{"report_id":"767d0feb-dfa4-4e49-9eb7-486319743c82","version":0,"status":"done","tags":["botpanel","malware","crypto","phishing"],"date":"2026-06-08T03:17:00Z","url":{"schema":"http","addr":"www.zh-metamask.com/","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":0,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"final":{"url":{"schema":"https","addr":"www.zh-metamask.com/","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"title":"MetaMask官方网站 | 小狐狸钱包官网 | MetaMask下载app最新安卓苹果ios安装 | MetaMask Wallet","dom":{"size":20217,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (448)","md5":"32c9042a1fca8fc23b2c9c284132af9d","sha1":"261f7ac4c5e40fe998369ff12e19e0afc53bc9ad","sha256":"79ad11ab09645cc1cdb94b4937056eced3f6838b5814ba564be16ed8e7968964","sha512":"c5dcecfa15a53da6ff387c1b1bf6fe4053201ec69116bdb75e932dced516642f49e6d0affe0899e56f5f49ff8b32fb54d898078a331932517795b08289a0b45f","ssdeep":"384:YT7Dt6ay1tVKOwhVtKdRwVtPgtOny4s53N+5rwJR4s53egrwi44s53aErwp04s58:YT7Amac/UvOJ2Rc5xMlMG9","tlshash":"3392841168cc5dff120756d671247b7de0af9f72cd2384a3f2b74205a6e2e62943a493","dom_hash":"domhash4d727667caee85abd5240b00f5c251c6","first_seen":"2026-06-08T03:17:07.31554Z","last_seen":"2026-06-08T03:17:07.31554Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"www.zh-metamask.com/","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":0,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-07-13T03:17:00Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":3,"analyzer":5}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Malware - Botnet panel","verdict":"malware","severity":"medium","comment":"Associated with Botnet webpanel","tags":["botpanel","malware"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]},"summary":[{"fqdn":"www.zh-metamask.com","ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"domain_registered":"2024-05-11","domain_rank":0,"first_seen":"2025-04-30T12:18:08.658594Z","last_seen":"2025-11-30T17:59:09.561241Z","alert_count":203,"request_count":38,"received_data":2467233,"sent_data":22426,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Google Analytics","description":"Google Analytics is a free web analytics service that tracks and reports website traffic.","website":"https://google.com/analytics","common_platform_enumeration":"","icon":"Google Analytics.svg","categories":["Analytics"]},{"name":"bowser:1.9.4","description":"A small, fast and rich-API browser/platform/engine detector for both browser and node.","website":"https://opencollective.com/bowser","common_platform_enumeration":"","icon":"","categories":["JavaScript libraries"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery:3.5.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]}]},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-06-07T22:40:26.930816Z","alert_count":0,"request_count":1,"received_data":8891,"sent_data":508,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"www.googletagmanager.com","ip":{"addr":"142.250.178.104","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2011-11-11","domain_rank":283,"first_seen":"2012-10-04T01:07:32Z","last_seen":"2026-06-07T22:29:27.813409Z","alert_count":0,"request_count":1,"received_data":367394,"sent_data":483,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Malware - Botnet panel","verdict":"malware","severity":"medium","comment":"Associated with Botnet webpanel","tags":["botpanel","malware"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/js/jquery.min.js","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"introduction_type":"scriptElement","is_inline":false,"md5":"3a728460147fb9af7faf0e587b9fbf42","sha1":"f3a55f44fb81cf8ee908a3872841f70d6548f8c1","sha256":"8c574e0a06396dfa7064b8b460e0e4a8d5d0748c4aa66eb2e4efdfcb46da4b31","sha512":"c6326be84aed0d20ae924246119b19ce4fd705f967d46c6c9dd89b1180984163f0708b9e0e8917f319304bf617f3c35d83657fcbfae1340bc34e689f0961c6a5","ssdeep":"1536:DYUqmRbwh3Kvk8QRExoulFTz7bkKz1A+uezbp9Bl+u5x/90yWZmnEJSxy3Y6nRwT:qSi3a7PxkKmO8MP63vkxEyUtCu+","tlshash":"5293d7e972d6716387b730a850af510bb13698e6b80c8c60f058d9e47e74e49a07bf7d","size":92555,"data":"","first_seen":"2023-03-07T01:02:06Z","last_seen":"2026-08-08T23:55:45.839122Z","times_seen":1927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/js/webflow.js","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"introduction_type":"scriptElement","is_inline":false,"md5":"631a7d3ebb657b0926e21d4c95002e25","sha1":"6745523a5233813bdafbba412ff43afa6199c737","sha256":"94b3185eff8d48c0db402f227d910832d0ea342b6018db0cbea95577509fd161","sha512":"61532d8df2d7f32efbfd126c676967f4c2fcdfc085c62e75b96f68a408342e08f6976f8f1e472b1b047ede2b189d874a2a1d15c7aca8d9ab48c7258a47fb0034","ssdeep":"6144:ui/F2d9aGkD1vCAcFFAoldAPt9W6MaT1IMOZKL:Ba0GBGPq6t15RL","tlshash":"2ac41b897251707902d60269d01f1907f337266aa00ec89cf669d8ee6dbcddd2277f3a","size":565891,"data":"","first_seen":"2023-03-07T14:39:03Z","last_seen":"2026-07-19T04:54:36.742533Z","times_seen":91,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"introduction_type":"scriptElement","is_inline":true,"md5":"2a1421cb2f9aad07d4037de7d08c1a06","sha1":"63fabda9823acc9bccdea84b031ee03e15e40c15","sha256":"a74f6645fc0ce5126c0565814f95787fe2ed7458f9f17887f67b8c796ac4934e","sha512":"f548a371810bdaf5e05b44a2dd852c0394a2d9fc96bfd219e1da976e5a9937b69823c72899ad6c3ef14cc7c1db13d9ffcc710666995fc9bd91e54c1f0826410d","ssdeep":"","tlshash":"9dd022fbf76ca85b509f382c0e0e29cd583e05b39c000d6bb4182dc0b89883c004ca03","size":207,"data":"","first_seen":"2026-06-08T03:17:07.349996Z","last_seen":"2026-07-19T04:54:36.746794Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"introduction_type":"scriptElement","is_inline":true,"md5":"d09a9d2f89929c2ccfe876e5f9aae3c3","sha1":"4f367ce46a1ea2241f467857c0218ca9efb53750","sha256":"2d412c31b238db08938afdcbb7a089ca516e4c387f8aa9c81c821e8f54af5ad0","sha512":"dbad26fb74b0115caae68984e94ebd5cc287d5bf6ac788c24d6c514037a0e960b07263fba20342173d8ae233505024e7fe846422a265836268439a6036ca0c3b","ssdeep":"","tlshash":"30d02bd66cccfa05e1e200cc382fb11c9b2f280499a69804dbb4de3ea54f321142b92d","size":269,"data":"","first_seen":"2026-06-08T03:17:07.350819Z","last_seen":"2026-06-08T03:17:07.350819Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"introduction_type":"scriptElement","is_inline":true,"md5":"2a1421cb2f9aad07d4037de7d08c1a06","sha1":"63fabda9823acc9bccdea84b031ee03e15e40c15","sha256":"a74f6645fc0ce5126c0565814f95787fe2ed7458f9f17887f67b8c796ac4934e","sha512":"f548a371810bdaf5e05b44a2dd852c0394a2d9fc96bfd219e1da976e5a9937b69823c72899ad6c3ef14cc7c1db13d9ffcc710666995fc9bd91e54c1f0826410d","ssdeep":"","tlshash":"9dd022fbf76ca85b509f382c0e0e29cd583e05b39c000d6bb4182dc0b89883c004ca03","size":207,"data":"","first_seen":"2026-06-08T03:17:07.349996Z","last_seen":"2026-07-19T04:54:36.746794Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"introduction_type":"scriptElement","is_inline":true,"md5":"d09a9d2f89929c2ccfe876e5f9aae3c3","sha1":"4f367ce46a1ea2241f467857c0218ca9efb53750","sha256":"2d412c31b238db08938afdcbb7a089ca516e4c387f8aa9c81c821e8f54af5ad0","sha512":"dbad26fb74b0115caae68984e94ebd5cc287d5bf6ac788c24d6c514037a0e960b07263fba20342173d8ae233505024e7fe846422a265836268439a6036ca0c3b","ssdeep":"","tlshash":"30d02bd66cccfa05e1e200cc382fb11c9b2f280499a69804dbb4de3ea54f321142b92d","size":269,"data":"","first_seen":"2026-06-08T03:17:07.350819Z","last_seen":"2026-06-08T03:17:07.350819Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=UA-37075177-6","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.178.104","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"27754f2ad8594d8790db215c3e17a203","sha1":"c37740250e4ae3ef28796ff1712006c15974c25e","sha256":"d9a62d77449d9eb19d58edb59a8706c58022ccde2d016768014143fe9c4d7c57","sha512":"6d611996ef1143b528603e62b7638447048e7f38f6a2b3f32cd53926694b72482a87924a0e5670e09b4a83b41634aee6f13bf92a5a5f064910138bcfceb9505b","ssdeep":"6144:Zf3GsHPjgbP4V2pYW0w40dicSF2Ks5vAXgNR4Q:ZM41cKEAX+","tlshash":"307408cdb3d674629393a478903f018bb23a79d2f848c898f186d8d42e7465a4277f7d","size":366744,"data":"","first_seen":"2026-06-08T03:17:07.339006Z","last_seen":"2026-06-08T03:17:07.339006Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/weihu/","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"introduction_type":"scriptElement","is_inline":true,"md5":"ad7275f4a7ce3e6e4cd1232867349a9c","sha1":"50bbc7727c236c9339e15258fcd8e350f4879519","sha256":"d54690f5ac17e8a419581062b90119d58f2f39128d2555a539b5820d1145d141","sha512":"b4238ce4ad3b17c5330ce910473459c48dae30aa331fb0984c11f1bbdf6180d1745d2e0675e4ab8e1495c2ef3c22166a66636eb7c16e0bf9d9f0e272799e393b","ssdeep":"","tlshash":"1601261d97e291b1ee2371f51b4fe406ba3a14430008ba0bb80d0b94ffc583887b6f80","size":823,"data":"","first_seen":"2026-05-26T00:05:21.157205Z","last_seen":"2026-08-11T05:45:44.537281Z","times_seen":253,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/bowser/1.9.4/bowser.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"557e1db8c44d751c997a04f411a61598","sha1":"849afb67561b75e90bc3ca310db3a82742a064ac","sha256":"b52f6b6011741e76cefa2be41164bbc9b33bba334b9ad15b03abad37b609d983","sha512":"71f29b4aa47197ea065990fc2ea159309ea71b845f8bb518465fc9c6f84de161160f9066bcc0b84af5923e500aeeb6c241302b9c4c9a161578c7f04708be98a7","ssdeep":"192:zrtNwo1ZAhquwmrYTtZtqhrJQcgm7RgsedRZ:zrtNwo1ZAhquwMYTtZtqhrJQcgmqsmZ","tlshash":"e1f123ece54fa4fb48f46706584e21381bb0c8324d7f9e51be8ce151ea59cad443aba0","size":7901,"data":"","first_seen":"2023-03-07T12:12:07Z","last_seen":"2026-08-05T19:50:05.416791Z","times_seen":546,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/js/jquery-3.5.1.min.dc5e7f18c8.js","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"introduction_type":"scriptElement","is_inline":false,"md5":"dc5e7f18c8d36ac1d3d4753a87c98d0a","sha1":"c8e1c8b386dc5b7a9184c763c88d19a346eb3342","sha256":"f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d","sha512":"6cb4f4426f559c06190df97229c05a436820d21498350ac9f118a5625758435171418a022ed523bae46e668f9f8ea871feab6aff58ad2740b67a30f196d65516","ssdeep":"1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakF:AYh8eip3huuf6IidlrvakdtQ47GK1","tlshash":"a993f9ddb2c6702257a720ba007f510bf236199d6c4d8450f265d8e9bcb8a4e827bf7d","size":89476,"data":"","first_seen":"2023-03-07T01:02:01Z","last_seen":"2026-08-11T11:27:14.604084Z","times_seen":266301,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"aaaa","filename":"https://www.zh-metamask.com/","line_number":0,"column_number":0}]},"http":[{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/images/mm-logo.svg","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.212Z","timestamp":1780888597212,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /template/pc/images/mm-logo.svg HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 3369\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Mon, 16 Aug 2021 01:00:56 GMT\r\netag: \"2ef3-5c9a2bbc9c200-gzip\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: MISS\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12019,"size_decoded":3687,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"51bcea2625eb2c6e9268a7377a792c86","sha1":"5eeb306e6584eed1747c36c11724f193711d430e","sha256":"5e722754f038988ba4b6d7f380d60191eba3b6e01d4a00749a28b79c53521f5b","sha512":"b70f1531c4d61f0494b516da54af09eabaec98a040993052dc63e39ac7d45e1dd112f5dc898dbfe57f77e5ee60ed8acf31b0b4eca8451fe93f77a962026dc742","ssdeep":"192:7h/+7QQKF3oE3WAiq4rKp/svCULRoWBkiCcxj4kPeErXoXDK:7F+7Qb3oCK+xsvtoWBKcxj4kPeErXoX2","tlshash":"b8421fdd37a85dacb923c7a9e3053136302608fb2a95d364c9736a78692221d9d7fcc4","first_seen":"2023-04-08T08:49:53Z","last_seen":"2026-07-19T04:54:36.703137Z","times_seen":1268,"resource_available":false,"data":null}},"time_used":620,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":620,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/fonts/EuclidCircularB-Bold-WebXL.woff2","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.638Z","timestamp":1780888597638,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /template/pc/fonts/EuclidCircularB-Bold-WebXL.woff2 HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/template/pc/css/metamask-staging-2.webflow.css\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 44544\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Mon, 16 Aug 2021 01:02:26 GMT\r\netag: \"ae00-5c9a2c1270c80\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\nserver: nginx\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":44544,"size_decoded":44809,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 44544, version 3.66","md5":"9024d0bf73943172297c4628d0054e20","sha1":"36c3795e7b297d06589e15ef59592683d9ed0974","sha256":"88fad87880ae6bb0d733c967419d5f0d68da547a88ad67e7af41f18dae2e20df","sha512":"3b621d07add00dcbbefa4b14279c78260d361b9848226d472780896865ecdb0c5096b1ad013ed114ad6c9b5fc60814cd678fd124d5265e9479abc2730cbf9bd6","ssdeep":"768:OYwXmLSu2ENQ2CMecobgGcYjYHI5FhZF2UIlN9/j7gAfHxiPiX0gaIutLAP:OYUm1NQ5gGPZF2UI397nEPinanA","tlshash":"1513e1e1f7961a8e4e500f3e236083be577c1469ff3349866588276d2ba51bf2073c56","first_seen":"2023-04-13T20:09:28Z","last_seen":"2026-08-03T15:51:51.461118Z","times_seen":783,"resource_available":false,"data":null}},"time_used":473,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":472,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/assets/css/style.css","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.164Z","timestamp":1780888597164,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /template/pc/assets/css/style.css HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: text/css\r\ncontent-length: 7432\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Sat, 18 Nov 2023 10:50:46 GMT\r\netag: \"e670-60a6b066f4d80-gzip\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: MISS\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58992,"size_decoded":7745,"mime_type":"text/css","magic":"ASCII text","md5":"21cfc54461c82560898a413640421c2f","sha1":"be1c6b32e84eb07d73ff6f39ae71ade5a4374309","sha256":"7160b277f45169349b34eb3c4a05f5a8b2a3cfc0e28ff276c406117dd587028b","sha512":"49d38e4ec8e54f4ba95f1797a0bcb0977ab5b66aa31e051cf0c0ae3f43f9e71bc12e24c02da88393b89f45b35eb53431dab1734d912881fec794f67b6cb2ef8c","ssdeep":"768:V0SfzzFXs8cFRF1FyF+FwFlFAFyF+FwFlFmFyF+FwFlFqx58V4hpfgC:V0Kzz1s8crrUwKryUwKrQUwKrwxj","tlshash":"d94320b11a7b1598b52f9528abef27587a3c6183e41bcde8f7c132144f416ec51a2f8c","first_seen":"2024-01-09T10:13:12Z","last_seen":"2026-07-19T04:54:36.700375Z","times_seen":66,"resource_available":false,"data":null}},"time_used":361,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":361,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/uploads/allimg/20231128/1-23112R21922446.png","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.179Z","timestamp":1780888597179,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /uploads/allimg/20231128/1-23112R21922446.png HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: image/png\r\ncontent-length: 10826\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Tue, 28 Nov 2023 14:19:22 GMT\r\netag: \"2a4a-60b371adc0e80\"\r\nserver: nginx\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10826,"size_decoded":11088,"mime_type":"image/png","magic":"PNG image data, 210 x 40, 8-bit/color RGB, interlaced","md5":"1c47170cd75561cc0c9a26be4da08c51","sha1":"24add2566de43c437556cd559450dfde02da4906","sha256":"189354d428ba3f0e549ae2b1377187abd3b7a760555ab68b70f6325acdcd949f","sha512":"fa805093159bb3f9e2fd506e77a99ce07dc4e66a0e87ae02c0730f4335f62a5179552f79d3f593abfa5857a46694c4d76c5f7fceee75d87a906e4cf894f06964","ssdeep":"192:23nrCgg91A6VR1GTUGzrICNf7EF9wOX2TCNWRF4X+j6zE5VH76ngE/FDbXEm5ZSk:2bCggnAzUME7vZNWRN176PDDpluu/P","tlshash":"5022cfd9c6c9818d294db2846556d802f890a4fc2dcb543c387ddbba15a3fc56cd223e","first_seen":"2024-01-09T10:13:13Z","last_seen":"2026-07-19T04:54:36.736183Z","times_seen":58,"resource_available":false,"data":null}},"time_used":267,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":267,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/images/webclip.png","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:38.610Z","timestamp":1780888598610,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /template/pc/images/webclip.png HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:38 GMT\r\ncontent-type: image/png\r\ncontent-length: 11764\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Mon, 16 Aug 2021 01:00:46 GMT\r\netag: \"2df4-5c9a2bb312b80\"\r\nserver: nginx\r\nx-cache-status: MISS\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11764,"size_decoded":12027,"mime_type":"image/png","magic":"PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced","md5":"48400a28770e10dd52a8c0e539aeb282","sha1":"151bcd0c431ed79f30193731de564106a5b11956","sha256":"27712ebee35bae5474f124f7cbf6cb2ca60d5121e561d284c9f11a4e69efd663","sha512":"2c379b81f9f94dab3d756c8a60d00efc992ab34947952b3c2fbbb1d52476659c5c1d7bd9f6d676e05f852ac6be0b1a38af8549bd5be6ea15884aceb0cbb7ee10","ssdeep":"192:1SwLv+UeDeSdXPDbr88+EdNTL8+hvMTvj9kCNH+BdQ5lURjVM79uoaaQmN7sRB9S:U+R0Dn88pdNv479kOebFrMZsaQygB9xg","tlshash":"5a32c0aeeac14d97b496f3b8f417059eca98cf5141e81d620bb0db5ca8700b13a619f7","first_seen":"2023-04-30T19:31:42Z","last_seen":"2026-07-19T04:54:36.739376Z","times_seen":704,"resource_available":false,"data":null}},"time_used":360,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":360,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/bowser/1.9.4/bowser.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.144Z","timestamp":1780888597144,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 12 May 2026 03:46:57 GMT","end":"Mon, 10 Aug 2026 04:46:42 GMT"},"fingerprint":{"sha1":"95:12:1E:0A:F6:69:8B:FC:A0:08:DA:67:1A:A4:D1:9D:87:F5:E9:07","sha256":"F3:4A:39:63:C7:6A:CE:66:1A:B4:62:2C:E9:92:82:9A:81:78:1B:CC:3F:D5:2D:0A:6D:D6:89:D9:F6:66:7B:BC"}}},"request":{"raw":"GET /ajax/libs/bowser/1.9.4/bowser.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://www.zh-metamask.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nserver: cloudflare\r\npriority: u=2,i=?0\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\nlast-modified: Mon, 04 May 2020 16:06:40 GMT\r\nvary: Accept-Encoding\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/r2\r\nx-cdnjs-cache: HIT\r\ncf-cache-status: HIT\r\nage: 205874\r\nexpires: Sat, 29 May 2027 03:16:37 GMT\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cNsdm4NVEkg%2B%2BZofKPZamJTKniw3sl5YDlk47sSkwUYG7bEbi1aj5umgx%2F54xBufGT3lVIZiKAH4GbBiIXccbTuVbmFcsD1T4s207aaHmiFXqE11ZO1srm6N1%2B4C6B7AxljfFcke\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\ncf-ray: a084bd243f1c1a30-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7901,"size_decoded":3551,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (7791)","md5":"557e1db8c44d751c997a04f411a61598","sha1":"849afb67561b75e90bc3ca310db3a82742a064ac","sha256":"b52f6b6011741e76cefa2be41164bbc9b33bba334b9ad15b03abad37b609d983","sha512":"71f29b4aa47197ea065990fc2ea159309ea71b845f8bb518465fc9c6f84de161160f9066bcc0b84af5923e500aeeb6c241302b9c4c9a161578c7f04708be98a7","ssdeep":"192:zrtNwo1ZAhquwmrYTtZtqhrJQcgm7RgsedRZ:zrtNwo1ZAhquwMYTtZtqhrJQcgmqsmZ","tlshash":"e1f123ece54fa4fb48f46706584e21381bb0c8324d7f9e51be8ce151ea59cad443aba0","first_seen":"2023-03-07T12:12:07Z","last_seen":"2026-08-05T19:50:05.416791Z","times_seen":546,"resource_available":true,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":2,"connect":11,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/uploads/allimg/20250912/1-25091215342V55.png","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.189Z","timestamp":1780888597189,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /uploads/allimg/20250912/1-25091215342V55.png HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: image/png\r\ncontent-length: 89614\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Fri, 12 Sep 2025 07:34:28 GMT\r\netag: \"15e0e-63e95af14bada\"\r\nserver: nginx\r\nx-cache-status: MISS\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":89614,"size_decoded":89878,"mime_type":"image/png","magic":"PNG image data, 511 x 384, 8-bit/color RGB, non-interlaced","md5":"d8003791f3bdd80364d07a7ad3cf6f2f","sha1":"43dc348ead66386600177e5a537e2d2a08c63757","sha256":"2a997c770ebea7318aa5073979a3b2938dd338184e6e55616dad04151d2fed65","sha512":"ca34b5b9995106110bd137b51835b945a1df0eaa79ab2370f687bfe1b21676112a87fd4a0a41b264864e93a3d6425030bdc623c703383a2fcdcf24557da24f74","ssdeep":"1536:m/dlAz6TGMM7es6j3tO8Ti6XSTjx9cUPIiFHhFCQPgRtrshMECZluYY2l8QJ5iS:UOz6TgesS93EcUPFDPGt9ZlRYiJ5iS","tlshash":"f49313c1b8db359167961083dc8e870f7cec81de91fa77daea233776017ca834a11619","first_seen":"2025-11-30T17:59:14.446444Z","last_seen":"2026-06-08T03:17:07.321641Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1113,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":783,"receive":330,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/images/Brave.png","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.211Z","timestamp":1780888597211,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /template/pc/images/Brave.png HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: image/png\r\ncontent-length: 19073\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Mon, 16 Aug 2021 01:10:42 GMT\r\netag: \"4a81-5c9a2deb76880\"\r\nserver: nginx\r\nx-cache-status: MISS\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19073,"size_decoded":19336,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"fbe69790d36bf636e87e83f5413218a7","sha1":"709f392de11c5f48cbbbefa95d0a6cb56e2592db","sha256":"cd70b79d81f32aa721dedf46ea682f1f0c1808d2ffe09da63730b2a01380c214","sha512":"01e965f180ab6c42d04d12e4d5d0d056eda222fd09b6c7fb81c956e08a3fa431f0e586c09cb86eaf162bf1f6ab011c7c0d0d246d2cc2703be85246cd84120c96","ssdeep":"384:1a7wmIyRm5Z6fHi4QHvh+5uHwpHY3dYgvINBqfantF72NSUCY+/:w7wm/ALmQPhSWwpHSZINgfoENSxp/","tlshash":"fc82d180101dc1f588fcfa37557ca799f4939db530697a289fe30b01089edc6af8454b","first_seen":"2023-04-30T19:31:42Z","last_seen":"2026-07-19T04:54:36.695382Z","times_seen":608,"resource_available":false,"data":null}},"time_used":622,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":622,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/assets/webfonts/fa-solid-900.woff2","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.640Z","timestamp":1780888597640,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /template/pc/assets/webfonts/fa-solid-900.woff2 HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/template/pc/assets/css/all.min.css\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 75440\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Tue, 03 Aug 2021 12:48:02 GMT\r\netag: \"126b0-5c8a718a34480\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\nserver: nginx\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":75440,"size_decoded":75706,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 75440, version 329.-1049","md5":"b5cf8ae26748570d8fb95a47f46b69e1","sha1":"07bed153d47f9129a944ee54dd72952deed074c8","sha256":"cd398be1a91817126cef10224738e624358edf6f08043abad7e60c1aaeccc8d0","sha512":"f08b9289695cf530094f076b2df4d2b0e1a1daedd00190d123b4179b2c1a1b5e8b2bb988d86fc6dc9eee117d88a58dd5b6dfe7689586c17068f5d2da01904d76","ssdeep":"1536:1Zq/f5ldhNurIqp+jqNT5Fm653lqWppat1Wa4W8TeodjxNrqM:1kvdS7ppFm6JhpgkrW6bGM","tlshash":"6f73028e1719f192f5d6cd177edc20be38f1a7121008f839e2eda6dd5085ab639a3825","first_seen":"2023-04-05T08:48:24Z","last_seen":"2026-08-11T07:30:26.328236Z","times_seen":22943,"resource_available":false,"data":null}},"time_used":868,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":603,"receive":265,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/assets/css/odometer.css","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.155Z","timestamp":1780888597155,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /template/pc/assets/css/odometer.css HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: text/css\r\ncontent-length: 500\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Tue, 03 Aug 2021 12:48:04 GMT\r\netag: \"cb3-5c8a718c1c900-gzip\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: MISS\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3251,"size_decoded":811,"mime_type":"text/css","magic":"ASCII text, with very long lines (3251), with no line terminators","md5":"55a406b2fd5b6f67b5fc6ac84d2cf1a1","sha1":"021b0dda1ead9f9fbb3920b4e4d1f66c378dd534","sha256":"6522eec9e084cd63766480e962c9b912f10ebb5dc79c91d75f64c53cd486fda8","sha512":"5b792c96bd1bc2e668803163a866a1491166242e14c5868c12a7ce6bead94b4288a6309f979b80c1905ff9026ca49c6829834b2cc5cc6945dab80b01010bc2dd","ssdeep":"","tlshash":"9e6104154f90036863367506bac81760befce9515123d98eb35ea54bcf43db9e398b0b","first_seen":"2023-05-25T14:37:54Z","last_seen":"2026-07-25T08:38:19.047647Z","times_seen":117,"resource_available":false,"data":null}},"time_used":365,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":365,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/assets/css/animate.css","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.162Z","timestamp":1780888597162,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /template/pc/assets/css/animate.css HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: text/css\r\ncontent-length: 3502\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Tue, 03 Aug 2021 12:48:04 GMT\r\netag: \"b43f-5c8a718c1c900-gzip\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: MISS\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":46143,"size_decoded":3815,"mime_type":"text/css","magic":"ASCII text, with very long lines (46143), with no line terminators","md5":"6e0836134b10ebdabf5fcb41e3b0acea","sha1":"7ddd1291a3d19a3671f1d3232c05d28e17433420","sha256":"c684a8f7e8a03a0a6ed4a2a5520474f42a8a1ec02a84e74c30435574d6e247ce","sha512":"ead704ed4be2117351bee08bd6f1ba5076fd3ebb43329fee9d3d70d99c9e94409d3957046fbe3f734a44aa104a716bbcf877e2f0e898fb286b579f19323167cf","ssdeep":"768:XiSp2sLx8zvwG1ZAIkKDJ3bys5XrHek0RT5:EwG1ZAIkKDJ3bys5XrHek0RT5","tlshash":"292398aa4ce1228594260e55cbdc8fa84b3cc76764b15cef3346384b8745bad23de727","first_seen":"2024-01-09T10:13:12Z","last_seen":"2026-07-19T04:54:36.708517Z","times_seen":69,"resource_available":false,"data":null}},"time_used":359,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":359,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/uploads/allimg/20250912/1-250912153259447.png","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.190Z","timestamp":1780888597190,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /uploads/allimg/20250912/1-250912153259447.png HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: image/png\r\ncontent-length: 174683\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Fri, 12 Sep 2025 07:32:59 GMT\r\netag: \"2aa5b-63e95a9bd8578\"\r\nserver: nginx\r\nx-cache-status: MISS\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":174683,"size_decoded":174948,"mime_type":"image/png","magic":"PNG image data, 512 x 376, 8-bit/color RGB, non-interlaced","md5":"4d203f3bf02af4e1ad06dca206ef97b3","sha1":"9e51d2a18c7ead3099a1c64d7df95e88630f7348","sha256":"e2f6d24653fd34756d0d7b0d2b98f5bad8cd0fadc6f20771b545f391046f920c","sha512":"022aeecf3f1f82e2b3d6a34079f44067419c961814af93b2d9375628bcb952f3e8ee3dfa23f9573544a4a3d707b69c5a8d4a18a01bd5d44ae91afade1ddfb192","ssdeep":"3072:75anwJMhNSxzxflTe3NCXH/scdm4RRr4oAKcfGl824GfBGA9yTHUFOkvGZ:7NJMjSdxNTwCXUUM53MBGAgLUFOk+Z","tlshash":"5d0412a0324a1937d3bb579da26dcc456d35b83f1be1847036d9cffb0ea2950c0d1aa6","first_seen":"2025-11-30T17:59:14.467665Z","last_seen":"2026-06-08T03:17:07.325544Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1388,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":847,"receive":541,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/weihu/","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:38.445Z","timestamp":1780888598445,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /weihu/ HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:38 GMT\r\ncontent-type: text/html\r\ncontent-length: 735\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Mon, 21 Oct 2024 06:09:15 GMT\r\netag: \"673-624f67e03d8c0-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: nginx\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1651,"size_decoded":1025,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"a95e9c08282cc165204b075fcf92638f","sha1":"688ca4acfe49eb189ad91c80078d09856dc66716","sha256":"d06876dec7d0b33ca416c868f0c15be01293972ff2a2cbfff3f5dc12477429b1","sha512":"7e4f4d11d580eafc3a08ddd90d2081d5f09fabe868cefc8728050844939790fae70f592d608b5c500d34e4e89bea1328b911227602289ea7b1f8bbfadf8be20e","ssdeep":"","tlshash":"4531260e4be35052ad23b1b42f9af2056a6644438146fe06798e1394ffc5868c6f7f98","first_seen":"2024-08-30T02:45:41Z","last_seen":"2026-06-27T02:38:39.105498Z","times_seen":120,"resource_available":false,"data":null}},"time_used":362,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":362,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/css/metamask-staging-2.webflow.css","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.140Z","timestamp":1780888597140,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /template/pc/css/metamask-staging-2.webflow.css HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: text/css\r\ncontent-length: 16613\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Mon, 27 Nov 2023 09:22:02 GMT\r\netag: \"21128-60b1ed5abe280-gzip\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: MISS\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":135464,"size_decoded":16928,"mime_type":"text/css","magic":"ASCII text","md5":"dec9e90ae8e2ccc4126528d2f74452a4","sha1":"15a89fb243d3460247a5b45182d8cb74b7a47dd4","sha256":"df6e961ef8e60d88910c75aeea12a6e10bc74ebffa45b61c8330e60b3a4dafae","sha512":"9c6659b1af126535ecf4c0d63ebe38b700ce31a5fe0d630b625fa732a7b7e2b7e485f5304ccd17e5f58af7f79e8566b8c25044ee846abf57d1277601fea01611","ssdeep":"1536:9sxHJFu3mk3kQoVi1sR9AOnw6kqAXAm8whgZ4GDHNmd6BNqXgCknzFExxH7OUnJh:+xqTCRW6ulKnqWO","tlshash":"c7d341a719612104341f6ca4cba6bb10e2b9c053c64ffdf639d2544ccf869c969b3b6e","first_seen":"2025-04-18T14:29:12.424155Z","last_seen":"2026-07-19T04:54:36.714275Z","times_seen":23,"resource_available":false,"data":null}},"time_used":412,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":412,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/assets/css/responsive.css","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.165Z","timestamp":1780888597165,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /template/pc/assets/css/responsive.css HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: text/css\r\ncontent-length: 1199\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Tue, 03 Aug 2021 12:48:04 GMT\r\netag: \"1fae-5c8a718c1c900-gzip\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: MISS\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8110,"size_decoded":1512,"mime_type":"text/css","magic":"ASCII text, with very long lines (8110), with no line terminators","md5":"2453f6e5f1751752d2ddc8839430ca17","sha1":"8321059727bad9b4b0ea907b9dbf2508b4585d2c","sha256":"c5d037fdf7a94026c3fbbf2afad8423d5e753bde39b30091b6d996c0c81f5685","sha512":"a0b7ec4dd5347a1812a6522e0411adc6807ad3c5f57cbb57233b65f6b8215a0761ebbd8f0ff29dcf2b730388ad3207136d37f190d3d782519b9b242aa561bcca","ssdeep":"96:+SHhedxpHPEDev4IMKltTYgFpHP9euxkkha+7ZAX4mlthYgNEZKcCHSiTha+FXwM:+kK4IMKDYsryXHRYtcRATH2jYI6sZ","tlshash":"def1cc313bb6183da12a9551f486b8a9bf10772dc34b62f3bc665c27cbb51c8066631e","first_seen":"2024-01-09T10:13:12Z","last_seen":"2026-07-19T04:54:36.746146Z","times_seen":67,"resource_available":false,"data":null}},"time_used":365,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":365,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/uploads/allimg/20250912/1-250912152953b7.png","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.191Z","timestamp":1780888597191,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /uploads/allimg/20250912/1-250912152953b7.png HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: image/png\r\ncontent-length: 124136\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Fri, 12 Sep 2025 07:29:53 GMT\r\netag: \"1e4e8-63e959eacab1a\"\r\nserver: nginx\r\nx-cache-status: MISS\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":124136,"size_decoded":124401,"mime_type":"image/png","magic":"PNG image data, 515 x 382, 8-bit/color RGB, non-interlaced","md5":"7257c3489686f235f713430d311d48b2","sha1":"3979dfbea7f89f54ab23c00b4b129f07af2c1ea5","sha256":"cc2f4223f7f59b055a39e6b5fd17b4ea5844d42c8005d2399629d23c00d6a444","sha512":"bc6f66a11dc4e43febb146c2e744e6dde6ba9a521b637db3b2e1f4887e934cac29be5f3dab4b39aac7a7f6cc3a4d625842afac97b14e81503e46aad4ee08ee9d","ssdeep":"3072:OLBH+tXPp60v7Dshu1LHfVAUAIL7lm0K/zf4dQ69yi8t3:OLNyXP/fOeLHNAUAisxEdQqyR3","tlshash":"e4c31201dea9dd7b9fefa828f059a992f2f12620285c86cd9f14237a37575c2870c671","first_seen":"2025-11-30T17:59:14.426196Z","last_seen":"2026-06-08T03:17:07.329122Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1158,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":884,"receive":274,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/images/favicon.png","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:38.612Z","timestamp":1780888598612,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /template/pc/images/favicon.png HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:38 GMT\r\ncontent-type: image/png\r\ncontent-length: 1532\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Mon, 16 Aug 2021 01:00:44 GMT\r\netag: \"5fc-5c9a2bb12a700\"\r\nserver: nginx\r\nx-cache-status: MISS\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1532,"size_decoded":1793,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"b7919ea38a8beed9b4763858c4f7412b","sha1":"1aa57bcd7ca8a0c3352923c9ee06c472f23d5b63","sha256":"214080adac9969108cb602cb68617e332db1288e95e18c29c10f9396c6d3744c","sha512":"7c2b72c2ab01ba3654182244ee3d95b7de954bbfc95ab9778c2360136134a920c1e8e58ba92f75e4ed20cf0595596b0e38020430c09f44a191aea972677fe07e","ssdeep":"","tlshash":"d53129d763af541cf59f8a630326c86074793853832240c98fd2fda422be818b27c29b","first_seen":"2023-04-30T19:31:42Z","last_seen":"2026-07-19T04:54:36.743233Z","times_seen":821,"resource_available":false,"data":null}},"time_used":367,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":367,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www.zh-metamask.com/","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-08T03:16:33.086Z","timestamp":1780888593086,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Mon, 08 Jun 2026 03:16:36 GMT\r\ncontent-type: text/html; charset=utf-8\r\ncontent-length: 5384\r\nalt-svc: h3=\":443\"; ma=86400\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\npragma: no-cache\r\ncache-control: private\r\nset-cookie: home_lang=cn; path=/\nadmin_lang=cn; path=/\nPHPSESSID=gqih7ee3jskdunae5gii2llocj; path=/\nsite_info=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: nginx\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Google Analytics","description":"Google Analytics is a free web analytics service that tracks and reports website traffic.","website":"https://google.com/analytics","common_platform_enumeration":"","icon":"Google Analytics.svg","categories":["Analytics"]},{"name":"bowser:1.9.4","description":"A small, fast and rich-API browser/platform/engine detector for both browser and node.","website":"https://opencollective.com/bowser","common_platform_enumeration":"","icon":"","categories":["JavaScript libraries"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery:3.5.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]}],"data":{"size":19713,"size_decoded":5869,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (448)","md5":"35536950fe4a09bbda2daf0495560367","sha1":"63b53bf61e353613ec5f8e002d64d8c68b1c82ac","sha256":"090fcc386d4df09d6b1aa58210b8745826618f8d1c4978d5179616de8f9421a8","sha512":"c49f02e66687cabfc98b35f46dd3c7b829822c93a5b3b35a02eceaa79030040274675e0bb97971e6aa98fc5e617cfcabf20744d1bbfc4b66fd31028cc49a67f4","ssdeep":"384:B37Jz69g5KpKSQ5VtOBvdVtT3tOly4s53N+5rwzR4s53egrw844s53aErwT04s55:B370ae/DRxQ/2b6qxMlMG1","tlshash":"f292631158cc9dff020752dab169376de0af9f72cd2394e3f2f74119a2d6e6284264a3","first_seen":"2025-11-30T17:59:14.424153Z","last_seen":"2026-06-08T03:17:07.330575Z","times_seen":2,"resource_available":false,"data":null}},"time_used":3772,"timings":{"blocked":-1,"dns":1546,"connect":259,"send":0,"wait":1449,"receive":0,"ssl":518},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/assets/css/all.min.css","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.146Z","timestamp":1780888597146,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /template/pc/assets/css/all.min.css HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: text/css\r\ncontent-length: 12202\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Tue, 03 Aug 2021 12:48:00 GMT\r\netag: \"da9e-5c8a71884c000-gzip\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: MISS\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":55966,"size_decoded":12516,"mime_type":"text/css","magic":"ASCII text, with very long lines (55785)","md5":"2bb00d5b5fd1e8dfdfcccc3bb87d15f6","sha1":"101bd7f275c2cd281d3e16efa8b6aa25661e1894","sha256":"c5e274b42c5a42e7478278de6f88be80e15105d8a352cf7f555a0c276abf98d0","sha512":"feb717171ffdc111671599ff637f588f84796053fd95f0096a51ecddc84994280dc82e1d1c8572d44fde0f34278facfc6ec372db2cfa98e42c551807363fefeb","ssdeep":"768:seC31sPizPq4/vnUAUHJvkQCg/xMQyjJrX759sGZQz5:seTPUC4/vMHBBC8gd7nsDF","tlshash":"f1430bb8e54c41c9a731c44fbf82b2bc61baf73de5910d95f00e691c2ad26a811c5fb9","first_seen":"2024-01-09T10:13:12Z","last_seen":"2026-07-19T04:54:36.727691Z","times_seen":65,"resource_available":false,"data":null}},"time_used":367,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":367,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/assets/css/venobox.css","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.157Z","timestamp":1780888597157,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /template/pc/assets/css/venobox.css HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: text/css\r\ncontent-length: 2703\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Tue, 03 Aug 2021 12:48:04 GMT\r\netag: \"4837-5c8a718c1c900-gzip\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: MISS\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18487,"size_decoded":3016,"mime_type":"text/css","magic":"ASCII text, with very long lines (18487), with no line terminators","md5":"77e6baeed54e79c04cf31828c34b05f2","sha1":"6c0909131f7955b0b91ac83011d20f6048443b67","sha256":"bc63f94a293a40de28bf11685e53268d8cb801c9ab4c1446f2132bd6a8f14b21","sha512":"d104751ccb9cf271e016024d012884c2554c3c8af8f5fc40c78f271a573addd14b324f703216ed484dc74fa189390b96b3699ed9068d99dfaa5ce7e985f85f84","ssdeep":"384:Z856RC+hAidpkzh7rgU+QJrlh+ftFXTjkXhTriUY5+KwHCAD1DGvT8ob3fUpxr+3:2eC+hAidpkzh7rgU+QJrlh+ftFXTjkXs","tlshash":"7b828eb308d221c6d8134f5293dc0f64563aca635b220edfb355349e8786faa13d667b","first_seen":"2024-01-09T10:13:12Z","last_seen":"2026-07-19T04:54:36.73118Z","times_seen":65,"resource_available":false,"data":null}},"time_used":363,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":363,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/js/webflow.js","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.173Z","timestamp":1780888597173,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /template/pc/js/webflow.js HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: text/javascript\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Mon, 16 Aug 2021 01:01:14 GMT\r\netag: \"8a283-5c9a2bcdc6a80-gzip\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: MISS\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":565891,"size_decoded":137129,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (54438)","md5":"631a7d3ebb657b0926e21d4c95002e25","sha1":"6745523a5233813bdafbba412ff43afa6199c737","sha256":"94b3185eff8d48c0db402f227d910832d0ea342b6018db0cbea95577509fd161","sha512":"61532d8df2d7f32efbfd126c676967f4c2fcdfc085c62e75b96f68a408342e08f6976f8f1e472b1b047ede2b189d874a2a1d15c7aca8d9ab48c7258a47fb0034","ssdeep":"6144:ui/F2d9aGkD1vCAcFFAoldAPt9W6MaT1IMOZKL:Ba0GBGPq6t15RL","tlshash":"2ac41b897251707902d60269d01f1907f337266aa00ec89cf669d8ee6dbcddd2277f3a","first_seen":"2023-03-07T14:39:03Z","last_seen":"2026-07-19T04:54:36.742533Z","times_seen":91,"resource_available":true,"data":null}},"time_used":1190,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":371,"receive":819,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/images/download-extension-p-800.png","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.180Z","timestamp":1780888597180,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /template/pc/images/download-extension-p-800.png HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: image/png\r\ncontent-length: 27701\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Mon, 16 Aug 2021 01:10:44 GMT\r\netag: \"6c35-5c9a2ded5ed00\"\r\nserver: nginx\r\nx-cache-status: MISS\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":27701,"size_decoded":27964,"mime_type":"image/png","magic":"PNG image data, 800 x 407, 8-bit colormap, non-interlaced","md5":"ef0d0b1ba0d66b79c24bceb966e7165f","sha1":"acec89109c680595e7283448cf970cbbed9c9312","sha256":"87644982f01044c06aa36da2713d8b652ffa95af674e22cbc7019f6415ad12d2","sha512":"ec2e4e3d28db1630615fcf0935488373d67eca66d90f5bb9131329fe21dc6c093e317d71a83962bb30dff97df3ed8574b51f99f007980c134ceb38fca22769fc","ssdeep":"768:5k0uP1iPP0wnFT+YbXROW+I7B7QprayxotWBWKf:y59/AFDR7+xplmQBWKf","tlshash":"28c2e1876cfa080fe6de4d7bc030f49fcb24e1bbb3682824966a5637455851e139d39a","first_seen":"2023-05-22T04:42:49Z","last_seen":"2026-07-19T04:54:36.728503Z","times_seen":78,"resource_available":false,"data":null}},"time_used":590,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":531,"receive":59,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/css/normalize.css","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.136Z","timestamp":1780888597136,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /template/pc/css/normalize.css HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: text/css\r\ncontent-length: 2659\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Mon, 16 Aug 2021 01:00:40 GMT\r\netag: \"1e5c-5c9a2bad59e00-gzip\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: MISS\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7772,"size_decoded":2992,"mime_type":"text/css","magic":"ASCII text","md5":"4951cc88307c632cf285d3ba988ab283","sha1":"031d58bc40b4242b27d8171a01bb0ecb5f9d22d7","sha256":"5c4a6fe64efc5d07833c35af9630d0f9b3d4d09a63f9358e441374e9102c9e81","sha512":"3351c28bc636eeca8938edebe26f5e6b93090c415d67e1446d68e442554d7f2226536c42b3f535d446172044344051b80306d957675ed9061022e9b88d34652f","ssdeep":"96:MrWcFPpkRUwojaszRO5LVSrwnTgPjnRo5wUEKsB+NE4t+49NaN71UB9:M/9pVjasdEvQnRo2UEKsBqBt+W67w","tlshash":"25f1b79923a04b5192395df5b3a7838577481127832c7c6eb4d340fc8fc9b1553baf99","first_seen":"2023-04-05T04:20:34Z","last_seen":"2026-08-07T20:44:11.517952Z","times_seen":782,"resource_available":false,"data":null}},"time_used":371,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":371,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/css/webflow.css","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.138Z","timestamp":1780888597138,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /template/pc/css/webflow.css HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: text/css\r\ncontent-length: 9294\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Mon, 16 Aug 2021 01:00:42 GMT\r\netag: \"98c5-5c9a2baf42280-gzip\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: MISS\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":39109,"size_decoded":9607,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (2587)","md5":"13fc860cb6eddbf469d986e1a6b6480b","sha1":"6bb85ecdc704734f59d4984d202f75b02048a58d","sha256":"ba6716203b5a6f128eab828aef79dcdfeab87ec1ee605392e4a9d6955de30842","sha512":"0c89d6cc7116d30e517946dbc8a21ad0cca75fb983b64190f5984340eb88cd848a2a1817b9ddffefa60b35cf0d89519e309734faf29326d29278d2da36d7eb09","ssdeep":"768:ef7A1YRh+HrFIoF7XF/Dw82aWoS+lyKA+vdxUFPF5FiYFIF4qOqClERcCi7CkQtw:t1YWHrVtJPUdjVCOqCO+ikQm","tlshash":"d30395b58bf40530b816c1a56991b3253f2d4043a70ede28bad1741fdfce2c79963b69","first_seen":"2023-04-05T04:20:34Z","last_seen":"2026-08-01T12:16:39.159584Z","times_seen":449,"resource_available":false,"data":null}},"time_used":367,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":367,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/assets/font/flaticon.css","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.148Z","timestamp":1780888597148,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /template/pc/assets/font/flaticon.css HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: text/css\r\ncontent-length: 501\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Tue, 03 Aug 2021 12:48:02 GMT\r\netag: \"5f8-5c8a718a34480-gzip\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: MISS\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1528,"size_decoded":812,"mime_type":"text/css","magic":"ASCII text, with very long lines (1528), with no line terminators","md5":"c98ef50d0499bc27eca90a8bd55133e5","sha1":"d483707660b7611e0f1f2a8b8921c4b5d4513b29","sha256":"a6105361bc9a7d88448e3ae5d491b501c053aa532f1b16b76cf479974a4d8ec8","sha512":"999824e52558459496b411ad8f1a21f298da4e3256b8b3fb194fd15dda6b4c035e66f8616c2e1c7474a072fba5f7e776d9673a8f37f37a0fa5102e147ff6b931","ssdeep":"","tlshash":"dc3190a8d03a54c16365ce47bfe93258da85f0389cd0ac61f41f0e6dacf2f604384b68","first_seen":"2024-01-09T10:13:12Z","last_seen":"2026-07-19T04:54:36.738009Z","times_seen":54,"resource_available":false,"data":null}},"time_used":364,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":364,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/images/download-android-p-800.png","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.183Z","timestamp":1780888597183,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /template/pc/images/download-android-p-800.png HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: image/png\r\ncontent-length: 30632\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Mon, 16 Aug 2021 01:10:48 GMT\r\netag: \"77a8-5c9a2df12f600\"\r\nserver: nginx\r\nx-cache-status: MISS\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":30632,"size_decoded":30895,"mime_type":"image/png","magic":"PNG image data, 800 x 407, 8-bit colormap, non-interlaced","md5":"82627227a1ab5f7f49daca3260d1b964","sha1":"104e097bfc0c67d04a81fe5b56ab644dac148304","sha256":"5b8eaa78003163540fcc8338d3905798c11153211a28c60c59b125a4784954d0","sha512":"33c996a5b3d9519484cfaac9deaa4c14df72eab803be05ffac588bcfa40072981e3819ef0472054a898ea4c523c9480c702ba7ac3f8622fbc7129d1521e1ce6f","ssdeep":"768:6lV5tNrGADNpBr6GbCel2Mc88XEYKL9ZHgYq24w:GVJr/hGGum2M6uHgb24w","tlshash":"ffd2d12b1328dc13e64f9a5a429c516d281671eb50ec20b4e11f5bbe7084231f9fbea6","first_seen":"2023-05-22T04:42:49Z","last_seen":"2026-07-19T04:54:36.705312Z","times_seen":81,"resource_available":false,"data":null}},"time_used":635,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":612,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=UA-37075177-6","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.178.104","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.141Z","timestamp":1780888597141,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google-analytics.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 18 May 2026 18:35:27 GMT","end":"Mon, 10 Aug 2026 18:35:26 GMT"},"fingerprint":{"sha1":"81:79:25:0A:2E:C8:CA:DA:16:EF:B8:34:B7:38:E6:48:7B:5B:4C:6D","sha256":"7B:74:72:15:7A:A8:4B:D0:1D:D6:11:DE:7C:D9:15:EE:E9:22:FF:E8:56:41:9E:88:6C:4A:F9:9F:AB:B3:6E:2C"}}},"request":{"raw":"GET /gtag/js?id=UA-37075177-6 HTTP/1.1\r\nHost: www.googletagmanager.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: application/javascript; charset=UTF-8\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: Cache-Control\r\ncontent-encoding: zstd\r\nvary: Accept-Encoding\r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\nexpires: Mon, 08 Jun 2026 03:16:37 GMT\r\ncache-control: private, max-age=900\r\nlast-modified: Mon, 08 Jun 2026 03:00:00 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncross-origin-resource-policy: cross-origin\r\nserver: Google Tag Manager\r\ncontent-length: 130328\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":366744,"size_decoded":130978,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (5930)","md5":"27754f2ad8594d8790db215c3e17a203","sha1":"c37740250e4ae3ef28796ff1712006c15974c25e","sha256":"d9a62d77449d9eb19d58edb59a8706c58022ccde2d016768014143fe9c4d7c57","sha512":"6d611996ef1143b528603e62b7638447048e7f38f6a2b3f32cd53926694b72482a87924a0e5670e09b4a83b41634aee6f13bf92a5a5f064910138bcfceb9505b","ssdeep":"6144:Zf3GsHPjgbP4V2pYW0w40dicSF2Ks5vAXgNR4Q:ZM41cKEAX+","tlshash":"307408cdb3d674629393a478903f018bb23a79d2f848c898f186d8d42e7465a4277f7d","first_seen":"2026-06-08T03:17:07.339006Z","last_seen":"2026-06-08T03:17:07.339006Z","times_seen":1,"resource_available":true,"data":null}},"time_used":157,"timings":{"blocked":-1,"dns":2,"connect":17,"send":0,"wait":50,"receive":53,"ssl":35},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/assets/css/bootstrap.min.css","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.150Z","timestamp":1780888597150,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /template/pc/assets/css/bootstrap.min.css HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: text/css\r\ncontent-length: 22586\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Thu, 30 Nov 2023 09:02:11 GMT\r\netag: \"2561a-60b5ae834cac0-gzip\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: MISS\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":153114,"size_decoded":22901,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65300)","md5":"ded9371fa049f3d7c7227783a32956b3","sha1":"bbf5d257c13850215eee718f1ccd8db7192d2d34","sha256":"9887ab6839c21b1055ab6817dcce49a9e101fe18b60e4eaa740be4d0857f087e","sha512":"80b1918919fd6b0f92d1442721adf8218df714c3185355bb8d98cfd2d2cf11ba6988c8d6944e1b0cb0bd6427df923cf449d6dbd65cd30963ab4fa2237e7992d5","ssdeep":"1536:ftxIN45VOvVVsEBpy0cuJD722TIH52DVIpz600I4P5:ftxIjDVIpz600I4P5","tlshash":"c7e383d7f581241de4a7c219a4d1bffd092f4686e3025eabb0277bb88b456c70963e4c","first_seen":"2024-01-09T10:13:12Z","last_seen":"2026-07-19T04:54:36.699418Z","times_seen":43,"resource_available":false,"data":null}},"time_used":417,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":417,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/assets/css/menu.css","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.151Z","timestamp":1780888597151,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /template/pc/assets/css/menu.css HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: text/css\r\ncontent-length: 1452\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Sat, 18 Nov 2023 10:49:44 GMT\r\netag: \"1a4e-60a6b02bd4200-gzip\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: MISS\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6734,"size_decoded":1765,"mime_type":"text/css","magic":"ASCII text","md5":"c93131e789d6bddfe86790b8b8bab010","sha1":"57cb64d5f47d73fa73ad216087334b1d581ff0a2","sha256":"0bd45e4614b7dbe548a2fcad989ced9defa6caf83c792f3fdce213fcbd1d4985","sha512":"c7d83dacdd5477937208f7344a1980a718072c0d6e3f3bead3929af35a40b11bcf846a4a917da33a9a2f6bfeb757ee1c98f6b2806b444da05bf83dc8afb18f86","ssdeep":"96:9NV12Uc9H0KW7Lu486FQFTziv0UPvf31D+VFS0Thp3d42Jns7XVWUORSxgnwtunR:/17uH6FQFPMFP31D+VFHbZdonaIYd","tlshash":"91d1be5143e3b38828178279d3eb2f1c73242283d705cca8fb5d125d8fc5aa5a6c2f65","first_seen":"2024-01-09T10:13:12Z","last_seen":"2026-07-19T04:54:36.717262Z","times_seen":57,"resource_available":false,"data":null}},"time_used":367,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":367,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/js/jquery-3.5.1.min.dc5e7f18c8.js","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.170Z","timestamp":1780888597170,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /template/pc/js/jquery-3.5.1.min.dc5e7f18c8.js HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: text/javascript\r\ncontent-length: 30910\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Mon, 16 Aug 2021 01:25:52 GMT\r\netag: \"15d84-5c9a314f4e800-gzip\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: MISS\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":89476,"size_decoded":31232,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65451)","md5":"dc5e7f18c8d36ac1d3d4753a87c98d0a","sha1":"c8e1c8b386dc5b7a9184c763c88d19a346eb3342","sha256":"f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d","sha512":"6cb4f4426f559c06190df97229c05a436820d21498350ac9f118a5625758435171418a022ed523bae46e668f9f8ea871feab6aff58ad2740b67a30f196d65516","ssdeep":"1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakF:AYh8eip3huuf6IidlrvakdtQ47GK1","tlshash":"a993f9ddb2c6702257a720ba007f510bf236199d6c4d8450f265d8e9bcb8a4e827bf7d","first_seen":"2023-03-07T01:02:01Z","last_seen":"2026-08-11T11:27:14.604084Z","times_seen":266301,"resource_available":true,"data":null}},"time_used":542,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":410,"receive":132,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Malware - Botnet panel","verdict":"malware","severity":"medium","comment":"Associated with Botnet webpanel","tags":["botpanel","malware"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/js/jquery.min.js","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.171Z","timestamp":1780888597171,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /template/pc/js/jquery.min.js HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: text/javascript\r\ncontent-length: 33064\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Fri, 03 Sep 2021 11:59:32 GMT\r\netag: \"1698b-5cb160844d100-gzip\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: MISS\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":92555,"size_decoded":33386,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65481)","md5":"3a728460147fb9af7faf0e587b9fbf42","sha1":"f3a55f44fb81cf8ee908a3872841f70d6548f8c1","sha256":"8c574e0a06396dfa7064b8b460e0e4a8d5d0748c4aa66eb2e4efdfcb46da4b31","sha512":"c6326be84aed0d20ae924246119b19ce4fd705f967d46c6c9dd89b1180984163f0708b9e0e8917f319304bf617f3c35d83657fcbfae1340bc34e689f0961c6a5","ssdeep":"1536:DYUqmRbwh3Kvk8QRExoulFTz7bkKz1A+uezbp9Bl+u5x/90yWZmnEJSxy3Y6nRwT:qSi3a7PxkKmO8MP63vkxEyUtCu+","tlshash":"5293d7e972d6716387b730a850af510bb13698e6b80c8c60f058d9e47e74e49a07bf7d","first_seen":"2023-03-07T01:02:06Z","last_seen":"2026-08-08T23:55:45.839122Z","times_seen":1927,"resource_available":true,"data":null}},"time_used":661,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":647,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/images/download-ios-p-800.png","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.182Z","timestamp":1780888597182,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /template/pc/images/download-ios-p-800.png HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: image/png\r\ncontent-length: 28529\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Mon, 16 Aug 2021 01:10:46 GMT\r\netag: \"6f71-5c9a2def47180\"\r\nserver: nginx\r\nx-cache-status: MISS\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28529,"size_decoded":28792,"mime_type":"image/png","magic":"PNG image data, 800 x 407, 8-bit colormap, non-interlaced","md5":"76b177e6396123e166446db3c18d77be","sha1":"c3ce0d1c5993bcb081fdd8d19d342fc6ff62cf49","sha256":"13c6d99edad1de7e82983bd0c7fd154513e4c06e29a665d94ead2512f60d33ce","sha512":"e9df5cbdecfaf28c280a799a41a7ed3d4e560150b6fb3f4cbc9f4af12785d4e5b82d661f8cbc084326cb7f9364b05fd8999636a65ce4428053b1209cb3e6a72d","ssdeep":"768:NpCfuLz9zPEGz5pzq4Rf4TMZ4qY2xBQCkNZ:NOuN4GzfPRKMZ4q/BQCkNZ","tlshash":"9cd2e185e72bcb2706b3193e0d989965ad5742a880220f66b74d2bd8754c6c3a14ffbc","first_seen":"2023-05-22T04:42:49Z","last_seen":"2026-07-19T04:54:36.74458Z","times_seen":78,"resource_available":false,"data":null}},"time_used":614,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":604,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/uploads/allimg/20250912/1-25091215355U46.png","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.187Z","timestamp":1780888597187,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /uploads/allimg/20250912/1-25091215355U46.png HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: image/png\r\ncontent-length: 128728\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Fri, 12 Sep 2025 07:35:58 GMT\r\netag: \"1f6d8-63e95b4713fa0\"\r\nserver: nginx\r\nx-cache-status: MISS\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":128728,"size_decoded":128993,"mime_type":"image/png","magic":"PNG image data, 513 x 382, 8-bit/color RGB, non-interlaced","md5":"e1fa462bb93ff8835b46beb7a3d8ba66","sha1":"39febbbfe105b39af7b76c6b5d518c20ecb0455d","sha256":"7ffd681747e68a82d7f6c6a351934aba72ba80d100ff8ec782d652328d595373","sha512":"ab65ca08e87434c08b9fbae6eb44e3f4bf3a4ad6d0c7db1c975046905597f3518be3ee5d5b1252a7ece4b75a70ace40952c5db3fdfd149e284a2399b9e141ecc","ssdeep":"3072:4Snazkccl3HU5luefObFN7xvrRfDQmJg5eH7iI:4uaz6EbEjx9fUmq0H7J","tlshash":"f4c3129cbe46d938a7ca1d031fd6352f6cac1dece6341280825fc7dd650e41367ab89a","first_seen":"2025-11-30T17:59:14.41302Z","last_seen":"2026-06-08T03:17:07.343559Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1134,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":861,"receive":273,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/fonts/EuclidCircularB-Regular-WebXL.woff2","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.636Z","timestamp":1780888597636,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /template/pc/fonts/EuclidCircularB-Regular-WebXL.woff2 HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/template/pc/css/metamask-staging-2.webflow.css\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 45196\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Mon, 16 Aug 2021 01:02:20 GMT\r\netag: \"b08c-5c9a2c0cb7f00\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\nserver: nginx\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":45196,"size_decoded":45461,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 45196, version 3.66","md5":"2d75957df3bb3aa6ed84f6591b0d5a1a","sha1":"906424e75625f63b0188471067065794d0348536","sha256":"8ff3b303322168b49a14878f195dbaf76d9da16e35094d1f83fa23245450155b","sha512":"79733ed5303ca93cdec16b9da25cd95ca397343d5ee529f4074ea878fa0f9916a6ffef297b51d5b9b3cd3bf8e199e203f91598166429bcce398f7c9055557c40","ssdeep":"768:I31VpnYUI+dibkAK4rZJ5CkE9cfnRN0C6fZQ/UAqD2zsUz8ANMDuu1ftOl6GXv:Ep0IJ4FJ5MhQ22zsUzoDp1Olhf","tlshash":"cc13f1586f3cc766d23960ead86c893d483aa8b6ac420fd4fa47173b0e44755934bb70","first_seen":"2023-04-13T20:09:28Z","last_seen":"2026-08-04T06:05:55.389747Z","times_seen":846,"resource_available":false,"data":null}},"time_used":606,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":475,"receive":131,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/assets/css/swiper-bundle.min.css","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.160Z","timestamp":1780888597160,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /template/pc/assets/css/swiper-bundle.min.css HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: text/css\r\ncontent-length: 3962\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Tue, 03 Aug 2021 12:48:04 GMT\r\netag: \"3460-5c8a718c1c900-gzip\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nserver: nginx\r\nx-cache-status: MISS\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13408,"size_decoded":4275,"mime_type":"text/css","magic":"ASCII text, with very long lines (13408), with no line terminators","md5":"3d815ae39e31b8c5e58e7d9447f410b9","sha1":"a8fc3c0cabe1c6908bb164da80fba16765c3b1c7","sha256":"5a9fd120c6c0b391f641038e5862f061f5d181d813bfdce19f9c195f1cc59abd","sha512":"51e27f8a391ff0472c148dda13858c35ee9fa2547a45c22aabb9e82b9675fec4b289fa3030094eee7620fdd6b8cb23173b7c665521cf0a4a3a13603e9a480cf8","ssdeep":"384:1Ubeo7Rgx9BU0mbJC4if65W/1mXAA0FH5x:Kbr7gbhmbJdif65W/1mXAA0F3","tlshash":"8252236417003837f3774f6e06a1e6b59f60cc838a934dadb2c0dd44d6fa8b9122eb95","first_seen":"2024-01-09T10:13:12Z","last_seen":"2026-07-19T04:54:36.72008Z","times_seen":69,"resource_available":false,"data":null}},"time_used":359,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":359,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/uploads/allimg/20250908/1-250ZQZ53JR.png","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.192Z","timestamp":1780888597192,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /uploads/allimg/20250908/1-250ZQZ53JR.png HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: image/png\r\ncontent-length: 74418\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Mon, 08 Sep 2025 11:05:37 GMT\r\netag: \"122b2-63e482ad4b713\"\r\nserver: nginx\r\nx-cache-status: MISS\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":74418,"size_decoded":74682,"mime_type":"image/png","magic":"PNG image data, 537 x 415, 8-bit/color RGB, non-interlaced","md5":"5a66372cacf5bcc1198e1003cfd61025","sha1":"08913dda4630e59ea8b6f6baf493e61b51ff65a0","sha256":"9ce1386032d59c22734a4a20cdeacb7c40beda52fc556bf22bd36ba301f1027a","sha512":"b937ab6e8a6d213709c11cfe24aa777f70ac032fe6e319791898c7a9bda3cb7288b3253bd877b685847cb0ae15bf30d8f2737e1f93002e57cc837063686136d6","ssdeep":"1536:cXry3IDoPPoA/0m6lPNWFjfqmVMjPFStXTSL/IMkARhpEaJAUOXIsdWN:0rO6oPL0m618TVkwtjSMCRki3sdWN","tlshash":"c673018bca84de68cc4354aa3ad5ff21c4f961d81a736a71383de0171b2cf9d3978658","first_seen":"2025-11-30T17:59:14.46296Z","last_seen":"2026-06-08T03:17:07.345846Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1170,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":892,"receive":278,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/uploads/allimg/20250908/1-250ZQZ419525.png","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.193Z","timestamp":1780888597193,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /uploads/allimg/20250908/1-250ZQZ419525.png HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: image/png\r\ncontent-length: 190864\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Mon, 08 Sep 2025 11:04:19 GMT\r\netag: \"2e990-63e482634ef72\"\r\nserver: nginx\r\nx-cache-status: MISS\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":190864,"size_decoded":191129,"mime_type":"image/png","magic":"PNG image data, 622 x 392, 8-bit/color RGB, non-interlaced","md5":"da87a9b68f5212d049d9000b1fd4858b","sha1":"8d06f2cdaf716b37345d45d53f8d4fb416c99898","sha256":"00245fc2fc85de86093964dfff298c5dbc16d946485b9f442ed9ebbce45277ab","sha512":"2447395966c399a9a9e60f330db765b5c4ca4c3a32a0428ce4535e02b39d37f2bf0c7c40151c57fb2235c4f1214bf38c3fe80a1785b16cd4e8c8fc44490496dc","ssdeep":"3072:5caD98yVrS0hPeqqTtzy5EEM8SFE9hE9EMmYyFlMM+Vdh1D662:jDFrlhWqSFy5EEJPfgEXYyQ1j2l","tlshash":"a91422d5899daa82734bb0367df9428c46de19b7b6d872712337ce12792b081828dc55","first_seen":"2025-11-30T17:59:14.451477Z","last_seen":"2026-06-08T03:17:07.346738Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1413,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":863,"receive":550,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/images/chrome_1chrome.png","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.208Z","timestamp":1780888597208,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /template/pc/images/chrome_1chrome.png HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: image/png\r\ncontent-length: 3890\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Mon, 16 Aug 2021 01:10:40 GMT\r\netag: \"f32-5c9a2de98e400\"\r\nserver: nginx\r\nx-cache-status: MISS\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3890,"size_decoded":4151,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"162fd1e613c0f3a992365a980a4fd6cc","sha1":"3401907394d4810392719d9696ce0088a8847618","sha256":"90af37bb98146aba902ae19d013dc16ead7ea6f5050f339a5728eaf2a068c7ec","sha512":"96e832135c825622d2f9895d0ecf594d53acd49b3e225f195ffa35caa4ab982c0fcded0d30b3395615bc079c5854fc0b0bcc610dc514b08ee446d042a429d02a","ssdeep":"","tlshash":"a2814d1b8ca55e7752410d8424d9eecdc8623a35af45f669cea873093f166839044baa","first_seen":"2023-04-30T19:31:42Z","last_seen":"2026-07-19T04:54:36.713289Z","times_seen":608,"resource_available":false,"data":null}},"time_used":503,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":503,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/images/Firefox_1Firefox.png","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.209Z","timestamp":1780888597209,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /template/pc/images/Firefox_1Firefox.png HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: image/png\r\ncontent-length: 10509\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Mon, 16 Aug 2021 01:10:40 GMT\r\netag: \"290d-5c9a2de98e400\"\r\nserver: nginx\r\nx-cache-status: MISS\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10509,"size_decoded":10772,"mime_type":"image/png","magic":"PNG image data, 107 x 100, 8-bit/color RGBA, non-interlaced","md5":"715129c60a9f70f0ccbb6c4395799e95","sha1":"4dfc6120523fda842c83261ddd922a9ce15a66d7","sha256":"52c88349bd9d45937236e20a4c9928f8a15db9dc7418436900e667b344e079c5","sha512":"267a7abe0e3f88cceb61696b41d34ca5b94ddfa156d8420858e4e18af20dd5be61fddf7e9aef5fd2958d2199573f3b3ecc17e44bdbfa110474dee869d43bf0b3","ssdeep":"192:T0JyM8a8xYuu5N36OhGsUySlmblD55Ecv/w1tC/zY6rA0+ckM+HgsFmy676os6Cf:TW8WfFGnmbl9donxc+TMmgOh67C","tlshash":"2122cf498fb920aef91e26841fcd810cef1e106ed0dd9df875e361ec8e1b058dac8128","first_seen":"2023-04-30T19:31:42Z","last_seen":"2026-07-19T04:54:36.723443Z","times_seen":608,"resource_available":false,"data":null}},"time_used":572,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":572,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www.zh-metamask.com/template/pc/images/Edge.png","fqdn":"www.zh-metamask.com","domain":"zh-metamask.com","tld":"com"},"ip":{"addr":"172.104.112.172","port":443,"asn":63949,"as":"Akamai Connected Cloud","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.zh-metamask.com/","date":"2026-06-08T03:16:37.212Z","timestamp":1780888597212,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zh-metamask.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 25 May 2026 08:24:52 GMT","end":"Sun, 23 Aug 2026 08:24:51 GMT"},"fingerprint":{"sha1":"0D:99:33:81:21:06:E1:49:C1:5A:DC:52:B4:D0:2C:0F:5A:B9:5B:16","sha256":"5C:88:DE:81:A6:62:C3:80:09:88:57:8B:93:EA:A3:F6:1F:45:B4:A8:97:C7:AE:49:46:97:B5:94:65:0B:31:BA"}}},"request":{"raw":"GET /template/pc/images/Edge.png HTTP/1.1\r\nHost: www.zh-metamask.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://www.zh-metamask.com/\r\nCookie: home_lang=cn; admin_lang=cn; PHPSESSID=gqih7ee3jskdunae5gii2llocj\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Mon, 08 Jun 2026 03:16:37 GMT\r\ncontent-type: image/png\r\ncontent-length: 34658\r\nalt-svc: h3=\":443\"; ma=86400\r\nlast-modified: Mon, 16 Aug 2021 01:10:42 GMT\r\netag: \"8762-5c9a2deb76880\"\r\nserver: nginx\r\nx-cache-status: MISS\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":34658,"size_decoded":34921,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"372e0f14122bc985fc25c9adf18e8dd1","sha1":"0da9b96762170fcdca32a35630e161064d45b3f2","sha256":"6643f9327bc18e8108d0bc474eee816d0807a10dc8ad3702797e8f81f23c888b","sha512":"39a8579538a2820bb1368402ebe0bb19f09990579392424f7f12c35b0520558da834c0f8c0a8a441b98a5bcfb736dca6e8b3f39c89becf01583c13c6547f60db","ssdeep":"768:gBP4YSEhe60ThEXgogOap816L9GfXWu6uDfNZnHAl:yQYSEhuEXdgZp880TXnW","tlshash":"0ef2f0f40646c78a7c9c19a87d064d5fdbabd0257b3ce9e38382e0c745f16913e9886d","first_seen":"2023-04-30T19:31:42Z","last_seen":"2026-07-19T04:54:36.730387Z","times_seen":608,"resource_available":false,"data":null}},"time_used":761,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":634,"receive":127,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-08","alert":"Phishing Block","trigger":"www.zh-metamask.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"www.zh-metamask.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic Crypto/Wallet","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Generic Crypto/Wallet phishing","tags":["crypto","phishing"],"meta":null}]}}]}