"size_decoded":0,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"97b925f9c15ba98365e52c90eaff625a","sha1":"8eb4688fa70f1b098778200f38386d77a40910c8","sha256":"3e679c87c3007e5786dd2d8e68f30b8a9ee6e8f805d9d2f1ff29d921eb93add9","sha512":"2bf2e372b0a1db2dd8adc38c3c50e7be68b4a05d5befa3fddef681cdc0bd67ae974467662af187ccdef290a08c90398124f8b529cb7d73ca5fc5b1508e9b1b59","ssdeep":"6144:CHNCUDcBoMmb6LjHCgQD8qSHOkPrTTLliF4MgKdk:CHNCUDfgQD8qLkPrTTLS4M9dk","tlshash":"9e24d58033ad53bd62850154a7fa14dded2ce937582be970bb4ea85f3be0819031de6d","first_seen":"2025-08-29T06:54:01.353607Z","last_seen":"2025-08-29T06:54:01.353607Z","times_seen":1,"resource_available":false,"data":null}},"time_used":447,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":447,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-29","alert":"Sinkholed","trigger":"telegramzh.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/template/default/style/picture/806151c3a767402d8abb6f5da2567601.gif","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:36.689Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegramzh.top","organization":""},"issuer":{"commonName":"sslTrus (RSA) DV CA","organization":"sslTrus"},"validity":{"start":"Fri, 24 Jan 2025 00:00:00 GMT","end":"Sat, 24 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:CC:94:72:16:54:90:DF:91:7C:06:58:6C:18:FC:29:A5:5D:EB:96","sha256":"DB:C0:38:DD:60:AF:CF:66:0D:80:3D:F0:15:30:0B:C1:12:C8:14:ED:60:5E:DF:93:1F:AB:F4:EB:FF:D9:2D:FF"}}},"request":{"raw":"GET /template/default/style/picture/806151c3a767402d8abb6f5da2567601.gif HTTP/1.1\r\nHost: telegramzh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nCookie: lg=cn\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 29 Aug 2025 06:53:36 GMT\r\ncontent-type: image/gif\r\nlast-modified: Fri, 20 Dec 2024 06:52:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67651422-4b7d\"\r\nexpires: Sun, 28 Sep 2025 06:53:36 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19325,"size_decoded":0,"mime_type":"image/gif","magic":"PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced","md5":"da1ff638a4141eed84327e20f936496f","sha1":"91e5410531539b53c3aefcc5774413e8a665a57a","sha256":"b66de388c12d6611870503c34c5db37fe079313c4292177435fd8dc7ed6cbe67","sha512":"75b6243feb853275a9e4aa1c36591cbdc3439cd27489cd5833f8670e072acecc59888699bebd3ffe5f8d1851608394d3255eaaa863db438511cb4798f99d334a","ssdeep":"384:/fkqoRm5m06jc+ejLD9xyVF1gX+Bq3lCTiqvfKs90HmFOGJaIv5Se4:/cqo25lu1RBJmYtiH8OERvK","tlshash":"3e92e1724b62b388ea599ce2524f72724cb9f52f5830afca12f5c544c1cf9ee402e56c","first_seen":"2023-05-09T05:29:39Z","last_seen":"2026-08-01T14:23:34.074455Z","times_seen":1101,"resource_available":false,"data":null}},"time_used":447,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":447,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-29","alert":"Sinkholed","trigger":"telegramzh.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/static/upload/image/20241222/1734836164397016.png","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:37.062Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegramzh.top","organization":""},"issuer":{"commonName":"sslTrus (RSA) DV CA","organization":"sslTrus"},"validity":{"start":"Fri, 24 Jan 2025 00:00:00 GMT","end":"Sat, 24 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:CC:94:72:16:54:90:DF:91:7C:06:58:6C:18:FC:29:A5:5D:EB:96","sha256":"DB:C0:38:DD:60:AF:CF:66:0D:80:3D:F0:15:30:0B:C1:12:C8:14:ED:60:5E:DF:93:1F:AB:F4:EB:FF:D9:2D:FF"}}},"request":{"raw":"GET /static/upload/image/20241222/1734836164397016.png HTTP/1.1\r\nHost: telegramzh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nCookie: lg=cn\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 29 Aug 2025 06:53:37 GMT\r\ncontent-type: image/png\r\ncontent-length: 640\r\nlast-modified: Sun, 22 Dec 2024 02:56:04 GMT\r\netag: \"67677fc4-280\"\r\nexpires: Sun, 28 Sep 2025 06:53:37 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":640,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 21 x 27, 8-bit colormap, non-interlaced","md5":"8585439171b0999154f9a5463e592b2d","sha1":"62a1d7d82cb5d53385bdf8966e8327cbc2f8be80","sha256":"85358e7a866ac74f3884a21df0482e4699e1c9b9f949467e1bca6c2700325ed3","sha512":"bfdb0f039b20cb62062667b71fe15e7c0a002680cffefb0069112e4c7b8fe6007498fbe8eb5a301801862da18e192295d52a891448b870ddfd7fde14f0202ff2","ssdeep":"","tlshash":"e6f08be33704a9f79ea43d1ad887249206664fb88dc196ca718793ae1ca21f303ca350","first_seen":"2025-08-29T06:54:01.35579Z","last_seen":"2025-08-29T06:54:01.35579Z","times_seen":1,"resource_available":false,"data":null}},"time_used":359,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":357,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-29","alert":"Sinkholed","trigger":"telegramzh.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.translate.zvo.cn/connectTest.json","fqdn":"api.translate.zvo.cn","domain":"zvo.cn","tld":"cn"},"ip":{"addr":"209.209.10.79","port":443,"asn":26832,"as":"RICAWEBSERVICES","country":"Canada","country_code":"CA"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:37.498Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.translate.zvo.cn","organization":""},"issuer":{"commonName":"ZeroSSL ECC Domain Secure Site CA","organization":"ZeroSSL"},"validity":{"start":"Sun, 20 Jul 2025 00:00:00 GMT","end":"Sat, 18 Oct 2025 23:59:59 GMT"},"fingerprint":{"sha1":"0B:58:AD:DE:2A:10:56:09:3B:6B:32:BC:41:45:FF:B9:66:BD:C6:F8","sha256":"68:72:08:A1:2D:3C:0E:3F:DE:40:B5:FD:DF:AF:A0:48:F8:6A:49:DC:2C:C7:4B:60:75:C0:C6:1B:23:CF:66:CC"}}},"request":{"raw":"OPTIONS /connectTest.json HTTP/1.1\r\nHost: api.translate.zvo.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: currentpage\r\nReferer: https://telegramzh.top/\r\nOrigin: https://telegramzh.top\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 \r\nServer: nginx/1.24.0\r\nDate: Fri, 29 Aug 2025 06:53:37 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Headers: currentpage\r\nTranslate-Doc: http://translate.zvo.cn\r\nVary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nAllow: GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/json","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T19:49:09.059463Z","times_seen":17805050,"resource_available":true,"data":null}},"time_used":684,"timings":{"blocked":282,"dns":1,"connect":110,"send":0,"wait":110,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/template/default/style/css/languji.css","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:36.669Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegramzh.top","organization":""},"issuer":{"commonName":"sslTrus (RSA) DV CA","organization":"sslTrus"},"validity":{"start":"Fri, 24 Jan 2025 00:00:00 GMT","end":"Sat, 24 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:CC:94:72:16:54:90:DF:91:7C:06:58:6C:18:FC:29:A5:5D:EB:96","sha256":"DB:C0:38:DD:60:AF:CF:66:0D:80:3D:F0:15:30:0B:C1:12:C8:14:ED:60:5E:DF:93:1F:AB:F4:EB:FF:D9:2D:FF"}}},"request":{"raw":"GET /template/default/style/css/languji.css HTTP/1.1\r\nHost: telegramzh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nCookie: lg=cn\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 29 Aug 2025 06:53:36 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 20 Dec 2024 12:45:51 GMT\r\nvary: Accept-Encoding\r\netag: W/\"676566ff-38bf\"\r\nexpires: Fri, 29 Aug 2025 18:53:36 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14527,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (458), with CRLF line terminators","md5":"1e63b9edc233b9761ec8ede9b1d47e68","sha1":"38c558bfa4cc9fd0f4c796cf4b917da42b7d0d06","sha256":"80b332f0859e4b01a78fda5102d3b7e789e6a6c1fad6e38b756ca3ce785770da","sha512":"444a3f256f511ffc236e8ba7eee31ae71d4dd4ca22a72bbb708d2328ddbf410f9c7afc1ca6745a76923566fec7b58a4a99b8bb2f78ca846428b6f59478f82ae2","ssdeep":"192:sNrQEyI9J/iMvHLg3l+nvPMLhbJjkGBp8RkR+/TEbW5l+2ozczqrwIlg:8rQEyIrzslb00g","tlshash":"a0623c9568d21169bc97d36074f32bb8be7e4d10de29bdfc235e37a42ac70fa1062464","first_seen":"2025-08-29T06:54:01.358052Z","last_seen":"2025-08-29T06:54:01.358052Z","times_seen":1,"resource_available":false,"data":null}},"time_used":305,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":305,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-29","alert":"Sinkholed","trigger":"telegramzh.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/static/upload/image/20241221/1734765834224262.jpg","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:36.673Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegramzh.top","organization":""},"issuer":{"commonName":"sslTrus (RSA) DV CA","organization":"sslTrus"},"validity":{"start":"Fri, 24 Jan 2025 00:00:00 GMT","end":"Sat, 24 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:CC:94:72:16:54:90:DF:91:7C:06:58:6C:18:FC:29:A5:5D:EB:96","sha256":"DB:C0:38:DD:60:AF:CF:66:0D:80:3D:F0:15:30:0B:C1:12:C8:14:ED:60:5E:DF:93:1F:AB:F4:EB:FF:D9:2D:FF"}}},"request":{"raw":"GET /static/upload/image/20241221/1734765834224262.jpg HTTP/1.1\r\nHost: telegramzh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nCookie: lg=cn\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 29 Aug 2025 06:53:36 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Sat, 21 Dec 2024 07:24:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67666d3c-37d32\"\r\nexpires: Sun, 28 Sep 2025 06:53:36 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":228658,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v90), quality = 90\", baseline, precision 8, 1000x641, components 3","md5":"69d6f2e14c58e0c86f8a4734522b471e","sha1":"54ce567407365ebdf198544ee72cc864fa2b016d","sha256":"7f3e1c6210abf39b9d7585fed1ced1469449b9438a390d6b9d564f7c7a50b223","sha512":"25f792660c89269ec8235a770dae4eb53d3205967940785b65a5a79e6a3ba516122f998a82286181cbbb9ca61fdc0b1e8ef038d877d0ccfeaba6173727a31b70","ssdeep":"6144:PgFOaiHI1cgwQPGn43bv4b69aBOZzAGVW2ebmyz+:YGIFwcG4LvNeOZQ22mQ+","tlshash":"432422a39921efe022795e4655373bd8e389fa09433b22c7c5e0679209211efa61c6c8","first_seen":"2025-08-29T06:54:01.35952Z","last_seen":"2025-08-29T06:54:01.35952Z","times_seen":1,"resource_available":false,"data":null}},"time_used":454,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":454,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-29","alert":"Sinkholed","trigger":"telegramzh.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/static/upload/image/20241221/1734762773847099.jpg","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:36.677Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegramzh.top","organization":""},"issuer":{"commonName":"sslTrus (RSA) DV CA","organization":"sslTrus"},"validity":{"start":"Fri, 24 Jan 2025 00:00:00 GMT","end":"Sat, 24 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:CC:94:72:16:54:90:DF:91:7C:06:58:6C:18:FC:29:A5:5D:EB:96","sha256":"DB:C0:38:DD:60:AF:CF:66:0D:80:3D:F0:15:30:0B:C1:12:C8:14:ED:60:5E:DF:93:1F:AB:F4:EB:FF:D9:2D:FF"}}},"request":{"raw":"GET /static/upload/image/20241221/1734762773847099.jpg HTTP/1.1\r\nHost: telegramzh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nCookie: lg=cn\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 29 Aug 2025 06:53:36 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Sat, 21 Dec 2024 06:32:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67666115-16a39\"\r\nexpires: Sun, 28 Sep 2025 06:53:36 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":92729,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 600x361, components 3","md5":"552c79a8fedf47e491b6b15dd3b1d922","sha1":"8a846d78d74098f962ea90f3d49c638dff9bf63c","sha256":"31188d47b6b3098db50a5dd3da0fe368a952846e0d5c1bce9b9505b0271005fc","sha512":"3f92280daca548c18bc8dbfc7e4e16bf97622c83c5c9eab4ca574db771a38ad80cf6f9ce0faeb77379d32aafa51fec1f82755f8a183e93627a8eea68ec3e31e8","ssdeep":"1536:wGdlytAEplOPWD3XHhhK3rAWygWZlonJcGcJ6YUUnnJiDd4295Z41g2n0UuBist3:7dlgCaroMgWs5iRnJa/95a1gYWR","tlshash":"729312d7e96bc502d3854b234eb7813b31b2138f5f823a5ce5ee5f0e200995e61ea5c8","first_seen":"2025-06-12T11:38:48.307577Z","last_seen":"2026-06-22T17:54:59.549684Z","times_seen":22,"resource_available":false,"data":null}},"time_used":452,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":452,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-29","alert":"Sinkholed","trigger":"telegramzh.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/static/upload/image/20241222/1734838799205390.jpg","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:37.060Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegramzh.top","organization":""},"issuer":{"commonName":"sslTrus (RSA) DV CA","organization":"sslTrus"},"validity":{"start":"Fri, 24 Jan 2025 00:00:00 GMT","end":"Sat, 24 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:CC:94:72:16:54:90:DF:91:7C:06:58:6C:18:FC:29:A5:5D:EB:96","sha256":"DB:C0:38:DD:60:AF:CF:66:0D:80:3D:F0:15:30:0B:C1:12:C8:14:ED:60:5E:DF:93:1F:AB:F4:EB:FF:D9:2D:FF"}}},"request":{"raw":"GET /static/upload/image/20241222/1734838799205390.jpg HTTP/1.1\r\nHost: telegramzh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nCookie: lg=cn\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 29 Aug 2025 06:53:37 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Sun, 22 Dec 2024 03:39:59 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67678a0f-5262\"\r\nexpires: Sun, 28 Sep 2025 06:53:37 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":21090,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1], baseline, precision 8, 290x270, components 3","md5":"f5eb8dcf9b18f19053034101e920574e","sha1":"9513c6c5e39669ad27132d470008955dbaae61f0","sha256":"15a94720d72ed1727fb281ed4af914e17cd8166bb18f5a8484f32f9faff4f365","sha512":"950178cc71bd88274f49e6248a078f4f0faa95e7188c2e69e2edc62d874cabf5edda83dece9fee9c657b05cf52760e513f5161b34bf5fe8232923e008dca34c3","ssdeep":"384:3j0OJMdamjE0cVsRQK80uxr+IsTJo7qvrgAK56GEUUW5tXnwu:34fHEGupslo7q8AK56U5tXwu","tlshash":"5692be2715d90d83ca59d3f97f4214e91b9aba9dff0274faca560ec69ba00e1100f478","first_seen":"2023-05-09T05:29:39Z","last_seen":"2026-08-05T23:34:55.017287Z","times_seen":1852,"resource_available":false,"data":null}},"time_used":357,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":357,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-29","alert":"Sinkholed","trigger":"telegramzh.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/static/upload/image/20241222/1734836154243584.png","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:37.058Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegramzh.top","organization":""},"issuer":{"commonName":"sslTrus (RSA) DV CA","organization":"sslTrus"},"validity":{"start":"Fri, 24 Jan 2025 00:00:00 GMT","end":"Sat, 24 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:CC:94:72:16:54:90:DF:91:7C:06:58:6C:18:FC:29:A5:5D:EB:96","sha256":"DB:C0:38:DD:60:AF:CF:66:0D:80:3D:F0:15:30:0B:C1:12:C8:14:ED:60:5E:DF:93:1F:AB:F4:EB:FF:D9:2D:FF"}}},"request":{"raw":"GET /static/upload/image/20241222/1734836154243584.png HTTP/1.1\r\nHost: telegramzh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nCookie: lg=cn\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 29 Aug 2025 06:53:37 GMT\r\ncontent-type: image/png\r\ncontent-length: 522\r\nlast-modified: Sun, 22 Dec 2024 02:55:54 GMT\r\netag: \"67677fba-20a\"\r\nexpires: Sun, 28 Sep 2025 06:53:37 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":522,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 22 x 27, 8-bit colormap, non-interlaced","md5":"6995696f5114832e623ef81fb0fbf8bb","sha1":"9b8ab5bec7b6a8ccaab65fe7b6194c799e6da0fa","sha256":"f9103bd8eed69c6b72da2a7ce1358ca669ec46d2bebc40606356d0e17fe98d23","sha512":"400c0b6a40bc1c873e91f5deef2a198749b7cc27d196250adb7fcea0869347ff50e30246eedf1e2ba0c77883a2fc7a034c84efb1d75686a875c0b0dd74e45b03","ssdeep":"","tlshash":"55f0d46621007be7ed85071978ce7212d90c0f3c5cc564d1b004f41d11601d3e5cb7d4","first_seen":"2025-08-29T06:54:01.362374Z","last_seen":"2025-08-29T06:54:01.362374Z","times_seen":1,"resource_available":false,"data":null}},"time_used":360,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":358,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-29","alert":"Sinkholed","trigger":"telegramzh.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"america.api.translate.zvo.cn/connectTest.json","fqdn":"america.api.translate.zvo.cn","domain":"zvo.cn","tld":"cn"},"ip":{"addr":"45.205.24.48","port":443,"asn":0,"as":"","country":"Mauritius","country_code":"MU"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:38.116Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"ECDSA-P521-SHA512","protocol":"TLSv1.2","cert":{"subject":{"commonName":"america.api.translate.zvo.cn","organization":""},"issuer":{"commonName":"E5","organization":"Let's Encrypt"},"validity":{"start":"Mon, 04 Aug 2025 03:15:41 GMT","end":"Sun, 02 Nov 2025 03:15:40 GMT"},"fingerprint":{"sha1":"B9:57:19:17:F4:1A:5B:EF:70:5E:1A:39:35:AE:A0:72:19:14:CB:92","sha256":"F6:7D:6C:B1:29:D7:C3:E9:B3:2D:A3:23:15:79:45:21:C0:FF:65:35:AE:20:C3:2D:89:DC:68:CC:8C:7D:CB:94"}}},"request":{"raw":"POST /connectTest.json HTTP/1.1\r\nHost: america.api.translate.zvo.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\ncontent-type: application/x-www-form-urlencoded\r\ncurrentpage: https://telegramzh.top/\r\nContent-Length: 42\r\nOrigin: https://telegramzh.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0\r\nDate: Fri, 29 Aug 2025 06:53:38 GMT\r\nContent-Type: application/json\r\nContent-Length: 59\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Headers: currentpage\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"f13a736e8c1ac6238aa9291cc1c0194c","sha1":"c5d222186d2c836d062918797ecab5146ec5b542","sha256":"f3ea102f42eea7f05e2f8d529c848751928f259a7a729c249d82205afbeacf30","sha512":"27ca379febb4ebbaebb7d4911ae35d59f582267a62f7d3c8a250af4d5d28fb0062ee712039f8bf0818ef2ce448d4fcbbb6f05578c6900df8e009badbc0cc5b58","ssdeep":"","tlshash":"fca002d35ad15d06aa81158a994d51c66405624b0f6bdd036a26844a1cb0494171f614","first_seen":"2024-01-21T01:54:45Z","last_seen":"2026-07-18T08:21:27.803408Z","times_seen":654,"resource_available":false,"data":null}},"time_used":148,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":148,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/favicon.ico","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:38.459Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegramzh.top","organization":""},"issuer":{"commonName":"sslTrus (RSA) DV CA","organization":"sslTrus"},"validity":{"start":"Fri, 24 Jan 2025 00:00:00 GMT","end":"Sat, 24 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:CC:94:72:16:54:90:DF:91:7C:06:58:6C:18:FC:29:A5:5D:EB:96","sha256":"DB:C0:38:DD:60:AF:CF:66:0D:80:3D:F0:15:30:0B:C1:12:C8:14:ED:60:5E:DF:93:1F:AB:F4:EB:FF:D9:2D:FF"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: telegramzh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nCookie: lg=cn\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Fri, 29 Aug 2025 06:53:38 GMT\r\ncontent-type: text/html\r\ncontent-length: 146\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":146,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-08-09T19:50:06.499889Z","times_seen":547763,"resource_available":true,"data":null}},"time_used":285,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":285,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-29","alert":"Sinkholed","trigger":"telegramzh.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/template/default/style/picture/cdf54169cbf74b58b6db07f5541df9ef.gif","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:36.678Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegramzh.top","organization":""},"issuer":{"commonName":"sslTrus (RSA) DV CA","organization":"sslTrus"},"validity":{"start":"Fri, 24 Jan 2025 00:00:00 GMT","end":"Sat, 24 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:CC:94:72:16:54:90:DF:91:7C:06:58:6C:18:FC:29:A5:5D:EB:96","sha256":"DB:C0:38:DD:60:AF:CF:66:0D:80:3D:F0:15:30:0B:C1:12:C8:14:ED:60:5E:DF:93:1F:AB:F4:EB:FF:D9:2D:FF"}}},"request":{"raw":"GET /template/default/style/picture/cdf54169cbf74b58b6db07f5541df9ef.gif HTTP/1.1\r\nHost: telegramzh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nCookie: lg=cn\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 29 Aug 2025 06:53:36 GMT\r\ncontent-type: image/gif\r\nlast-modified: Fri, 20 Dec 2024 06:52:17 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67651421-2c4f\"\r\nexpires: Sun, 28 Sep 2025 06:53:36 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11343,"size_decoded":0,"mime_type":"image/gif","magic":"PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced","md5":"4e06d87c860ba8e8a804350f42632217","sha1":"31d3f89ae95d6f25660020b21e49114aaecfdd59","sha256":"6b081cb199e67a43ddcd7ddac0b528c93cc72bb82641937368a41b0aece43125","sha512":"c28516686e07c341dba58b28c8185ac31ff479d7b4f8d081cb50b395c6678e353b8d0d00e3b21185dbcb6484f81a354170d403b8b6f6e7efe8d73017d1d681ed","ssdeep":"192:5BkxH7mNBqw0b+7h5tyiS/5Z3LeiTLgrsPGLR66oy/PtnBpLghEr/RKlfPs9yMHk:5BGKrr0bkNyiqZ3LeiTLLm66NFBZgWru","tlshash":"fc32ceebb95170dc581b208b3f005099cc5df6500d2e2e9fb9fec78910238a9a580bab","first_seen":"2023-05-09T05:29:39Z","last_seen":"2026-08-01T14:23:34.150123Z","times_seen":1211,"resource_available":false,"data":null}},"time_used":451,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":451,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-29","alert":"Sinkholed","trigger":"telegramzh.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/template/default/style/picture/fb2076d230cc4f7682585741f47ea213.gif","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:36.683Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegramzh.top","organization":""},"issuer":{"commonName":"sslTrus (RSA) DV CA","organization":"sslTrus"},"validity":{"start":"Fri, 24 Jan 2025 00:00:00 GMT","end":"Sat, 24 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:CC:94:72:16:54:90:DF:91:7C:06:58:6C:18:FC:29:A5:5D:EB:96","sha256":"DB:C0:38:DD:60:AF:CF:66:0D:80:3D:F0:15:30:0B:C1:12:C8:14:ED:60:5E:DF:93:1F:AB:F4:EB:FF:D9:2D:FF"}}},"request":{"raw":"GET /template/default/style/picture/fb2076d230cc4f7682585741f47ea213.gif HTTP/1.1\r\nHost: telegramzh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nCookie: lg=cn\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 29 Aug 2025 06:53:36 GMT\r\ncontent-type: image/gif\r\nlast-modified: Fri, 20 Dec 2024 06:52:19 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67651423-4637\"\r\nexpires: Sun, 28 Sep 2025 06:53:36 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":17975,"size_decoded":0,"mime_type":"image/gif","magic":"PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced","md5":"1d581b72d19bc828654229a0773a5300","sha1":"ff517c8bb4b37351ff3dd72f7ec66fc584e90d5c","sha256":"d2b3858e94ed122782de9028f668334438649e46e5d2c6d761e3359c8e3de200","sha512":"1b98b05c5f720c34d470af9606013e8dfef2c88225ab39dde906e4bec48f84851bfa9c68bd99aebafefac35c8f99861a58a40deb5c26cb74a5a19374fe7aedef","ssdeep":"384:/QJwEzZkYmHWlAk99RDXjovjCKGzsawRB8icBLu5+r0lKOqke:I1V9mIAedXUvjCKGzHwNx5Vlc","tlshash":"8b82e0fa8aad835fa9b82500f17219d07d8277389cdc7d6dc07818e0bb245963b1f712","first_seen":"2023-05-09T05:29:39Z","last_seen":"2026-08-01T14:23:34.066521Z","times_seen":1205,"resource_available":false,"data":null}},"time_used":450,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":450,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-29","alert":"Sinkholed","trigger":"telegramzh.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/?Spider/\u0026url=/","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:36.691Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegramzh.top","organization":""},"issuer":{"commonName":"sslTrus (RSA) DV CA","organization":"sslTrus"},"validity":{"start":"Fri, 24 Jan 2025 00:00:00 GMT","end":"Sat, 24 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:CC:94:72:16:54:90:DF:91:7C:06:58:6C:18:FC:29:A5:5D:EB:96","sha256":"DB:C0:38:DD:60:AF:CF:66:0D:80:3D:F0:15:30:0B:C1:12:C8:14:ED:60:5E:DF:93:1F:AB:F4:EB:FF:D9:2D:FF"}}},"request":{"raw":"GET /?Spider/\u0026url=/ HTTP/1.1\r\nHost: telegramzh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nCookie: lg=cn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 29 Aug 2025 06:53:36 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\nx-ua-compatible: IE=edge,chrome=1\r\nx-powered-by: PbootCMS\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T19:49:09.059463Z","times_seen":17805050,"resource_available":true,"data":null}},"time_used":446,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":446,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-29","alert":"Sinkholed","trigger":"telegramzh.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.translate.zvo.cn/language.json?v=3.5.1.20240609","fqdn":"api.translate.zvo.cn","domain":"zvo.cn","tld":"cn"},"ip":{"addr":"209.209.10.79","port":443,"asn":26832,"as":"RICAWEBSERVICES","country":"Canada","country_code":"CA"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:37.500Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.translate.zvo.cn","organization":""},"issuer":{"commonName":"ZeroSSL ECC Domain Secure Site CA","organization":"ZeroSSL"},"validity":{"start":"Sun, 20 Jul 2025 00:00:00 GMT","end":"Sat, 18 Oct 2025 23:59:59 GMT"},"fingerprint":{"sha1":"0B:58:AD:DE:2A:10:56:09:3B:6B:32:BC:41:45:FF:B9:66:BD:C6:F8","sha256":"68:72:08:A1:2D:3C:0E:3F:DE:40:B5:FD:DF:AF:A0:48:F8:6A:49:DC:2C:C7:4B:60:75:C0:C6:1B:23:CF:66:CC"}}},"request":{"raw":"OPTIONS /language.json?v=3.5.1.20240609 HTTP/1.1\r\nHost: api.translate.zvo.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: currentpage\r\nReferer: https://telegramzh.top/\r\nOrigin: https://telegramzh.top\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 \r\nServer: nginx/1.24.0\r\nDate: Fri, 29 Aug 2025 06:53:37 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Headers: currentpage\r\nTranslate-Doc: http://translate.zvo.cn\r\nVary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nAllow: GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/json","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T19:49:09.059463Z","times_seen":17805050,"resource_available":true,"data":null}},"time_used":690,"timings":{"blocked":286,"dns":0,"connect":110,"send":0,"wait":110,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-08-29T06:53:34.810Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegramzh.top","organization":""},"issuer":{"commonName":"sslTrus (RSA) DV CA","organization":"sslTrus"},"validity":{"start":"Fri, 24 Jan 2025 00:00:00 GMT","end":"Sat, 24 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:CC:94:72:16:54:90:DF:91:7C:06:58:6C:18:FC:29:A5:5D:EB:96","sha256":"DB:C0:38:DD:60:AF:CF:66:0D:80:3D:F0:15:30:0B:C1:12:C8:14:ED:60:5E:DF:93:1F:AB:F4:EB:FF:D9:2D:FF"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: telegramzh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 29 Aug 2025 06:53:36 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\nx-ua-compatible: IE=edge,chrome=1\r\nx-powered-by: PbootCMS\r\nset-cookie: lg=cn; path=/\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26069,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (938)","md5":"d520669198c79a5a0bf51a0593690844","sha1":"e7ee96e1ac70e4d9cbf9bdedbc82b194f118d7b5","sha256":"1a51c12ef8688a7fd61634f84948b98601917d1dc290c41478382934678b0334","sha512":"92d241f75426fe2cd1bb0f1242c071b64f7de181f242306fcf717e96ff4e4ed4dfe4c8e9b659b2fd9cf202c783c92ec4a816a6f518c2c195e95026ab68b5c127","ssdeep":"384:lAmFPNQ9FK+kxuSAWZJUSQRUs7yF6+CNtif3c4:33Q9FbSAWZJE6CNF4","tlshash":"51c2d51442f4e42260d346ea7669271a7ed9c513ca1b0e42b3fe1ba23fcbf85ce5211d","first_seen":"2025-08-29T06:54:01.374425Z","last_seen":"2025-08-29T06:54:01.374425Z","times_seen":1,"resource_available":false,"data":null}},"time_used":3130,"timings":{"blocked":1484,"dns":501,"connect":152,"send":0,"wait":161,"receive":0,"ssl":828},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-29","alert":"Sinkholed","trigger":"telegramzh.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/template/default/style/images/siteios.jpg","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:37.063Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegramzh.top","organization":""},"issuer":{"commonName":"sslTrus (RSA) DV CA","organization":"sslTrus"},"validity":{"start":"Fri, 24 Jan 2025 00:00:00 GMT","end":"Sat, 24 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:CC:94:72:16:54:90:DF:91:7C:06:58:6C:18:FC:29:A5:5D:EB:96","sha256":"DB:C0:38:DD:60:AF:CF:66:0D:80:3D:F0:15:30:0B:C1:12:C8:14:ED:60:5E:DF:93:1F:AB:F4:EB:FF:D9:2D:FF"}}},"request":{"raw":"GET /template/default/style/images/siteios.jpg HTTP/1.1\r\nHost: telegramzh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nCookie: lg=cn\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 29 Aug 2025 06:53:37 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Fri, 20 Dec 2024 06:52:17 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67651421-7a49\"\r\nexpires: Sun, 28 Sep 2025 06:53:37 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31305,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1], baseline, precision 8, 442x270, components 3","md5":"89486a05599a1cfd549f8fb2d70e7d73","sha1":"24867697525df19b88e79d75ff32384eba57b321","sha256":"5a2c666b6e4f30ff921353cd9a3eccc09b9314c5c5ab11e1a3928936e497b2dc","sha512":"bf59ea2f4cdc21464bce9aba5401c5df0522769f998b432dbc79e7863737b87521e0faa7501dbce72115b256a181b6da2c4f2fdbcdff3e1abbd4f73ac3177714","ssdeep":"768:3OqzWWjlwuxS+TRqYXz7xlPcuYq8KkTwWq7Pku4kz2R:3nr5zdPn8QSkz2R","tlshash":"cae2cf0ba851cc638e8cf3657f056ae9a357296ed31477fc42603c98fb8b38128c52d8","first_seen":"2023-05-09T05:29:39Z","last_seen":"2026-08-05T23:34:55.018266Z","times_seen":1857,"resource_available":false,"data":null}},"time_used":355,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":355,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-29","alert":"Sinkholed","trigger":"telegramzh.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/static/upload/image/20241222/1734839081952311.png","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:37.064Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegramzh.top","organization":""},"issuer":{"commonName":"sslTrus (RSA) DV CA","organization":"sslTrus"},"validity":{"start":"Fri, 24 Jan 2025 00:00:00 GMT","end":"Sat, 24 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:CC:94:72:16:54:90:DF:91:7C:06:58:6C:18:FC:29:A5:5D:EB:96","sha256":"DB:C0:38:DD:60:AF:CF:66:0D:80:3D:F0:15:30:0B:C1:12:C8:14:ED:60:5E:DF:93:1F:AB:F4:EB:FF:D9:2D:FF"}}},"request":{"raw":"GET /static/upload/image/20241222/1734839081952311.png HTTP/1.1\r\nHost: telegramzh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nCookie: lg=cn\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 29 Aug 2025 06:53:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Sun, 22 Dec 2024 03:44:41 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67678b29-bad6\"\r\nexpires: Sun, 28 Sep 2025 06:53:37 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":47830,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 304 x 204, 8-bit/color RGBA, non-interlaced","md5":"7ab78e875b38058db9c1ba09a9fb1482","sha1":"650cd5443e3d2f105cb363de849c19e69ef8ee46","sha256":"ad327c4c9b9498db2e3b0224d432b5ec57b170e93ef9d8fd044de147b22a2248","sha512":"4f546a596f04724e08802de0cd77f35e011e3012674bbd8152b018d03767f44245044703f39aadc6641e4c32b0447f0eee3e9a654f467a929fe694017b3f92c2","ssdeep":"768:Qxb59aEAvYUEsRtOGZXFpKeuKas/sjukxEhhu8KzLEOnlUsozV+wEv/VL:QxH6DEnGZXdWs/sx5v/nl+sZv9L","tlshash":"0623018649b7dc90ff0da4dc6edc83604d18d81d9b97fa7c2b098da1f8e31a5427c686","first_seen":"2025-08-29T06:54:01.378079Z","last_seen":"2025-08-29T06:54:01.378079Z","times_seen":1,"resource_available":false,"data":null}},"time_used":354,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":354,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-29","alert":"Sinkholed","trigger":"telegramzh.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/template/default/style/picture/7a8ed1d4a0484f749700e71637baef6d.gif","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:36.685Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegramzh.top","organization":""},"issuer":{"commonName":"sslTrus (RSA) DV CA","organization":"sslTrus"},"validity":{"start":"Fri, 24 Jan 2025 00:00:00 GMT","end":"Sat, 24 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:CC:94:72:16:54:90:DF:91:7C:06:58:6C:18:FC:29:A5:5D:EB:96","sha256":"DB:C0:38:DD:60:AF:CF:66:0D:80:3D:F0:15:30:0B:C1:12:C8:14:ED:60:5E:DF:93:1F:AB:F4:EB:FF:D9:2D:FF"}}},"request":{"raw":"GET /template/default/style/picture/7a8ed1d4a0484f749700e71637baef6d.gif HTTP/1.1\r\nHost: telegramzh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nCookie: lg=cn\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 29 Aug 2025 06:53:36 GMT\r\ncontent-type: image/gif\r\nlast-modified: Fri, 20 Dec 2024 06:52:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67651420-3192\"\r\nexpires: Sun, 28 Sep 2025 06:53:36 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12690,"size_decoded":0,"mime_type":"image/gif","magic":"PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced","md5":"9c2a194ee50807ae9342b60634be2445","sha1":"553dfd2ba2a5e11468a3b57aba897995f2f4d676","sha256":"ec1788bcdd05595bbcd16e5c7c13bce6481b620ebbc4200b2e6598c02c82aa78","sha512":"27018db71b0a93e3e68e42e0f9dc8528f7c807571c5ed1c1330bb5fac68a1685869bf04043167f885ea413ae6b0ed029cdedce64b1354c0df367603ed0baa67a","ssdeep":"192:qU6SieKSVdeYciqBy/VHaqqtsNEQ8bwRP46NLvDMm5GebYlttyr:qz9e7e3iq+HlHs0qaRkJAr","tlshash":"2542c0d3fc6099d75e4a01e3096faa651879203c2fc0da3f66115967f1dcc3ea7218ca","first_seen":"2023-05-09T05:29:39Z","last_seen":"2026-08-01T14:23:34.174943Z","times_seen":1214,"resource_available":false,"data":null}},"time_used":449,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":449,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-29","alert":"Sinkholed","trigger":"telegramzh.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/template/default/style/picture/a19175b284114bd796d0b30a07b69da1.gif","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:36.688Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegramzh.top","organization":""},"issuer":{"commonName":"sslTrus (RSA) DV CA","organization":"sslTrus"},"validity":{"start":"Fri, 24 Jan 2025 00:00:00 GMT","end":"Sat, 24 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:CC:94:72:16:54:90:DF:91:7C:06:58:6C:18:FC:29:A5:5D:EB:96","sha256":"DB:C0:38:DD:60:AF:CF:66:0D:80:3D:F0:15:30:0B:C1:12:C8:14:ED:60:5E:DF:93:1F:AB:F4:EB:FF:D9:2D:FF"}}},"request":{"raw":"GET /template/default/style/picture/a19175b284114bd796d0b30a07b69da1.gif HTTP/1.1\r\nHost: telegramzh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nCookie: lg=cn\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 29 Aug 2025 06:53:36 GMT\r\ncontent-type: image/gif\r\nlast-modified: Fri, 20 Dec 2024 06:52:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67651420-350b\"\r\nexpires: Sun, 28 Sep 2025 06:53:36 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13579,"size_decoded":0,"mime_type":"image/gif","magic":"PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced","md5":"eb46ced34f8cd5637a3ca911bd12f300","sha1":"a26b44e6e634e4d670a38549033d3539a981e415","sha256":"df53d5b90c9e669236f8593b7fc941a6da753ee8eec79a64c6955a4a67dcb45f","sha512":"8e015b01a7bc62637caf4c7138d256105fc77b227e0108224917b55ae813d7b1b2381371e0ef0b76a27fa9a0d7d2b02a96b0981b7183e433d3fb07a029488c33","ssdeep":"384:YJIBYQNLDhKyY9tWkQqHAKSTSMk8IduPQDvrz:YJIKYlYnWk/VS5k8Su4Dv/","tlshash":"8152c0500866b246bf19f23b7f683c57c7e154880a47e6369421eed180e78c7fb2a32d","first_seen":"2023-05-09T05:29:39Z","last_seen":"2026-08-01T14:23:34.043333Z","times_seen":1148,"resource_available":false,"data":null}},"time_used":448,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":448,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-29","alert":"Sinkholed","trigger":"telegramzh.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/template/default/style/images/all-m.gif","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:37.007Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegramzh.top","organization":""},"issuer":{"commonName":"sslTrus (RSA) DV CA","organization":"sslTrus"},"validity":{"start":"Fri, 24 Jan 2025 00:00:00 GMT","end":"Sat, 24 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:CC:94:72:16:54:90:DF:91:7C:06:58:6C:18:FC:29:A5:5D:EB:96","sha256":"DB:C0:38:DD:60:AF:CF:66:0D:80:3D:F0:15:30:0B:C1:12:C8:14:ED:60:5E:DF:93:1F:AB:F4:EB:FF:D9:2D:FF"}}},"request":{"raw":"GET /template/default/style/images/all-m.gif HTTP/1.1\r\nHost: telegramzh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/template/default/style/css/languji.css\r\nCookie: lg=cn\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 29 Aug 2025 06:53:37 GMT\r\ncontent-type: image/gif\r\nlast-modified: Tue, 25 Jul 2023 03:23:21 GMT\r\nvary: Accept-Encoding\r\netag: W/\"64bf4029-522e\"\r\nexpires: Sun, 28 Sep 2025 06:53:37 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21038,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 22 x 2016","md5":"b8726132b44bf2d413f963d5fdc92726","sha1":"442b61ca9379735852deed4c19698ae8bdcb04b0","sha256":"70d0b146afb1d207a82c02329f64b0ffd6674f8aa1db36467059f02b8f1ecd76","sha512":"62bb4e180c4eec11455e50c59381280e8db7938b325b0fc49d8d8d13cc4cbcbb49d76ade19b264f654d3e6583c4ae60300849a56b5fa3f6eb136029719988258","ssdeep":"384:pqAPWFMedriizOhxHeJ+wxajUaomLDTWfYr9f+rPKxIyoLcBxh6fOaa2OtDvVpTp:IAeFMizO7JcDf4mKxIysLGb2OtDvDt","tlshash":"6792d0a5e960a34874f0e97db8663eb952bfe17105761b300c9c7e56ca31520e162e36","first_seen":"2023-05-17T11:59:02Z","last_seen":"2026-07-21T07:40:19.246363Z","times_seen":68,"resource_available":false,"data":null}},"time_used":407,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":407,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-29","alert":"Sinkholed","trigger":"telegramzh.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.translate.zvo.cn/init.json?v=3.5.1.20240609","fqdn":"api.translate.zvo.cn","domain":"zvo.cn","tld":"cn"},"ip":{"addr":"209.209.10.79","port":443,"asn":26832,"as":"RICAWEBSERVICES","country":"Canada","country_code":"CA"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:37.964Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.translate.zvo.cn","organization":""},"issuer":{"commonName":"ZeroSSL ECC Domain Secure Site CA","organization":"ZeroSSL"},"validity":{"start":"Sun, 20 Jul 2025 00:00:00 GMT","end":"Sat, 18 Oct 2025 23:59:59 GMT"},"fingerprint":{"sha1":"0B:58:AD:DE:2A:10:56:09:3B:6B:32:BC:41:45:FF:B9:66:BD:C6:F8","sha256":"68:72:08:A1:2D:3C:0E:3F:DE:40:B5:FD:DF:AF:A0:48:F8:6A:49:DC:2C:C7:4B:60:75:C0:C6:1B:23:CF:66:CC"}}},"request":{"raw":"POST /init.json?v=3.5.1.20240609 HTTP/1.1\r\nHost: api.translate.zvo.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\ncurrentpage: https://telegramzh.top/\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 0\r\nOrigin: https://telegramzh.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/1.1 200 \r\nServer: nginx/1.24.0\r\nDate: Fri, 29 Aug 2025 06:53:37 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Headers: currentpage\r\nTranslate-Doc: http://translate.zvo.cn\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":129,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"dd2d1a4c34e3fe62a46ac862a8f7dfaa","sha1":"f95514d7fd226d6009a302119167a250760d6423","sha256":"59d22ea59247b7eaa9d5e9f289ccde5f67a6050f57d3e477fb46e34bf0e98df6","sha512":"101a150f8dfa36f679fc758975d5093671598c26016a0a1d359c65f5179031c7dca0161420ca0a57aac11b648d255503b17195d70ce8dcf3d0829f467d56eafa","ssdeep":"","tlshash":"ecb02b44c540cfba1fc0137c68529980113d2181094db21c37fc00224dfc87e410c000","first_seen":"2025-08-21T13:58:55.648096Z","last_seen":"2026-08-04T19:52:44.545634Z","times_seen":544,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":110,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/static/upload/image/20241221/1734765748623094.jpg","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:36.674Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegramzh.top","organization":""},"issuer":{"commonName":"sslTrus (RSA) DV CA","organization":"sslTrus"},"validity":{"start":"Fri, 24 Jan 2025 00:00:00 GMT","end":"Sat, 24 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:CC:94:72:16:54:90:DF:91:7C:06:58:6C:18:FC:29:A5:5D:EB:96","sha256":"DB:C0:38:DD:60:AF:CF:66:0D:80:3D:F0:15:30:0B:C1:12:C8:14:ED:60:5E:DF:93:1F:AB:F4:EB:FF:D9:2D:FF"}}},"request":{"raw":"GET /static/upload/image/20241221/1734765748623094.jpg HTTP/1.1\r\nHost: telegramzh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nCookie: lg=cn\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 29 Aug 2025 06:53:36 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Sat, 21 Dec 2024 07:23:23 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67666ceb-345b6\"\r\nexpires: Sun, 28 Sep 2025 06:53:36 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":214454,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v90), quality = 90\", baseline, precision 8, 1000x633, components 3","md5":"f4b0acf658751890c925aefb02844b87","sha1":"2b8d1e7636314b44f18331d3f4a74e6b134d3e11","sha256":"1a12b703c9e929797d4f3c35503abff5219fad3cd93d063eaae7a77f66f41421","sha512":"bc879b4343731dbbb2b9c145057598137604812338b1d5ba78146ae0f2278898a06a18e7e62462839f0e6e30cef6652121e50c6c1e658593d76a756a5a0b2f33","ssdeep":"6144:4To1786bGYoXlmWF5+3RYClFtD/XYPZvhpM+:ZKEHoXdghBwPZvhpM+","tlshash":"c224235341e072e13dc248bd7069601b0d0ac6dd332332f125689ae67feee6b5b1d9e6","first_seen":"2025-08-29T06:54:01.385818Z","last_seen":"2025-08-29T06:54:01.385818Z","times_seen":1,"resource_available":false,"data":null}},"time_used":453,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":453,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-29","alert":"Sinkholed","trigger":"telegramzh.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/template/default/style/picture/545a2091eed2493b855dc801361df1c4.gif","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:36.680Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegramzh.top","organization":""},"issuer":{"commonName":"sslTrus (RSA) DV CA","organization":"sslTrus"},"validity":{"start":"Fri, 24 Jan 2025 00:00:00 GMT","end":"Sat, 24 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:CC:94:72:16:54:90:DF:91:7C:06:58:6C:18:FC:29:A5:5D:EB:96","sha256":"DB:C0:38:DD:60:AF:CF:66:0D:80:3D:F0:15:30:0B:C1:12:C8:14:ED:60:5E:DF:93:1F:AB:F4:EB:FF:D9:2D:FF"}}},"request":{"raw":"GET /template/default/style/picture/545a2091eed2493b855dc801361df1c4.gif HTTP/1.1\r\nHost: telegramzh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nCookie: lg=cn\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 29 Aug 2025 06:53:36 GMT\r\ncontent-type: image/gif\r\nlast-modified: Fri, 20 Dec 2024 06:52:20 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67651424-3bb6\"\r\nexpires: Sun, 28 Sep 2025 06:53:36 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15286,"size_decoded":0,"mime_type":"image/gif","magic":"PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced","md5":"5f245ac9016657dfafcbdbf61b61e514","sha1":"4033c942a333f667ef26c5d45ed5e233bd83b8b9","sha256":"006d88e7389f56f925cdac325a2d6fc7956bbdcc30e46214bdd97b43274bd78e","sha512":"0be5306b2867b719a1b6736784ab063a6186d7187bb5378fa225e4f6eee5db31e18a56fbf05f2874f02e52c028e74bff6c3ab6854f9cdd821c80d7f8bc4baa3f","ssdeep":"384:LhEEnY6rtlrWDBX5s7eLvvRjx7HFYSTKavK4Pjwglq:NEEXrtlrWDHs7eLRt7Ha4vq","tlshash":"fd62cfd60b8be7d3044b62d8c4a127357756c050ac9d0c734abec2396bcb90f6263aa6","first_seen":"2023-05-09T05:29:39Z","last_seen":"2026-08-01T14:23:34.155649Z","times_seen":1204,"resource_available":false,"data":null}},"time_used":451,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":451,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-29","alert":"Sinkholed","trigger":"telegramzh.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/template/default/style/picture/3fbd27f5926b4320b972cbd5709819d4.gif","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:36.684Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegramzh.top","organization":""},"issuer":{"commonName":"sslTrus (RSA) DV CA","organization":"sslTrus"},"validity":{"start":"Fri, 24 Jan 2025 00:00:00 GMT","end":"Sat, 24 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:CC:94:72:16:54:90:DF:91:7C:06:58:6C:18:FC:29:A5:5D:EB:96","sha256":"DB:C0:38:DD:60:AF:CF:66:0D:80:3D:F0:15:30:0B:C1:12:C8:14:ED:60:5E:DF:93:1F:AB:F4:EB:FF:D9:2D:FF"}}},"request":{"raw":"GET /template/default/style/picture/3fbd27f5926b4320b972cbd5709819d4.gif HTTP/1.1\r\nHost: telegramzh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nCookie: lg=cn\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 29 Aug 2025 06:53:36 GMT\r\ncontent-type: image/gif\r\nlast-modified: Fri, 20 Dec 2024 06:52:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67651422-7767\"\r\nexpires: Sun, 28 Sep 2025 06:53:36 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":30567,"size_decoded":0,"mime_type":"image/gif","magic":"PNG image data, 320 x 320, 8-bit/color RGBA, non-interlaced","md5":"0c6c45ee2597151fa5e955d11d2d38fe","sha1":"771aa6bbe2765cd2d6f754e14d5e12ffc476e939","sha256":"889ddfb8550bac935b0a02e52bef9d0950f0734d7a70661a0930a3d8e6a2f372","sha512":"bb4808e6b52f06991e9fbeb6e6e0d64b0afb4e87076a9cad8543494605cd2d0dc2f1d0007bf8c588c5e7682a87ea63f83bcc6f9c847dd60b3e3024cb39bbbd85","ssdeep":"768:pYweyGgLyxCaJ1leoVAqIuOlHPUfFbqqxViqR58IWE1:pX2eaLzOlvEAqxhR1","tlshash":"54d2e187ea13e50d3e4d83956dffb092007a172e49ee2dfb8871719217c6369413d9e4","first_seen":"2023-05-15T10:52:59Z","last_seen":"2026-08-01T14:23:34.103705Z","times_seen":918,"resource_available":false,"data":null}},"time_used":449,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":449,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-29","alert":"Sinkholed","trigger":"telegramzh.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.translate.zvo.cn/connectTest.json","fqdn":"api.translate.zvo.cn","domain":"zvo.cn","tld":"cn"},"ip":{"addr":"209.209.10.79","port":443,"asn":26832,"as":"RICAWEBSERVICES","country":"Canada","country_code":"CA"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:37.921Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.translate.zvo.cn","organization":""},"issuer":{"commonName":"ZeroSSL ECC Domain Secure Site CA","organization":"ZeroSSL"},"validity":{"start":"Sun, 20 Jul 2025 00:00:00 GMT","end":"Sat, 18 Oct 2025 23:59:59 GMT"},"fingerprint":{"sha1":"0B:58:AD:DE:2A:10:56:09:3B:6B:32:BC:41:45:FF:B9:66:BD:C6:F8","sha256":"68:72:08:A1:2D:3C:0E:3F:DE:40:B5:FD:DF:AF:A0:48:F8:6A:49:DC:2C:C7:4B:60:75:C0:C6:1B:23:CF:66:CC"}}},"request":{"raw":"POST /connectTest.json HTTP/1.1\r\nHost: api.translate.zvo.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\ncontent-type: application/x-www-form-urlencoded\r\ncurrentpage: https://telegramzh.top/\r\nContent-Length: 34\r\nOrigin: https://telegramzh.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/1.1 200 \r\nServer: nginx/1.24.0\r\nDate: Fri, 29 Aug 2025 06:53:37 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Headers: currentpage\r\nTranslate-Doc: http://translate.zvo.cn\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":51,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"bc3c595c41a4b5f2d807cccfcc657c8b","sha1":"847377d95d94c996f92e21fee12fc0046d133f7f","sha256":"a670968373e972f89338087f326333d31360fb696807844101b789451d98300e","sha512":"dafba05edc6d32bb5614884206df34cf9168db09bbae1e083a64abd0adbfafef1ee9647f5421bd168720be704aed3b8f4bf1d52fe9abed2f06eedf6862b3c1f7","ssdeep":"","tlshash":"4a9002d25a915906a240158a95491186540aa10a0f66d902566644471c70464164f214","first_seen":"2024-01-21T01:54:45Z","last_seen":"2026-08-05T11:21:24.82396Z","times_seen":658,"resource_available":false,"data":null}},"time_used":514,"timings":{"blocked":-1,"dns":6,"connect":112,"send":0,"wait":110,"receive":0,"ssl":175},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/template/default/style/css/telegram.css","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:36.667Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegramzh.top","organization":""},"issuer":{"commonName":"sslTrus (RSA) DV CA","organization":"sslTrus"},"validity":{"start":"Fri, 24 Jan 2025 00:00:00 GMT","end":"Sat, 24 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:CC:94:72:16:54:90:DF:91:7C:06:58:6C:18:FC:29:A5:5D:EB:96","sha256":"DB:C0:38:DD:60:AF:CF:66:0D:80:3D:F0:15:30:0B:C1:12:C8:14:ED:60:5E:DF:93:1F:AB:F4:EB:FF:D9:2D:FF"}}},"request":{"raw":"GET /template/default/style/css/telegram.css HTTP/1.1\r\nHost: telegramzh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nCookie: lg=cn\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 29 Aug 2025 06:53:36 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 28 Dec 2024 03:14:56 GMT\r\nvary: Accept-Encoding\r\netag: W/\"676f6d30-1bfc6\"\r\nexpires: Fri, 29 Aug 2025 18:53:36 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":114630,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1267), with CRLF line terminators","md5":"36bdf495bd6bdbaa3e43ab3565f516bd","sha1":"cd3a2092319c3efaa91320452937c7e6e6d6617c","sha256":"f9b1695c378d2400a5175bb3ffcf364e465ffbf2e1d3484681f909b678ad4ec3","sha512":"64e3b555d1dd50a6363d4846a32afb159e70aaa00ea3aa7c451b5fc6e2b32bdeb14040edd612662e0238affe1624d18467275f0a39e8607b56b452a812f1471c","ssdeep":"768:r6eFQxnyWm53br/sSYgFDG8QF+1foBOogrrr9btpB43Zqe:rsyWW9YgFDH1fjogltpBWqe","tlshash":"38b3958dca2491046177cb74bba34b52be7a0093eb42077ebbf56455a3869d84233fcd","first_seen":"2025-08-29T06:54:01.390752Z","last_seen":"2025-08-29T06:54:01.390752Z","times_seen":1,"resource_available":false,"data":null}},"time_used":154,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":154,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-29","alert":"Sinkholed","trigger":"telegramzh.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/template/default/style/images/twitter.png","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:37.049Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegramzh.top","organization":""},"issuer":{"commonName":"sslTrus (RSA) DV CA","organization":"sslTrus"},"validity":{"start":"Fri, 24 Jan 2025 00:00:00 GMT","end":"Sat, 24 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:CC:94:72:16:54:90:DF:91:7C:06:58:6C:18:FC:29:A5:5D:EB:96","sha256":"DB:C0:38:DD:60:AF:CF:66:0D:80:3D:F0:15:30:0B:C1:12:C8:14:ED:60:5E:DF:93:1F:AB:F4:EB:FF:D9:2D:FF"}}},"request":{"raw":"GET /template/default/style/images/twitter.png HTTP/1.1\r\nHost: telegramzh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nCookie: lg=cn\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 29 Aug 2025 06:53:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 20 Dec 2024 06:52:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67651420-4f8\"\r\nexpires: Sun, 28 Sep 2025 06:53:37 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1272,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 21 x 17, 8-bit/color RGBA, non-interlaced","md5":"1ed9bf7633f4f449c8d2df94ea0eb35f","sha1":"2902ba9c2b127c74c2550298a0578d7d8da941c2","sha256":"e7d23b06a4ffd600558e5443d1e32daaaf13a27cf7bb8b7cc163a92b4054aaf2","sha512":"51dd36178dd85f062fee20903a4f0981ca34eb24a7e7245191ef43d493cd47f756389e548a731109f1c0463ba3bd1d3d4f7c4c623639b9514eb2fb9619124f07","ssdeep":"","tlshash":"c6218409f6505401c164e8c234fe416ade3209c0d5d5f56d658fc85f1d281fb687cbeb","first_seen":"2023-05-09T05:29:39Z","last_seen":"2026-08-05T23:34:55.023611Z","times_seen":2083,"resource_available":false,"data":null}},"time_used":365,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":365,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-29","alert":"Sinkholed","trigger":"telegramzh.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/static/upload/image/20241222/1734839161574337.png","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:37.065Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegramzh.top","organization":""},"issuer":{"commonName":"sslTrus (RSA) DV CA","organization":"sslTrus"},"validity":{"start":"Fri, 24 Jan 2025 00:00:00 GMT","end":"Sat, 24 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:CC:94:72:16:54:90:DF:91:7C:06:58:6C:18:FC:29:A5:5D:EB:96","sha256":"DB:C0:38:DD:60:AF:CF:66:0D:80:3D:F0:15:30:0B:C1:12:C8:14:ED:60:5E:DF:93:1F:AB:F4:EB:FF:D9:2D:FF"}}},"request":{"raw":"GET /static/upload/image/20241222/1734839161574337.png HTTP/1.1\r\nHost: telegramzh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nCookie: lg=cn\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 29 Aug 2025 06:53:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Sun, 22 Dec 2024 03:46:01 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67678b79-e509\"\r\nexpires: Sun, 28 Sep 2025 06:53:37 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":58633,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 304 x 204, 8-bit/color RGBA, non-interlaced","md5":"94149624dae9429811e3080808348c76","sha1":"c6d4e51968ab4123b7ee83364c9a43ced5495469","sha256":"2cfb17b0245f20fd4478457743a3a0fab5a70b6b90c2ff04492f42008544bc37","sha512":"6874c229890c145f74c520966c3e9e0b45108a5a0d53b11d8bb811801e4f2184e498495de15a4b721791e57db9f27f76a2e952589e599209d53b10e50c02c088","ssdeep":"1536:Eo8Vn3L9RdgPaXj9PAcRs05VZGYEr3UGrWScMZNuLlcHRaARIZ:tk3xRdgypYih5VZGBWSNNu2xaARG","tlshash":"c843024ae858c74f431bbba49050f38869aafbf85d546c71fa140e113a2fd6937a350b","first_seen":"2025-08-29T06:54:01.393581Z","last_seen":"2025-08-29T06:54:01.393581Z","times_seen":1,"resource_available":false,"data":null}},"time_used":353,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":353,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-29","alert":"Sinkholed","trigger":"telegramzh.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.translate.zvo.cn/init.json?v=3.5.1.20240609","fqdn":"api.translate.zvo.cn","domain":"zvo.cn","tld":"cn"},"ip":{"addr":"209.209.10.79","port":443,"asn":26832,"as":"RICAWEBSERVICES","country":"Canada","country_code":"CA"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:37.501Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.translate.zvo.cn","organization":""},"issuer":{"commonName":"ZeroSSL ECC Domain Secure Site CA","organization":"ZeroSSL"},"validity":{"start":"Sun, 20 Jul 2025 00:00:00 GMT","end":"Sat, 18 Oct 2025 23:59:59 GMT"},"fingerprint":{"sha1":"0B:58:AD:DE:2A:10:56:09:3B:6B:32:BC:41:45:FF:B9:66:BD:C6:F8","sha256":"68:72:08:A1:2D:3C:0E:3F:DE:40:B5:FD:DF:AF:A0:48:F8:6A:49:DC:2C:C7:4B:60:75:C0:C6:1B:23:CF:66:CC"}}},"request":{"raw":"OPTIONS /init.json?v=3.5.1.20240609 HTTP/1.1\r\nHost: api.translate.zvo.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: currentpage\r\nReferer: https://telegramzh.top/\r\nOrigin: https://telegramzh.top\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 \r\nServer: nginx/1.24.0\r\nDate: Fri, 29 Aug 2025 06:53:37 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Headers: currentpage\r\nTranslate-Doc: http://translate.zvo.cn\r\nVary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nAllow: GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/json","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-09T19:49:09.059463Z","times_seen":17805050,"resource_available":true,"data":null}},"time_used":689,"timings":{"blocked":284,"dns":1,"connect":111,"send":0,"wait":110,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.translate.zvo.cn/language.json?v=3.5.1.20240609","fqdn":"api.translate.zvo.cn","domain":"zvo.cn","tld":"cn"},"ip":{"addr":"209.209.10.79","port":443,"asn":26832,"as":"RICAWEBSERVICES","country":"Canada","country_code":"CA"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:37.966Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.translate.zvo.cn","organization":""},"issuer":{"commonName":"ZeroSSL ECC Domain Secure Site CA","organization":"ZeroSSL"},"validity":{"start":"Sun, 20 Jul 2025 00:00:00 GMT","end":"Sat, 18 Oct 2025 23:59:59 GMT"},"fingerprint":{"sha1":"0B:58:AD:DE:2A:10:56:09:3B:6B:32:BC:41:45:FF:B9:66:BD:C6:F8","sha256":"68:72:08:A1:2D:3C:0E:3F:DE:40:B5:FD:DF:AF:A0:48:F8:6A:49:DC:2C:C7:4B:60:75:C0:C6:1B:23:CF:66:CC"}}},"request":{"raw":"POST /language.json?v=3.5.1.20240609 HTTP/1.1\r\nHost: api.translate.zvo.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\ncontent-type: application/x-www-form-urlencoded\r\ncurrentpage: https://telegramzh.top/\r\nContent-Length: 0\r\nOrigin: https://telegramzh.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/1.1 200 \r\nServer: nginx/1.24.0\r\nDate: Fri, 29 Aug 2025 06:53:38 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Headers: currentpage\r\nTranslate-Doc: http://translate.zvo.cn\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7542,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"0776877073726a6887b89d6965e86459","sha1":"4ca37c0dafe7f9419c49b173c74a3db47f485c4b","sha256":"512402f030cad51d757daa01ab1b07bb33a24e4a657609b2c0e575078ad6d33f","sha512":"433d96844245ec8e66756f85c397e9665969212f000a40e0c3fb5f573b72064827482e7efe20fa351b609c746640774e7659e366079c787052bee8135ad08658","ssdeep":"192:FB+lokcVPNeSlLbrmSt4Ix1JsqkMEZ+Lkd2ZUE:mo/1N1lXySvPjkPZ+AdEUE","tlshash":"73f1658e05d41dbf97483a3a9c8f07ac28582056f28dbf4a5af90e4841cffd95131bb6","first_seen":"2025-08-21T13:58:55.649352Z","last_seen":"2025-10-12T23:52:00.682451Z","times_seen":9,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":110,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/template/default/style/js/jquery.min.js","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:36.668Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegramzh.top","organization":""},"issuer":{"commonName":"sslTrus (RSA) DV CA","organization":"sslTrus"},"validity":{"start":"Fri, 24 Jan 2025 00:00:00 GMT","end":"Sat, 24 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:CC:94:72:16:54:90:DF:91:7C:06:58:6C:18:FC:29:A5:5D:EB:96","sha256":"DB:C0:38:DD:60:AF:CF:66:0D:80:3D:F0:15:30:0B:C1:12:C8:14:ED:60:5E:DF:93:1F:AB:F4:EB:FF:D9:2D:FF"}}},"request":{"raw":"GET /template/default/style/js/jquery.min.js HTTP/1.1\r\nHost: telegramzh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nCookie: lg=cn\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 29 Aug 2025 06:53:36 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 19 Nov 2024 08:43:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"673c4fc4-17692\"\r\nexpires: Fri, 29 Aug 2025 18:53:36 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":95890,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (32047), with CRLF line terminators","md5":"60f3317e844d9d135aba49ffee394a40","sha1":"672dd49b982c5ce98bcec0cd0449487feb6fa1a8","sha256":"7b7de2f5bc4f6b4644a79b2e1e2b16072c60a2942f8d9fe6e5926ed0232f951f","sha512":"74bbf4655ede4c71904c3d24892cb7769cff98ea5fbf9b2b043ae2a94f2e0fa22a2e12e95da7229e3192a54e599470bbcde2e617bdc11e5e35c23cf3ebe8c102","ssdeep":"1536:XP1vk7i6GUHdXXeyQazBu+4HhiO2AEeLyFoqqhJ7SerN5sVI6xcBvPv7E+nzms9e:K4UddqhJvNPqcBH7MfWWca98HrK","tlshash":"9793d8d9b7d67062977730b850bf510bb13a98eab80c4c60f1a4d8e47e74a89507bf2d","first_seen":"2025-08-29T06:54:01.396915Z","last_seen":"2025-08-29T06:54:01.396915Z","times_seen":1,"resource_available":true,"data":null}},"time_used":305,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":305,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-29","alert":"Sinkholed","trigger":"telegramzh.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/static/upload/image/20241221/1734765636719220.jpg","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:36.675Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegramzh.top","organization":""},"issuer":{"commonName":"sslTrus (RSA) DV CA","organization":"sslTrus"},"validity":{"start":"Fri, 24 Jan 2025 00:00:00 GMT","end":"Sat, 24 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:CC:94:72:16:54:90:DF:91:7C:06:58:6C:18:FC:29:A5:5D:EB:96","sha256":"DB:C0:38:DD:60:AF:CF:66:0D:80:3D:F0:15:30:0B:C1:12:C8:14:ED:60:5E:DF:93:1F:AB:F4:EB:FF:D9:2D:FF"}}},"request":{"raw":"GET /static/upload/image/20241221/1734765636719220.jpg HTTP/1.1\r\nHost: telegramzh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nCookie: lg=cn\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 29 Aug 2025 06:53:36 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Sat, 21 Dec 2024 07:20:36 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67666c44-121ef\"\r\nexpires: Sun, 28 Sep 2025 06:53:36 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":74223,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 600x361, components 3","md5":"14690dac5b47a4893b2047e26bb74b23","sha1":"4c3ab20d602eeeaee8022104b348a0ec8cc152c3","sha256":"b59be62eb3271ad569eee9bd5bae97185c990c37b46f2475973383d7576f27b8","sha512":"9c43476b96fdafb7ddb4556d3468c6be140bcebb26133a1a2127af55e7d050ff734a89f1758c628001f74d4f2d7951ba4015e8b617ab081fcc26c1adadb5d497","ssdeep":"1536:N+Z+lFSkedu+RDm6cbTwI/TG4cNVKnbpVR2VDipLNzgPW1aGwEnMT+VkWEHj4j86:N+wSfdFcbkSKOuDi55gCaGoCDEH+","tlshash":"d7730295b552ae99d070a10623bff768f80ab1e0753c45caf8f4976cd8322b3495bed0","first_seen":"2025-08-29T06:54:01.398854Z","last_seen":"2025-08-29T06:54:01.398854Z","times_seen":1,"resource_available":false,"data":null}},"time_used":453,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":453,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-29","alert":"Sinkholed","trigger":"telegramzh.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegramzh.top/template/default/style/picture/8139da257da74a38a39bbc9bef363f16.gif","fqdn":"telegramzh.top","domain":"telegramzh.top","tld":"top"},"ip":{"addr":"38.47.255.99","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegramzh.top/","date":"2025-08-29T06:53:36.686Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"telegramzh.top","organization":""},"issuer":{"commonName":"sslTrus (RSA) DV CA","organization":"sslTrus"},"validity":{"start":"Fri, 24 Jan 2025 00:00:00 GMT","end":"Sat, 24 Jan 2026 23:59:59 GMT"},"fingerprint":{"sha1":"18:CC:94:72:16:54:90:DF:91:7C:06:58:6C:18:FC:29:A5:5D:EB:96","sha256":"DB:C0:38:DD:60:AF:CF:66:0D:80:3D:F0:15:30:0B:C1:12:C8:14:ED:60:5E:DF:93:1F:AB:F4:EB:FF:D9:2D:FF"}}},"request":{"raw":"GET /template/default/style/picture/8139da257da74a38a39bbc9bef363f16.gif HTTP/1.1\r\nHost: telegramzh.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegramzh.top/\r\nCookie: lg=cn\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 29 Aug 2025 06:53:36 GMT\r\ncontent-type: image/gif\r\nlast-modified: Fri, 20 Dec 2024 06:52:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67651420-3d7c\"\r\nexpires: Sun, 28 Sep 2025 06:53:36 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15740,"size_decoded":0,"mime_type":"image/gif","magic":"PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced","md5":"4e59e61b2a0205e09dafad24da174530","sha1":"0dc2adba2fbe4f1cd195364ef4f1ab4dc1641993","sha256":"269f20eb63db3ece8035886ebc69112ef94339da867d47f815237800555e508a","sha512":"8ee876a60c4d511beb1229678e34d5f91c34dd8eda4cf792dc521db76cb8338480b3c265181b3afb7446d3992e243d590a09494cb8e10fc4268022181babda28","ssdeep":"384:AwIpVA9llRR/+5BrSOxNbCGcIvTeSEHIGbi24fe:8Vul+5BrPtIIvTeSEHRiV2","tlshash":"e562d0c5d117242430b822b7c7fb936136e6b90fa3b1354b907a994112c74bec3deab5","first_seen":"2023-05-09T05:29:39Z","last_seen":"2026-08-01T14:23:34.16231Z","times_seen":1148,"resource_available":false,"data":null}},"time_used":448,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":448,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-08-29","alert":"Sinkholed","trigger":"telegramzh.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}