{"report_id":"900f9e37-e5ab-46f4-acfb-451101363650","version":0,"status":"done","tags":[],"date":"2026-07-19T15:09:14Z","url":{"schema":"http","addr":"app.whatsapp.ih.hl.cn","fqdn":"app.whatsapp.ih.hl.cn","domain":"ih.hl.cn","tld":"hl.cn"},"ip":{"addr":"154.195.74.69","port":0,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"app.whatsapp.ih.hl.cn/","fqdn":"app.whatsapp.ih.hl.cn","domain":"ih.hl.cn","tld":"hl.cn"},"title":"WhatsApp 网页版","dom":{"size":35844,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (24242)","md5":"e5034539fe0244e575b33c86a0837a37","sha1":"9e3b78c496f51fd79fab3998e62f36478d1d2e6b","sha256":"1f0a02d0d94c4430bd3721ef5b2f1d926c655162170476b517fbeada2032a979","sha512":"bd16139746f476e150d77297f14b1b4a292adc9bc18b3161c1d7dabf2e7f0802716400b8de260d9e74ae4e75c666ae1541079a0470ca1bc20251103a773a021a","ssdeep":"768:086pvCh0bhnjGFbdYt4adHxT+Qi7/EpGvZKTdX7aGKx:08XhqhjgbWdHs7/EpWwJX7a9","tlshash":"59f22af66bb061f8ed03c7d6d971b168715b30f9fb268b98c2c44a64e7c659c8cc6890","dom_hash":"domhashdf9c12259c2a07feff53de4d8fe56c06","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"app.whatsapp.ih.hl.cn","fqdn":"app.whatsapp.ih.hl.cn","domain":"ih.hl.cn","tld":"hl.cn"},"ip":{"addr":"154.195.74.69","port":0,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-23T15:09:14Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"app.whatsapp.ih.hl.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"app.whatsapp.ih.hl.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null},"summary":[{"fqdn":"app.whatsapp.ih.hl.cn","ip":{"addr":"154.195.74.69","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":32,"request_count":16,"received_data":945067,"sent_data":7390,"comment":"","tags":null,"fingerprints":[{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]},{"name":"jQuery:3.2.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Bootstrap:3.3.7","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Tailwind CSS","description":"Tailwind is a utility-first CSS framework.","website":"https://tailwindcss.com/","common_platform_enumeration":"","icon":"tailwindcss.svg","categories":["UI frameworks"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]},{"name":"Lodash","description":"Lodash is a JavaScript library which provides utility functions for common programming tasks using the functional programming paradigm.","website":"https://www.lodash.com","common_platform_enumeration":"cpe:2.3:a:lodash:lodash:*:*:*:*:*:*:*:*","icon":"Lodash.svg","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cdn.tailwindcss.com","ip":{"addr":"172.67.68.11","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2017-07-20","domain_rank":117330,"first_seen":"2018-07-09T05:46:13Z","last_seen":"2026-07-13T08:19:52.745508Z","alert_count":0,"request_count":2,"received_data":408711,"sent_data":948,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}]},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-07-12T22:42:14.264548Z","alert_count":0,"request_count":2,"received_data":30097,"sent_data":984,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"code.jquery.com","ip":{"addr":"151.101.1.155","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2005-12-10","domain_rank":4915,"first_seen":"2012-05-21T17:28:02Z","last_seen":"2026-07-12T23:52:49.76326Z","alert_count":0,"request_count":1,"received_data":288271,"sent_data":467,"comment":"","tags":null,"fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"web.dcobxs.com","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2023-11-02","domain_rank":0,"first_seen":"2023-11-15T04:57:36Z","last_seen":"2026-05-28T12:24:07.280056Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":460,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"app.whatsapp.ih.hl.cn/","fqdn":"app.whatsapp.ih.hl.cn","domain":"ih.hl.cn","tld":"hl.cn"},"ip":{"addr":"154.195.74.69","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-07-21T14:25:24.619521Z","times_seen":89611,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app.whatsapp.ih.hl.cn/lib/jquery-colResizable/js/jquery-colResizable-1.6.min.js","fqdn":"app.whatsapp.ih.hl.cn","domain":"ih.hl.cn","tld":"hl.cn"},"ip":{"addr":"154.195.74.69","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e289cb315e61253151fadc9b9a63824d","sha1":"ccb6f3fd5f91c7463c1aacadea25d9d63d2b8601","sha256":"df43b04a42d0088dd8b12f7ef3c04c2d2743c1af009acc07a331b8e4da4e9830","sha512":"cdcd859363202ad88be1550be4281d048f2494b5f2b6fbb30933fc65481bafc20247ceda1357d5d065d0a9887fe00e0fc91edb7a227a50207aa3c7df5a786edf","ssdeep":"96:mgfPd892kG0eutk0+DM2Cl7YCfZ4s+WYigQhfp6ir5tzPn5Y2KWDBsomB:mgfP/kcNDMYCfiRbigwp6Cnn5Y5WDOo0","tlshash":"03c1e8497350780f9557a15a382bb91efa220a21eb3bc16ce13ad37d4cf89c48175ebd","size":5817,"data":"","first_seen":"2023-03-13T08:49:18Z","last_seen":"2026-07-19T15:36:35.904106Z","times_seen":105,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app.whatsapp.ih.hl.cn/lib/bootstrap/js/bootbox-4.4.0.min.js","fqdn":"app.whatsapp.ih.hl.cn","domain":"ih.hl.cn","tld":"hl.cn"},"ip":{"addr":"154.195.74.69","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"8055e87f2396a627e93c85890189e625","sha1":"842ff4db865468086582581a540e5b87a128f5ce","sha256":"0b6bab63e3aa24b4ab6aab63765a217db5004961bab1ab7d74ffebfa33efb5c4","sha512":"9a18db6c96ebae906c28f9f6396818dbe838db8c32429927755c6d70ca4894a8fe028678b409c3a93790d8a91ee00ff71f761a21d5c746f9f2de436920617f79","ssdeep":"192:SkLnr8QmxYY72OlfojjuXBacAEkEVg3pXrzTGv6:Sk/8BKrypxPLC3pz46","tlshash":"79228281e819e13726737872308f9706303ad569e65948225241e2d59ffaddc43ffb3a","size":9972,"data":"","first_seen":"2023-03-07T12:04:36Z","last_seen":"2026-07-20T23:44:07.542715Z","times_seen":1040,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app.whatsapp.ih.hl.cn/lib/jsonTree/jsonTree.js","fqdn":"app.whatsapp.ih.hl.cn","domain":"ih.hl.cn","tld":"hl.cn"},"ip":{"addr":"154.195.74.69","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"3ff80e9766a6ef42d85e78a51074ba6a","sha1":"1fbabf173acf615e89ad99fc4ca72ad575241cbd","sha256":"3cc0e2e4d75f991ab09790bc2f9bd86ae39d726c9827f718e367c2ac86098c09","sha512":"1f0d8e61550b2b60f062859cd3b7b63cb73232cadeb53646c1a413dd8f202892b7f996ac60ed8d4453cdbacf32ae8a9e3c2467f2fe2e4499d2cceeed2558201a","ssdeep":"384:JIjJ8s49pyE2DIR4Lb4YSDncH60lqBxzl/4:JId+9pyECIR4LEYSYgB1p4","tlshash":"b3b264153cf762639427f9b50b4f0045f568050fa905acd8bc9e6ab01f98f2459bbafc","size":24674,"data":"","first_seen":"2024-08-19T22:12:06.29686Z","last_seen":"2026-07-19T15:36:35.911706Z","times_seen":88,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app.whatsapp.ih.hl.cn/","fqdn":"app.whatsapp.ih.hl.cn","domain":"ih.hl.cn","tld":"hl.cn"},"ip":{"addr":"154.195.74.69","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-07-21T14:24:44.296044Z","times_seen":729086,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.tailwindcss.com/","fqdn":"cdn.tailwindcss.com","domain":"tailwindcss.com","tld":"com"},"ip":{"addr":"172.67.68.11","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"7a614b9a197e532c00d09a23b0996b5f","sha1":"1ff1738a40f3716e30e9031b181b0955ae578955","sha256":"176e894661aa9cdc9a5cba6c720044cbbf7b8bd80d1c9a142a7c24b1b6c50d15","sha512":"a67bc26f52d938358471be5671ff4b79e11af4e68b486aaf73a35a4c9bf3777aab51101af81563b4e5b7ba4b04dd8971fcfa9ee2c41fb10a0c1ee5604a99abd6","ssdeep":"12288:fpgrZxSAoNbJb0Wie75aUXGuyQZhK4O0s:RCVoNB0Wie75aUWmnO0s","tlshash":"e8844aa57396702647eb51e850ea1042f2beaa38840c44bcf7edd4da39e5e4440fbf79","size":407279,"data":"","first_seen":"2025-07-28T16:58:08.903462Z","last_seen":"2026-07-21T14:22:29.986193Z","times_seen":45281,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app.whatsapp.ih.hl.cn/lib/moment/js/moment-2.20.1.min.js","fqdn":"app.whatsapp.ih.hl.cn","domain":"ih.hl.cn","tld":"hl.cn"},"ip":{"addr":"154.195.74.69","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"5ff1de69e6fd137a6dd511205ea7c49e","sha1":"91a29a02cca99f32598f7b5764c610ab3cc89fba","sha256":"001564a706fd2bd3f1b9bbd1ac732493ac2659c207504f5e0713592d7610f389","sha512":"419fa651f350826ebb4ef5f375352a504886638e1d1394ef5d18197ba45d8e48d12fc99596da7fbc7530ec23f6f46c81706c2743971724200da8f3f43c9af0a4","ssdeep":"768:RmEj5IyZrV7dmUJ8/HhbmINN3vhg+XVspjiCumS5vcAKR1DC:wKxrV7d3g8ixXVspCmcti1+","tlshash":"cc3393ca3646b112176622b5083f490bf33d5959680f0d1df508e9e93979c6e827bfbc","size":51599,"data":"","first_seen":"2023-03-07T01:07:40Z","last_seen":"2026-07-21T06:51:19.171605Z","times_seen":923,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app.whatsapp.ih.hl.cn/js/UpdaterPromise.js","fqdn":"app.whatsapp.ih.hl.cn","domain":"ih.hl.cn","tld":"hl.cn"},"ip":{"addr":"154.195.74.69","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"b751955868ca22533228a0b00b202246","sha1":"d2009cf3ce2d3fb12801fd4904f0f1af0dbb4f90","sha256":"6f5ddd748ae17d89c950678f62d8583aa7fef592597a29305df5cf0af1a691a4","sha512":"846d9030528ee05e44bed9e63c2ab5e570df85a2638c6f052549f6b677647f5b763d6761c19707595c79ef2f46b6a87cf3d34a57cf98107010f341b0b7b14043","ssdeep":"1536:JMN3MzMq3sfeJGS6q1h7lF/af9l4V3aiJLMFUZGARy9:J43+GfAxvy1qqilMoy9","tlshash":"da73528077d1b8c102875bb6b72bb1e6f82a5ce9b1c5484ef500f898f8b9915fed1931","size":74900,"data":"","first_seen":"2025-10-19T01:16:14.590733Z","last_seen":"2026-07-19T15:36:35.901462Z","times_seen":119,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app.whatsapp.ih.hl.cn/","fqdn":"app.whatsapp.ih.hl.cn","domain":"ih.hl.cn","tld":"hl.cn"},"ip":{"addr":"154.195.74.69","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"ec7cd96dc36d63d04dc170b40c6ea49f","sha1":"45c90ba40ea841f1567a75e50d77b169933c522e","sha256":"42125df1e71b4e2dd7c3eaeada41763e79a70082dce89c0f3bd029e0c5c52cfa","sha512":"6be6cfcc50b4f386b57f0963463d43bae68191b2196299b05258bc343d31e52bb6917700f7e041b48ec43be8dfaac1232475c4030aea0e907c2e33d842d216b2","ssdeep":"","tlshash":"9cf0a322588b1efc5263607f2fbe9d2673d7280f4450c0003d4ca410df715c2c601388","size":454,"data":"","first_seen":"2026-07-19T15:09:22.257973Z","last_seen":"2026-07-19T15:36:35.914139Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app.whatsapp.ih.hl.cn/lib/bootstrap/js/bootstrap-3.3.7.min.js","fqdn":"app.whatsapp.ih.hl.cn","domain":"ih.hl.cn","tld":"hl.cn"},"ip":{"addr":"154.195.74.69","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"5869c96cc8f19086aee625d670d741f9","sha1":"430a443d74830fe9be26efca431f448c1b3740f9","sha256":"53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef","sha512":"8b3b64a1bb2f9e329f02d4cd7479065630184ebaed942ee61a9ff9e1ce34c28c0eecb854458977815cf3704a8697fa8a5d096d2761f032b74b70d51da3e37f45","ssdeep":"768:o2rGy27UwlNqMl95qNmCFejhqs8snmi+CSFXfbx8Gf3Zq7Q:Jg73zhq0GvbJ3ZKQ","tlshash":"b6f28606b23031a147efb1e1525b020e7239696ee906907c78b99af53db9c48717bf3d","size":37045,"data":"","first_seen":"2023-03-07T01:02:54Z","last_seen":"2026-07-21T14:28:25.478892Z","times_seen":96022,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app.whatsapp.ih.hl.cn/lib/lodash/js/lodash.min.js","fqdn":"app.whatsapp.ih.hl.cn","domain":"ih.hl.cn","tld":"hl.cn"},"ip":{"addr":"154.195.74.69","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"c8515f131f3194c32a3670c8e274fab6","sha1":"60de6e43c4a2c3326275ab12d4ffd90b2582aee9","sha256":"23258114961c94563c3e7df66f059d487995e01f4ce666f2e5b84f1c499e63cc","sha512":"77fac43371a6dc0f97e2ceecdceb64c15eeb1165598b68ae115416afea2721aaedecc953e8dcd29c3af5ab87fae65d4956c58aa7cedeb95daa8f3c4a8f21c7ad","ssdeep":"1536:VkFd9r+sGaSag+Md2ucB+0L87DsqMq5lkQ:VkFSaMDi67","tlshash":"cd6360c93ac3f41643a364b1406f088bf17eaea5acdda108d0e1f0ec797885dd967e59","size":72772,"data":"","first_seen":"2023-03-07T12:03:35Z","last_seen":"2026-07-20T00:52:24.344033Z","times_seen":615,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app.whatsapp.ih.hl.cn/","fqdn":"app.whatsapp.ih.hl.cn","domain":"ih.hl.cn","tld":"hl.cn"},"ip":{"addr":"154.195.74.69","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-07-21T14:26:00.724687Z","times_seen":235252,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app.whatsapp.ih.hl.cn/lib/jquery/js/jquery-3.2.1.min.js","fqdn":"app.whatsapp.ih.hl.cn","domain":"ih.hl.cn","tld":"hl.cn"},"ip":{"addr":"154.195.74.69","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"c9f5aeeca3ad37bf2aa006139b935f0a","sha1":"1055018c28ab41087ef9ccefe411606893dabea2","sha256":"87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de","sha512":"dcff2b5c2b8625d3593a7531ff4ddcd633939cc9f7acfeb79c18a9e6038fdaa99487960075502f159d44f902d965b0b5aed32b41bfa66a1dc07d85b5d5152b58","ssdeep":"1536:YNhEyjjTikEJO4edXXe9J578go6MWX2xkj8e4c4j2ll2AckaXEP6n15HZ+FhFcQ7:uxc2yjx4j2uX/kcQDU8Cu9","tlshash":"4483e6d9b2c67062977730b950bf410bb17a98dab44c8c60f158d9d47eb8a8d907bf2c","size":86659,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-07-21T12:59:42.899814Z","times_seen":97904,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"warn","text":"cdn.tailwindcss.com should not be used in production. To use Tailwind CSS in production, install it as a PostCSS plugin or use the Tailwind CLI: https://tailwindcss.com/docs/installation","filename":"https://cdn.tailwindcss.com/","line_number":64,"column_number":1711}]},"http":[{"url":{"schema":"https","addr":"app.whatsapp.ih.hl.cn/","fqdn":"app.whatsapp.ih.hl.cn","domain":"ih.hl.cn","tld":"hl.cn"},"ip":{"addr":"154.195.74.69","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-19T15:08:34.302Z","timestamp":1784473714302,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whatsapp.ih.hl.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 18 Jul 2026 14:38:25 GMT","end":"Fri, 16 Oct 2026 14:38:24 GMT"},"fingerprint":{"sha1":"25:BF:F0:31:EC:D2:E0:07:86:F6:ED:7B:FB:7D:D5:4D:AB:F9:77:61","sha256":"CA:36:47:53:28:95:C4:67:71:31:2A:DD:07:30:E1:A8:42:EB:06:17:10:D3:DD:41:8E:46:B9:35:17:83:90:22"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: app.whatsapp.ih.hl.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 19 Jul 2026 15:08:36 GMT\r\ncontent-type: text/html\r\nlast-modified: Sat, 18 Jul 2026 15:37:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a5b9dc4-ce8\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]},{"name":"jQuery:3.2.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Bootstrap:3.3.7","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Tailwind CSS","description":"Tailwind is a utility-first CSS framework.","website":"https://tailwindcss.com/","common_platform_enumeration":"","icon":"tailwindcss.svg","categories":["UI frameworks"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]},{"name":"Lodash","description":"Lodash is a JavaScript library which provides utility functions for common programming tasks using the functional programming paradigm.","website":"https://www.lodash.com","common_platform_enumeration":"cpe:2.3:a:lodash:lodash:*:*:*:*:*:*:*:*","icon":"Lodash.svg","categories":["JavaScript libraries"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3304,"size_decoded":1889,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"34ec123d0ee14548fd06c12a1d1e1c5c","sha1":"7f927f615e7781fea7e0ef3fb71af0d55ec0dd37","sha256":"44a1800db8300ea870961e5a01f18ebe88b011e7296d32123e988ce6e045134f","sha512":"869acde3e637cd8dcc22b54178b974d2b8982c9a10ef14284f3de45cfe8601fc77bf5250671366b28b0bd1d2c5e5a81fc0b92279028fa33bdc6ecbe2d94eaeec","ssdeep":"","tlshash":"0e610347ace6c87e612015cab8f6f42dec9db14ad550cca8b5dc80ba1fa5bc84c57984","first_seen":"2025-10-20T04:23:27.940802Z","last_seen":"2026-07-19T15:36:35.90632Z","times_seen":12,"resource_available":true,"data":null}},"time_used":2099,"timings":{"blocked":-1,"dns":3,"connect":1283,"send":0,"wait":264,"receive":0,"ssl":275},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"app.whatsapp.ih.hl.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"app.whatsapp.ih.hl.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.tailwindcss.com/","fqdn":"cdn.tailwindcss.com","domain":"tailwindcss.com","tld":"com"},"ip":{"addr":"172.67.68.11","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://app.whatsapp.ih.hl.cn/","date":"2026-07-19T15:08:37.037Z","timestamp":1784473717037,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tailwindcss.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 17 Jul 2026 20:38:38 GMT","end":"Thu, 15 Oct 2026 21:38:35 GMT"},"fingerprint":{"sha1":"AF:4F:AD:59:FA:ED:77:04:0D:32:56:48:B0:E5:1B:38:67:6D:7D:02","sha256":"E7:FC:CF:2D:6A:CC:F5:3C:4C:1E:9D:CD:21:8A:72:A3:DB:7C:B1:50:0F:83:D1:DC:E4:AD:25:90:8F:98:37:0F"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: cdn.tailwindcss.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.whatsapp.ih.hl.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\ndate: Sun, 19 Jul 2026 15:08:37 GMT\r\ncache-control: max-age=14400\r\nlocation: /3.4.17\r\nserver: cloudflare\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: MISS\r\nx-vercel-id: fra1::iad1::j6kdv-1784472844719-3d802815900f\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 872\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SA2nHB6r%2BDXV68DGgZnuBZzm6uC8TzekWVCYPj6nkRnrsDJoVDy%2F3B%2FNI4kQzyev%2Bca4YJosjWIbk0MGQqL86iTqyJJaHBIzc46%2BFTFyy4ib68M3Aino1ltoVSaGQJQLx0J%2BUyU%3D\"}]}\r\ncf-ray: a1daa47b9c5d0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/javascript","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-21T14:24:28.807251Z","times_seen":17423368,"resource_available":true,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":3,"connect":1,"send":0,"wait":6,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app.whatsapp.ih.hl.cn/css/spinner_style.css","fqdn":"app.whatsapp.ih.hl.cn","domain":"ih.hl.cn","tld":"hl.cn"},"ip":{"addr":"154.195.74.69","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://app.whatsapp.ih.hl.cn/","date":"2026-07-19T15:08:37.043Z","timestamp":1784473717043,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whatsapp.ih.hl.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 18 Jul 2026 14:38:25 GMT","end":"Fri, 16 Oct 2026 14:38:24 GMT"},"fingerprint":{"sha1":"25:BF:F0:31:EC:D2:E0:07:86:F6:ED:7B:FB:7D:D5:4D:AB:F9:77:61","sha256":"CA:36:47:53:28:95:C4:67:71:31:2A:DD:07:30:E1:A8:42:EB:06:17:10:D3:DD:41:8E:46:B9:35:17:83:90:22"}}},"request":{"raw":"GET /css/spinner_style.css HTTP/1.1\r\nHost: app.whatsapp.ih.hl.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.whatsapp.ih.hl.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 19 Jul 2026 15:08:37 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 09 Jan 2025 04:47:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"677f54f4-986\"\r\nexpires: Mon, 20 Jul 2026 03:08:37 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2438,"size_decoded":1042,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"d3c0fb3e5e8fb8fdec95a92550ac26e6","sha1":"7a6462fd8ca17c42877736b6fa9a17eaf2aaf7cb","sha256":"92503cced30e330d6e7074bca3bcfe0611f21886f737c682b1ff83db1b49ca14","sha512":"635b40841c07044c9b8d25df45e39db9fe0b5765f57d8519e697512babfe9dbb02f243ce95bf948302a12517da3adbae76509b01375246a6a3c3fa670e819156","ssdeep":"","tlshash":"c5412b1e0d8124f6813b937687932c25fb3b5863434a26d5396fad780f32ad81276ef5","first_seen":"2025-10-19T01:16:14.624534Z","last_seen":"2026-07-19T15:36:35.907445Z","times_seen":87,"resource_available":false,"data":null}},"time_used":263,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":263,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"app.whatsapp.ih.hl.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"app.whatsapp.ih.hl.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.whatsapp.ih.hl.cn/lib/jquery-colResizable/js/jquery-colResizable-1.6.min.js","fqdn":"app.whatsapp.ih.hl.cn","domain":"ih.hl.cn","tld":"hl.cn"},"ip":{"addr":"154.195.74.69","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://app.whatsapp.ih.hl.cn/","date":"2026-07-19T15:08:37.056Z","timestamp":1784473717056,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whatsapp.ih.hl.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 18 Jul 2026 14:38:25 GMT","end":"Fri, 16 Oct 2026 14:38:24 GMT"},"fingerprint":{"sha1":"25:BF:F0:31:EC:D2:E0:07:86:F6:ED:7B:FB:7D:D5:4D:AB:F9:77:61","sha256":"CA:36:47:53:28:95:C4:67:71:31:2A:DD:07:30:E1:A8:42:EB:06:17:10:D3:DD:41:8E:46:B9:35:17:83:90:22"}}},"request":{"raw":"GET /lib/jquery-colResizable/js/jquery-colResizable-1.6.min.js HTTP/1.1\r\nHost: app.whatsapp.ih.hl.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.whatsapp.ih.hl.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 19 Jul 2026 15:08:37 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 25 Mar 2024 08:42:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6601390a-16b9\"\r\nexpires: Mon, 20 Jul 2026 03:08:37 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5817,"size_decoded":3103,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (5715)","md5":"e289cb315e61253151fadc9b9a63824d","sha1":"ccb6f3fd5f91c7463c1aacadea25d9d63d2b8601","sha256":"df43b04a42d0088dd8b12f7ef3c04c2d2743c1af009acc07a331b8e4da4e9830","sha512":"cdcd859363202ad88be1550be4281d048f2494b5f2b6fbb30933fc65481bafc20247ceda1357d5d065d0a9887fe00e0fc91edb7a227a50207aa3c7df5a786edf","ssdeep":"96:mgfPd892kG0eutk0+DM2Cl7YCfZ4s+WYigQhfp6ir5tzPn5Y2KWDBsomB:mgfP/kcNDMYCfiRbigwp6Cnn5Y5WDOo0","tlshash":"03c1e8497350780f9557a15a382bb91efa220a21eb3bc16ce13ad37d4cf89c48175ebd","first_seen":"2023-03-13T08:49:18Z","last_seen":"2026-07-19T15:36:35.904106Z","times_seen":105,"resource_available":true,"data":null}},"time_used":794,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":794,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"app.whatsapp.ih.hl.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"app.whatsapp.ih.hl.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.whatsapp.ih.hl.cn/lib/bootstrap/js/bootstrap-3.3.7.min.js","fqdn":"app.whatsapp.ih.hl.cn","domain":"ih.hl.cn","tld":"hl.cn"},"ip":{"addr":"154.195.74.69","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://app.whatsapp.ih.hl.cn/","date":"2026-07-19T15:08:37.057Z","timestamp":1784473717057,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whatsapp.ih.hl.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 18 Jul 2026 14:38:25 GMT","end":"Fri, 16 Oct 2026 14:38:24 GMT"},"fingerprint":{"sha1":"25:BF:F0:31:EC:D2:E0:07:86:F6:ED:7B:FB:7D:D5:4D:AB:F9:77:61","sha256":"CA:36:47:53:28:95:C4:67:71:31:2A:DD:07:30:E1:A8:42:EB:06:17:10:D3:DD:41:8E:46:B9:35:17:83:90:22"}}},"request":{"raw":"GET /lib/bootstrap/js/bootstrap-3.3.7.min.js HTTP/1.1\r\nHost: app.whatsapp.ih.hl.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.whatsapp.ih.hl.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 19 Jul 2026 15:08:37 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 25 Mar 2024 08:42:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6601390a-90b5\"\r\nexpires: Mon, 20 Jul 2026 03:08:37 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":37045,"size_decoded":10451,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (32033)","md5":"5869c96cc8f19086aee625d670d741f9","sha1":"430a443d74830fe9be26efca431f448c1b3740f9","sha256":"53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef","sha512":"8b3b64a1bb2f9e329f02d4cd7479065630184ebaed942ee61a9ff9e1ce34c28c0eecb854458977815cf3704a8697fa8a5d096d2761f032b74b70d51da3e37f45","ssdeep":"768:o2rGy27UwlNqMl95qNmCFejhqs8snmi+CSFXfbx8Gf3Zq7Q:Jg73zhq0GvbJ3ZKQ","tlshash":"b6f28606b23031a147efb1e1525b020e7239696ee906907c78b99af53db9c48717bf3d","first_seen":"2023-03-07T01:02:54Z","last_seen":"2026-07-21T14:28:25.478892Z","times_seen":96022,"resource_available":true,"data":null}},"time_used":791,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":791,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"app.whatsapp.ih.hl.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"app.whatsapp.ih.hl.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.whatsapp.ih.hl.cn/js/UpdaterPromise.js","fqdn":"app.whatsapp.ih.hl.cn","domain":"ih.hl.cn","tld":"hl.cn"},"ip":{"addr":"154.195.74.69","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://app.whatsapp.ih.hl.cn/","date":"2026-07-19T15:08:37.065Z","timestamp":1784473717065,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whatsapp.ih.hl.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 18 Jul 2026 14:38:25 GMT","end":"Fri, 16 Oct 2026 14:38:24 GMT"},"fingerprint":{"sha1":"25:BF:F0:31:EC:D2:E0:07:86:F6:ED:7B:FB:7D:D5:4D:AB:F9:77:61","sha256":"CA:36:47:53:28:95:C4:67:71:31:2A:DD:07:30:E1:A8:42:EB:06:17:10:D3:DD:41:8E:46:B9:35:17:83:90:22"}}},"request":{"raw":"GET /js/UpdaterPromise.js HTTP/1.1\r\nHost: app.whatsapp.ih.hl.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.whatsapp.ih.hl.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 19 Jul 2026 15:08:37 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 25 Jun 2024 22:31:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"667b4550-12494\"\r\nexpires: Mon, 20 Jul 2026 03:08:37 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":74900,"size_decoded":30207,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"b751955868ca22533228a0b00b202246","sha1":"d2009cf3ce2d3fb12801fd4904f0f1af0dbb4f90","sha256":"6f5ddd748ae17d89c950678f62d8583aa7fef592597a29305df5cf0af1a691a4","sha512":"846d9030528ee05e44bed9e63c2ab5e570df85a2638c6f052549f6b677647f5b763d6761c19707595c79ef2f46b6a87cf3d34a57cf98107010f341b0b7b14043","ssdeep":"1536:JMN3MzMq3sfeJGS6q1h7lF/af9l4V3aiJLMFUZGARy9:J43+GfAxvy1qqilMoy9","tlshash":"da73528077d1b8c102875bb6b72bb1e6f82a5ce9b1c5484ef500f898f8b9915fed1931","first_seen":"2025-10-19T01:16:14.590733Z","last_seen":"2026-07-19T15:36:35.901462Z","times_seen":119,"resource_available":true,"data":null}},"time_used":785,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":785,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"app.whatsapp.ih.hl.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"app.whatsapp.ih.hl.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.whatsapp.ih.hl.cn/js/main.js","fqdn":"app.whatsapp.ih.hl.cn","domain":"ih.hl.cn","tld":"hl.cn"},"ip":{"addr":"154.195.74.69","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://app.whatsapp.ih.hl.cn/","date":"2026-07-19T15:08:37.070Z","timestamp":1784473717070,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whatsapp.ih.hl.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 18 Jul 2026 14:38:25 GMT","end":"Fri, 16 Oct 2026 14:38:24 GMT"},"fingerprint":{"sha1":"25:BF:F0:31:EC:D2:E0:07:86:F6:ED:7B:FB:7D:D5:4D:AB:F9:77:61","sha256":"CA:36:47:53:28:95:C4:67:71:31:2A:DD:07:30:E1:A8:42:EB:06:17:10:D3:DD:41:8E:46:B9:35:17:83:90:22"}}},"request":{"raw":"GET /js/main.js HTTP/1.1\r\nHost: app.whatsapp.ih.hl.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.whatsapp.ih.hl.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 19 Jul 2026 15:08:37 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sun, 16 Mar 2025 18:49:28 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67d71d38-1f458\"\r\nexpires: Mon, 20 Jul 2026 03:08:37 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":128088,"size_decoded":49782,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"d0117a3218db3fb3bf6757de07c481e2","sha1":"97d6f8b06249ec39ebdce4e9c10b03e10d515ef8","sha256":"2f6233c3c2f2ded13630778b83a60d2f0b93cc7eb00ba59e6a0355f41afba7d5","sha512":"74e99ff3b88e39fd2b670894820f32a60a05c687100931cf91e811a5c8f45f024e550a7ba6a311d805873b2933e0f503c07a9caf4091a12c5d50b20be36ad88c","ssdeep":"3072:YgRqiDilIWUKSPXye5ZkrPlepHzLJXHuoR:tDiaWU7Xye5ZkrPYz9Oe","tlshash":"8ec35180b7c2bc8116875b72732bb2e9f52d4de97589488bf500fc94f5ba911fae0931","first_seen":"2025-10-19T01:16:14.594234Z","last_seen":"2026-07-19T15:36:35.908644Z","times_seen":82,"resource_available":false,"data":null}},"time_used":781,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":781,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"app.whatsapp.ih.hl.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"app.whatsapp.ih.hl.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.tailwindcss.com/3.4.17","fqdn":"cdn.tailwindcss.com","domain":"tailwindcss.com","tld":"com"},"ip":{"addr":"172.67.68.11","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://app.whatsapp.ih.hl.cn/","date":"2026-07-19T15:08:37.102Z","timestamp":1784473717102,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tailwindcss.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 17 Jul 2026 20:38:38 GMT","end":"Thu, 15 Oct 2026 21:38:35 GMT"},"fingerprint":{"sha1":"AF:4F:AD:59:FA:ED:77:04:0D:32:56:48:B0:E5:1B:38:67:6D:7D:02","sha256":"E7:FC:CF:2D:6A:CC:F5:3C:4C:1E:9D:CD:21:8A:72:A3:DB:7C:B1:50:0F:83:D1:DC:E4:AD:25:90:8F:98:37:0F"}}},"request":{"raw":"GET /3.4.17 HTTP/1.1\r\nHost: cdn.tailwindcss.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://app.whatsapp.ih.hl.cn/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Sun, 19 Jul 2026 15:08:37 GMT\r\ncontent-type: text/javascript\r\ncache-control: max-age=31536000\r\ncontent-encoding: br\r\nserver: cloudflare\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: MISS\r\nx-vercel-id: fra1::iad1::bj55r-1781146628084-40ce7f37f405\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\nage: 3327088\r\nlast-modified: Wed, 01 Jul 2026 01:49:34 GMT\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=T5TSzx74SMC4CiOvS4mWP9cMnw1iRc8gXZ7vcef7OrhOOiZYeafVs1p%2FOZVaDw9Mw1xy1R40tO781%2FDAQ36y6Iev4%2FVuKYFoeYS7HXzmKmjLvqjoXIx2QcBXq%2FgBeDw5bc%2FaGDs%3D\"}]}\r\ncf-ray: a1daa47bed6d0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":407279,"size_decoded":127124,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (52853)","md5":"7a614b9a197e532c00d09a23b0996b5f","sha1":"1ff1738a40f3716e30e9031b181b0955ae578955","sha256":"176e894661aa9cdc9a5cba6c720044cbbf7b8bd80d1c9a142a7c24b1b6c50d15","sha512":"a67bc26f52d938358471be5671ff4b79e11af4e68b486aaf73a35a4c9bf3777aab51101af81563b4e5b7ba4b04dd8971fcfa9ee2c41fb10a0c1ee5604a99abd6","ssdeep":"12288:fpgrZxSAoNbJb0Wie75aUXGuyQZhK4O0s:RCVoNB0Wie75aUWmnO0s","tlshash":"e8844aa57396702647eb51e850ea1042f2beaa38840c44bcf7edd4da39e5e4440fbf79","first_seen":"2025-07-28T16:58:08.903462Z","last_seen":"2026-07-21T14:22:29.986193Z","times_seen":45281,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app.whatsapp.ih.hl.cn/css/main.css","fqdn":"app.whatsapp.ih.hl.cn","domain":"ih.hl.cn","tld":"hl.cn"},"ip":{"addr":"154.195.74.69","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://app.whatsapp.ih.hl.cn/","date":"2026-07-19T15:08:37.040Z","timestamp":1784473717040,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whatsapp.ih.hl.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 18 Jul 2026 14:38:25 GMT","end":"Fri, 16 Oct 2026 14:38:24 GMT"},"fingerprint":{"sha1":"25:BF:F0:31:EC:D2:E0:07:86:F6:ED:7B:FB:7D:D5:4D:AB:F9:77:61","sha256":"CA:36:47:53:28:95:C4:67:71:31:2A:DD:07:30:E1:A8:42:EB:06:17:10:D3:DD:41:8E:46:B9:35:17:83:90:22"}}},"request":{"raw":"GET /css/main.css HTTP/1.1\r\nHost: app.whatsapp.ih.hl.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.whatsapp.ih.hl.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 19 Jul 2026 15:08:37 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 09 Jan 2025 04:37:52 GMT\r\nvary: Accept-Encoding\r\netag: W/\"677f52a0-1db1\"\r\nexpires: Mon, 20 Jul 2026 03:08:37 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7601,"size_decoded":2569,"mime_type":"text/css","magic":"ASCII text","md5":"bcae2c55fc15557c686667b5211d6666","sha1":"29bb2f9fe5e429b85fbf1a9735a6c6933ff93ec7","sha256":"1cb533af5df98df30a59d6414fe34f4d407c9ec8de77e537c58c914328429261","sha512":"2f3b0d22229a699b558ac1d25204c658921b282c04c818e8b39eb6e03d6893f26a5f2c11061af3d7022dddde681b45319416db8c9bc1bda55fab9265ae1ba004","ssdeep":"192:3gssXtsPqjDZrugVO4Dy4JscL7MsABM4pquQJNPi:3bx9ZcyU3vz1DHPi","tlshash":"23f103d15fb62508b4afd06d7851eb19a72dc582e64fcc786be1200cddc92cd19b7b88","first_seen":"2025-10-19T01:16:14.641958Z","last_seen":"2026-07-19T15:36:35.901952Z","times_seen":87,"resource_available":false,"data":null}},"time_used":263,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":263,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"app.whatsapp.ih.hl.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"app.whatsapp.ih.hl.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.whatsapp.ih.hl.cn/static/css/main.4ab9b89d.css","fqdn":"app.whatsapp.ih.hl.cn","domain":"ih.hl.cn","tld":"hl.cn"},"ip":{"addr":"154.195.74.69","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://app.whatsapp.ih.hl.cn/","date":"2026-07-19T15:08:37.048Z","timestamp":1784473717048,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whatsapp.ih.hl.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 18 Jul 2026 14:38:25 GMT","end":"Fri, 16 Oct 2026 14:38:24 GMT"},"fingerprint":{"sha1":"25:BF:F0:31:EC:D2:E0:07:86:F6:ED:7B:FB:7D:D5:4D:AB:F9:77:61","sha256":"CA:36:47:53:28:95:C4:67:71:31:2A:DD:07:30:E1:A8:42:EB:06:17:10:D3:DD:41:8E:46:B9:35:17:83:90:22"}}},"request":{"raw":"GET /static/css/main.4ab9b89d.css HTTP/1.1\r\nHost: app.whatsapp.ih.hl.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.whatsapp.ih.hl.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 19 Jul 2026 15:08:37 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 15 Mar 2025 21:47:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67d5f580-74c\"\r\nexpires: Mon, 20 Jul 2026 03:08:37 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1868,"size_decoded":1403,"mime_type":"text/css","magic":"ASCII text, with very long lines (1823)","md5":"e5c7d3176160705a7932fc2e17a93774","sha1":"21a62d2bc514a07d9181edc2f9c84ff70db9cd3a","sha256":"0aec1499759884b05c5dc4795c5e6aacd16f2c93025a8bdbc8e95a17b8ba04cc","sha512":"11b07b7d3f270a5a4d4a2aa2de1072163e845dfcd1559e5cb301173fa43846caa24b8bf2746f24919f15612ddb67922550b0f645249162125838c1e90ce975e7","ssdeep":"","tlshash":"35318835eb08103fe17bc63b5295f80170262853da63876eb997b724cac35502a37b54","first_seen":"2025-10-19T01:16:14.631743Z","last_seen":"2026-07-19T15:36:35.902498Z","times_seen":87,"resource_available":false,"data":null}},"time_used":800,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":800,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"app.whatsapp.ih.hl.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"app.whatsapp.ih.hl.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.whatsapp.ih.hl.cn/lib/lodash/js/lodash.min.js","fqdn":"app.whatsapp.ih.hl.cn","domain":"ih.hl.cn","tld":"hl.cn"},"ip":{"addr":"154.195.74.69","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://app.whatsapp.ih.hl.cn/","date":"2026-07-19T15:08:37.050Z","timestamp":1784473717050,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whatsapp.ih.hl.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 18 Jul 2026 14:38:25 GMT","end":"Fri, 16 Oct 2026 14:38:24 GMT"},"fingerprint":{"sha1":"25:BF:F0:31:EC:D2:E0:07:86:F6:ED:7B:FB:7D:D5:4D:AB:F9:77:61","sha256":"CA:36:47:53:28:95:C4:67:71:31:2A:DD:07:30:E1:A8:42:EB:06:17:10:D3:DD:41:8E:46:B9:35:17:83:90:22"}}},"request":{"raw":"GET /lib/lodash/js/lodash.min.js HTTP/1.1\r\nHost: app.whatsapp.ih.hl.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.whatsapp.ih.hl.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 19 Jul 2026 15:08:37 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 25 Mar 2024 08:42:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6601390a-11c44\"\r\nexpires: Mon, 20 Jul 2026 03:08:37 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":72772,"size_decoded":24951,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (4357)","md5":"c8515f131f3194c32a3670c8e274fab6","sha1":"60de6e43c4a2c3326275ab12d4ffd90b2582aee9","sha256":"23258114961c94563c3e7df66f059d487995e01f4ce666f2e5b84f1c499e63cc","sha512":"77fac43371a6dc0f97e2ceecdceb64c15eeb1165598b68ae115416afea2721aaedecc953e8dcd29c3af5ab87fae65d4956c58aa7cedeb95daa8f3c4a8f21c7ad","ssdeep":"1536:VkFd9r+sGaSag+Md2ucB+0L87DsqMq5lkQ:VkFSaMDi67","tlshash":"cd6360c93ac3f41643a364b1406f088bf17eaea5acdda108d0e1f0ec797885dd967e59","first_seen":"2023-03-07T12:03:35Z","last_seen":"2026-07-20T00:52:24.344033Z","times_seen":615,"resource_available":true,"data":null}},"time_used":799,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":799,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"app.whatsapp.ih.hl.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"app.whatsapp.ih.hl.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.whatsapp.ih.hl.cn/lib/bootstrap/js/bootbox-4.4.0.min.js","fqdn":"app.whatsapp.ih.hl.cn","domain":"ih.hl.cn","tld":"hl.cn"},"ip":{"addr":"154.195.74.69","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://app.whatsapp.ih.hl.cn/","date":"2026-07-19T15:08:37.059Z","timestamp":1784473717059,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whatsapp.ih.hl.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 18 Jul 2026 14:38:25 GMT","end":"Fri, 16 Oct 2026 14:38:24 GMT"},"fingerprint":{"sha1":"25:BF:F0:31:EC:D2:E0:07:86:F6:ED:7B:FB:7D:D5:4D:AB:F9:77:61","sha256":"CA:36:47:53:28:95:C4:67:71:31:2A:DD:07:30:E1:A8:42:EB:06:17:10:D3:DD:41:8E:46:B9:35:17:83:90:22"}}},"request":{"raw":"GET /lib/bootstrap/js/bootbox-4.4.0.min.js HTTP/1.1\r\nHost: app.whatsapp.ih.hl.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.whatsapp.ih.hl.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 19 Jul 2026 15:08:37 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 25 Mar 2024 08:42:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6601390a-26f4\"\r\nexpires: Mon, 20 Jul 2026 03:08:37 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9972,"size_decoded":4246,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (9748)","md5":"8055e87f2396a627e93c85890189e625","sha1":"842ff4db865468086582581a540e5b87a128f5ce","sha256":"0b6bab63e3aa24b4ab6aab63765a217db5004961bab1ab7d74ffebfa33efb5c4","sha512":"9a18db6c96ebae906c28f9f6396818dbe838db8c32429927755c6d70ca4894a8fe028678b409c3a93790d8a91ee00ff71f761a21d5c746f9f2de436920617f79","ssdeep":"192:SkLnr8QmxYY72OlfojjuXBacAEkEVg3pXrzTGv6:Sk/8BKrypxPLC3pz46","tlshash":"79228281e819e13726737872308f9706303ad569e65948225241e2d59ffaddc43ffb3a","first_seen":"2023-03-07T12:04:36Z","last_seen":"2026-07-20T23:44:07.542715Z","times_seen":1040,"resource_available":true,"data":null}},"time_used":790,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":790,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"app.whatsapp.ih.hl.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"app.whatsapp.ih.hl.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.whatsapp.ih.hl.cn/lib/jsonTree/jsonTree.js","fqdn":"app.whatsapp.ih.hl.cn","domain":"ih.hl.cn","tld":"hl.cn"},"ip":{"addr":"154.195.74.69","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://app.whatsapp.ih.hl.cn/","date":"2026-07-19T15:08:37.062Z","timestamp":1784473717062,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whatsapp.ih.hl.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 18 Jul 2026 14:38:25 GMT","end":"Fri, 16 Oct 2026 14:38:24 GMT"},"fingerprint":{"sha1":"25:BF:F0:31:EC:D2:E0:07:86:F6:ED:7B:FB:7D:D5:4D:AB:F9:77:61","sha256":"CA:36:47:53:28:95:C4:67:71:31:2A:DD:07:30:E1:A8:42:EB:06:17:10:D3:DD:41:8E:46:B9:35:17:83:90:22"}}},"request":{"raw":"GET /lib/jsonTree/jsonTree.js HTTP/1.1\r\nHost: app.whatsapp.ih.hl.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.whatsapp.ih.hl.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 19 Jul 2026 15:08:37 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 25 Mar 2024 08:42:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6601390a-6062\"\r\nexpires: Mon, 20 Jul 2026 03:08:37 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24674,"size_decoded":5584,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"3ff80e9766a6ef42d85e78a51074ba6a","sha1":"1fbabf173acf615e89ad99fc4ca72ad575241cbd","sha256":"3cc0e2e4d75f991ab09790bc2f9bd86ae39d726c9827f718e367c2ac86098c09","sha512":"1f0d8e61550b2b60f062859cd3b7b63cb73232cadeb53646c1a413dd8f202892b7f996ac60ed8d4453cdbacf32ae8a9e3c2467f2fe2e4499d2cceeed2558201a","ssdeep":"384:JIjJ8s49pyE2DIR4Lb4YSDncH60lqBxzl/4:JId+9pyECIR4LEYSYgB1p4","tlshash":"b3b264153cf762639427f9b50b4f0045f568050fa905acd8bc9e6ab01f98f2459bbafc","first_seen":"2024-08-19T22:12:06.29686Z","last_seen":"2026-07-19T15:36:35.911706Z","times_seen":88,"resource_available":true,"data":null}},"time_used":788,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":788,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"app.whatsapp.ih.hl.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"app.whatsapp.ih.hl.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.whatsapp.ih.hl.cn/lib/moment/js/moment-2.20.1.min.js","fqdn":"app.whatsapp.ih.hl.cn","domain":"ih.hl.cn","tld":"hl.cn"},"ip":{"addr":"154.195.74.69","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://app.whatsapp.ih.hl.cn/","date":"2026-07-19T15:08:37.064Z","timestamp":1784473717064,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whatsapp.ih.hl.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 18 Jul 2026 14:38:25 GMT","end":"Fri, 16 Oct 2026 14:38:24 GMT"},"fingerprint":{"sha1":"25:BF:F0:31:EC:D2:E0:07:86:F6:ED:7B:FB:7D:D5:4D:AB:F9:77:61","sha256":"CA:36:47:53:28:95:C4:67:71:31:2A:DD:07:30:E1:A8:42:EB:06:17:10:D3:DD:41:8E:46:B9:35:17:83:90:22"}}},"request":{"raw":"GET /lib/moment/js/moment-2.20.1.min.js HTTP/1.1\r\nHost: app.whatsapp.ih.hl.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.whatsapp.ih.hl.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 19 Jul 2026 15:08:37 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 25 Mar 2024 08:42:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6601390a-c98f\"\r\nexpires: Mon, 20 Jul 2026 03:08:37 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":51599,"size_decoded":17355,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (51599), with no line terminators","md5":"5ff1de69e6fd137a6dd511205ea7c49e","sha1":"91a29a02cca99f32598f7b5764c610ab3cc89fba","sha256":"001564a706fd2bd3f1b9bbd1ac732493ac2659c207504f5e0713592d7610f389","sha512":"419fa651f350826ebb4ef5f375352a504886638e1d1394ef5d18197ba45d8e48d12fc99596da7fbc7530ec23f6f46c81706c2743971724200da8f3f43c9af0a4","ssdeep":"768:RmEj5IyZrV7dmUJ8/HhbmINN3vhg+XVspjiCumS5vcAKR1DC:wKxrV7d3g8ixXVspCmcti1+","tlshash":"cc3393ca3646b112176622b5083f490bf33d5959680f0d1df508e9e93979c6e827bfbc","first_seen":"2023-03-07T01:07:40Z","last_seen":"2026-07-21T06:51:19.171605Z","times_seen":923,"resource_available":true,"data":null}},"time_used":787,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":787,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"app.whatsapp.ih.hl.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"app.whatsapp.ih.hl.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/uuid/8.3.2/uuid.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://app.whatsapp.ih.hl.cn/","date":"2026-07-19T15:08:37.076Z","timestamp":1784473717076,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Jul 2026 07:07:58 GMT","end":"Thu, 08 Oct 2026 08:07:45 GMT"},"fingerprint":{"sha1":"DF:66:97:F5:13:A2:C0:81:D3:5B:60:C4:B0:7F:CD:78:F5:91:14:D5","sha256":"3C:F2:95:73:83:BA:4D:D9:CC:85:8F:BC:7D:2C:22:CF:F3:49:9A:3A:E4:1D:FC:AE:CB:07:3D:66:89:74:0E:C5"}}},"request":{"raw":"GET /ajax/libs/uuid/8.3.2/uuid.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.whatsapp.ih.hl.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Sun, 19 Jul 2026 15:08:37 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 2933\r\ncf-cache-status: BYPASS\r\naccess-control-allow-origin: *\r\ncache-control: no-transform, public, s-maxage=30672000, max-age=30672000, immutable\r\ncontent-encoding: br\r\nlast-modified: Mon, 21 Dec 2020 09:31:31 GMT\r\nvary: Accept-Encoding\r\nx-cdnjs-cache: HIT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/r2\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=raVfaeMe2OcZQ1m8XVu374MXESSwf5kZpL%2F%2BLXrousjWSPw17thdSREjsnD85q6rSUZPBCqllGQMURsvIteAHs3MRMfNDlohBllN61%2BoMYhnnzs56tlft4yQrqHIsyGoWll22SYK\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nserver: cloudflare\r\ncf-ray: a1daa47bceb2c759-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8160,"size_decoded":3937,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (8160), with no line terminators","md5":"50fecb6517141ce734bdc903aeb7aa6d","sha1":"ffce0e94a0a6f3b661942c5f9344e709773ec44a","sha256":"c5df6d9704bdada96df0770523058f395192ee9d1fe13880eb1d57dfe6417533","sha512":"50d3359e302038551aef86746c00f002af206d372a642f048f8c4f4b3a6787497a28c7afc2f901bdb95d17db91fbea8a789f8c3991d18d5d47663a11be30df35","ssdeep":"192:NT/XsoaxLo7L1AsLVllMA5/VYZncbsPYxb2g9n/m5iCyK08l9l4E+kghMnf4W5Qe:VX9aNo7LWsLPnYZncbs5UeiCyK0Q9l4W","tlshash":"d7f193ac6c8960afc3ef1e5d18aa304b72f07511244d8415f2a5b9fa1490eff9b36e1d","first_seen":"2023-03-29T21:08:33Z","last_seen":"2026-07-21T01:49:27.671197Z","times_seen":825,"resource_available":true,"data":null}},"time_used":70,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":70,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-3.5.1.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.1.155","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://app.whatsapp.ih.hl.cn/","date":"2026-07-19T15:08:37.077Z","timestamp":1784473717077,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jquery.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV E36","organization":"Sectigo Limited"},"validity":{"start":"Wed, 20 May 2026 00:00:00 GMT","end":"Fri, 04 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"DE:F8:0F:C4:8F:BC:F5:01:B1:66:91:CC:15:DC:D8:6E:5D:2F:45:4E","sha256":"05:8E:2E:14:85:E2:41:28:F5:18:A4:37:49:31:2B:0E:24:53:64:3F:02:15:BE:63:EF:F4:B8:53:5A:8B:6D:29"}}},"request":{"raw":"GET /jquery-3.5.1.js HTTP/1.1\r\nHost: code.jquery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.whatsapp.ih.hl.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 18 Oct 1991 12:00:00 GMT\r\netag: W/\"28feccc0-4638e\"\r\ncache-control: public, max-age=31536000, stale-while-revalidate=604800\r\naccess-control-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nvia: 1.1 varnish, 1.1 varnish\r\naccept-ranges: bytes\r\ndate: Sun, 19 Jul 2026 15:08:37 GMT\r\nage: 1921648\r\nx-served-by: cache-lga21971-LGA, cache-bma-essb1270069-BMA\r\nx-cache: HIT, HIT\r\nx-cache-hits: 14869, 11897\r\nx-timer: S1784473717.111977,VS0,VE0\r\nvary: Accept-Encoding\r\ncontent-length: 84374\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":287630,"size_decoded":85015,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"23c7c5d2d1317508e807a6c7f777d6ed","sha1":"ad16c4a132ad2a03b4951185fed46d55397b5e88","sha256":"416a3b2c3bf16d64f6b5b6d0f7b079df2267614dd6847fc2f3271b4409233c37","sha512":"58d2f17cfffc71560bf6c8fc267a7a7add0192e6cb3f7d638531bdbe12ff179b84666839c04ccaa17a75909b25ccf416c0f4f57b23224b194a0a0cc72ce4ce4d","ssdeep":"6144:pJChNVls+TCtlFhTzeKR7cYmD2zK8EAbEtPx+WI+Y7cFyW48L/dyVxNaIPfytrAP:xf7cYmD43APx+WI+Y7cFyMyDTPfCAeuH","tlshash":"2354a4d9f78d112e423231aaac2f12cdb77cd171560458aebd4d597c24a083d83baf7a","first_seen":"2023-03-07T01:03:32Z","last_seen":"2026-07-21T12:33:58.532628Z","times_seen":8857,"resource_available":true,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":1,"connect":9,"send":0,"wait":12,"receive":11,"ssl":21},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"app.whatsapp.ih.hl.cn/js/WebSocketClient.js","fqdn":"app.whatsapp.ih.hl.cn","domain":"ih.hl.cn","tld":"hl.cn"},"ip":{"addr":"154.195.74.69","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://app.whatsapp.ih.hl.cn/","date":"2026-07-19T15:08:37.067Z","timestamp":1784473717067,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whatsapp.ih.hl.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 18 Jul 2026 14:38:25 GMT","end":"Fri, 16 Oct 2026 14:38:24 GMT"},"fingerprint":{"sha1":"25:BF:F0:31:EC:D2:E0:07:86:F6:ED:7B:FB:7D:D5:4D:AB:F9:77:61","sha256":"CA:36:47:53:28:95:C4:67:71:31:2A:DD:07:30:E1:A8:42:EB:06:17:10:D3:DD:41:8E:46:B9:35:17:83:90:22"}}},"request":{"raw":"GET /js/WebSocketClient.js HTTP/1.1\r\nHost: app.whatsapp.ih.hl.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.whatsapp.ih.hl.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 19 Jul 2026 15:08:37 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 26 Jun 2024 15:32:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"667c349e-220b3\"\r\nexpires: Mon, 20 Jul 2026 03:08:37 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":139443,"size_decoded":55289,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"d26219a6baeda6762dccb88c3cd692a8","sha1":"c3e5f409115d29e117607cc2eca6ef5317af210b","sha256":"e597eb5fcb211106d53ea3940d0bde89b178b093c12ada9de57f81169302ffca","sha512":"6db1170ab0c4571fc3aeed48e785dbf62bc3d03564d1c9b0dee993134db75bf85dea93e345ef801bbb7bc384446c1894705da2725900e2937303b207358962f8","ssdeep":"3072:NLnP1eVKU+ytfF6DyIA7kvo1kis3hQdhnNFn:99VytfL7kA1U3ydhnNFn","tlshash":"6ad3938177c6b88122471bb7772bb1e9f92e4dd870c9088bf154bc98f5b9911fae4930","first_seen":"2025-10-19T01:16:14.653859Z","last_seen":"2026-07-19T15:36:35.908047Z","times_seen":117,"resource_available":false,"data":null}},"time_used":783,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":783,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"app.whatsapp.ih.hl.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"app.whatsapp.ih.hl.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.whatsapp.ih.hl.cn/static/js/main.6c724e39.js","fqdn":"app.whatsapp.ih.hl.cn","domain":"ih.hl.cn","tld":"hl.cn"},"ip":{"addr":"154.195.74.69","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://app.whatsapp.ih.hl.cn/","date":"2026-07-19T15:08:37.045Z","timestamp":1784473717045,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whatsapp.ih.hl.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 18 Jul 2026 14:38:25 GMT","end":"Fri, 16 Oct 2026 14:38:24 GMT"},"fingerprint":{"sha1":"25:BF:F0:31:EC:D2:E0:07:86:F6:ED:7B:FB:7D:D5:4D:AB:F9:77:61","sha256":"CA:36:47:53:28:95:C4:67:71:31:2A:DD:07:30:E1:A8:42:EB:06:17:10:D3:DD:41:8E:46:B9:35:17:83:90:22"}}},"request":{"raw":"GET /static/js/main.6c724e39.js HTTP/1.1\r\nHost: app.whatsapp.ih.hl.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.whatsapp.ih.hl.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 19 Jul 2026 15:08:37 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sat, 15 Mar 2025 21:47:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67d5f580-34091\"\r\nexpires: Mon, 20 Jul 2026 03:08:37 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":213137,"size_decoded":71852,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65465)","md5":"26a8b96a4e2f8ec33a08c340b726c50f","sha1":"1d3204f433b0c7d2f042083094bb1ab17317e3fb","sha256":"7dd85aca2c29abbe85ca1f14cb376ed30e3a9e64a6cb35f9b3f726b1a8784e82","sha512":"7b0de1dfa7540cb4d3e50d5792f61299036de1c8e2e3a9c56a3a64e36cd1cf80f7baf6bdf8a5edd796c6ab75d014d596a1abf53924faaac96c518b5d548886ca","ssdeep":"3072:lqwTemJdjlGG+5tMiGfV+rY2MPeiwXMLthI+:lfTpJdouiwV+rY2MPeiwXathI+","tlshash":"68241ae83955f5516eb343f710af1807737c2a2b280d4da0a211fd9db4b809eb17be99","first_seen":"2025-10-19T01:16:14.645533Z","last_seen":"2026-07-19T15:36:35.911199Z","times_seen":87,"resource_available":true,"data":null}},"time_used":538,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":538,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"app.whatsapp.ih.hl.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"app.whatsapp.ih.hl.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.whatsapp.ih.hl.cn/lib/jquery/js/jquery-3.2.1.min.js","fqdn":"app.whatsapp.ih.hl.cn","domain":"ih.hl.cn","tld":"hl.cn"},"ip":{"addr":"154.195.74.69","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://app.whatsapp.ih.hl.cn/","date":"2026-07-19T15:08:37.053Z","timestamp":1784473717053,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whatsapp.ih.hl.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 18 Jul 2026 14:38:25 GMT","end":"Fri, 16 Oct 2026 14:38:24 GMT"},"fingerprint":{"sha1":"25:BF:F0:31:EC:D2:E0:07:86:F6:ED:7B:FB:7D:D5:4D:AB:F9:77:61","sha256":"CA:36:47:53:28:95:C4:67:71:31:2A:DD:07:30:E1:A8:42:EB:06:17:10:D3:DD:41:8E:46:B9:35:17:83:90:22"}}},"request":{"raw":"GET /lib/jquery/js/jquery-3.2.1.min.js HTTP/1.1\r\nHost: app.whatsapp.ih.hl.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.whatsapp.ih.hl.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 19 Jul 2026 15:08:37 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 25 Mar 2024 08:42:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6601390a-15283\"\r\nexpires: Mon, 20 Jul 2026 03:08:37 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":86659,"size_decoded":30915,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (32058)","md5":"c9f5aeeca3ad37bf2aa006139b935f0a","sha1":"1055018c28ab41087ef9ccefe411606893dabea2","sha256":"87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de","sha512":"dcff2b5c2b8625d3593a7531ff4ddcd633939cc9f7acfeb79c18a9e6038fdaa99487960075502f159d44f902d965b0b5aed32b41bfa66a1dc07d85b5d5152b58","ssdeep":"1536:YNhEyjjTikEJO4edXXe9J578go6MWX2xkj8e4c4j2ll2AckaXEP6n15HZ+FhFcQ7:uxc2yjx4j2uX/kcQDU8Cu9","tlshash":"4483e6d9b2c67062977730b950bf410bb17a98dab44c8c60f158d9d47eb8a8d907bf2c","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-07-21T12:59:42.899814Z","times_seen":97904,"resource_available":true,"data":null}},"time_used":797,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":797,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"app.whatsapp.ih.hl.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"app.whatsapp.ih.hl.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"app.whatsapp.ih.hl.cn/js/BootstrapStep.js","fqdn":"app.whatsapp.ih.hl.cn","domain":"ih.hl.cn","tld":"hl.cn"},"ip":{"addr":"154.195.74.69","port":443,"asn":54467,"as":"XNNET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://app.whatsapp.ih.hl.cn/","date":"2026-07-19T15:08:37.069Z","timestamp":1784473717069,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"whatsapp.ih.hl.cn","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sat, 18 Jul 2026 14:38:25 GMT","end":"Fri, 16 Oct 2026 14:38:24 GMT"},"fingerprint":{"sha1":"25:BF:F0:31:EC:D2:E0:07:86:F6:ED:7B:FB:7D:D5:4D:AB:F9:77:61","sha256":"CA:36:47:53:28:95:C4:67:71:31:2A:DD:07:30:E1:A8:42:EB:06:17:10:D3:DD:41:8E:46:B9:35:17:83:90:22"}}},"request":{"raw":"GET /js/BootstrapStep.js HTTP/1.1\r\nHost: app.whatsapp.ih.hl.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.whatsapp.ih.hl.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 19 Jul 2026 15:08:37 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 25 Jun 2024 22:31:28 GMT\r\nvary: Accept-Encoding\r\netag: W/\"667b4540-12e8f\"\r\nexpires: Mon, 20 Jul 2026 03:08:37 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":77455,"size_decoded":31315,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"f76c1d59b412927131d2bdd64cac8be4","sha1":"3311c13fa7175af40427a8af270c647ec6c6fed0","sha256":"c2ade901c6e6b1dfd488789d9d013f0094b084eb65f4caa39fc6c4507c0cb60f","sha512":"90f61851503490e9c270b32b66a7bd334636ba2df959f131ab6622eb97e78a2c40261c79dc38f5049b8150bbfd85d669bcbd212e52c1fdfbe2c3278e738bf3c4","ssdeep":"1536:EM52C9Y2mVGNl5CThrtQLxL5sYpfWFt/JBOyKAWEBTxOZ8GdRcjR+BvF+ShvZIIk:EY9Y2mVGNl5CThr2vsy+BBzKTEBTxO2p","tlshash":"df73838577c6b8c1124767b7b32ab1e5e82e5cdd3088088ff544bc98f5b9916fae0931","first_seen":"2025-10-19T01:16:14.611698Z","last_seen":"2026-07-19T15:36:35.90008Z","times_seen":118,"resource_available":false,"data":null}},"time_used":782,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":782,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-19","alert":"Phishing Block","trigger":"app.whatsapp.ih.hl.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-19","alert":"Sinkholed","trigger":"app.whatsapp.ih.hl.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/qrcodejs/1.0.0/qrcode.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://app.whatsapp.ih.hl.cn/","date":"2026-07-19T15:08:37.074Z","timestamp":1784473717074,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Jul 2026 07:07:58 GMT","end":"Thu, 08 Oct 2026 08:07:45 GMT"},"fingerprint":{"sha1":"DF:66:97:F5:13:A2:C0:81:D3:5B:60:C4:B0:7F:CD:78:F5:91:14:D5","sha256":"3C:F2:95:73:83:BA:4D:D9:CC:85:8F:BC:7D:2C:22:CF:F3:49:9A:3A:E4:1D:FC:AE:CB:07:3D:66:89:74:0E:C5"}}},"request":{"raw":"GET /ajax/libs/qrcodejs/1.0.0/qrcode.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.whatsapp.ih.hl.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Sun, 19 Jul 2026 15:08:37 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 6083\r\ncf-cache-status: BYPASS\r\naccess-control-allow-origin: *\r\ncache-control: no-transform, public, s-maxage=30672000, max-age=30672000, immutable\r\ncontent-encoding: br\r\nlast-modified: Mon, 04 May 2020 16:15:41 GMT\r\nvary: Accept-Encoding\r\nx-cdnjs-cache: HIT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/r2\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NAC%2FspRiN2MWfJiUTju6gQwDZ2xT%2F3P7k14ytVEq3RMhnjywnXN8cZ6AgAzlNdpt0aij4e5jxc17%2BH05aWSVkBzzib2BKkdH9dHWoxwrsHdAkpxWPUCiHET3VYjnjH62Aj%2FNnYhz\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\npriority: u=3,i=?0\r\nserver: cloudflare\r\ncf-ray: a1daa47bceb0c759-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19927,"size_decoded":7089,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with very long lines (19927), with no line terminators","md5":"517b55d3688ce9ef1085a3d9632bcb97","sha1":"2d06c1f823f34c19981c6ae0b0eb0f5861c5e14b","sha256":"c541ef06327885a8415bca8df6071e14189b4855336def4f36db54bde8484f36","sha512":"08d80845e706a3b9e985b799d3849cd7791ad3ba5aa9d793bb4591d4833890d7299810144874905f416c94d8530da74be0ee520066a91ade05a1da8bf0ccb498","ssdeep":"384:WRQ2kvcAAdTRhQLThP2yO9/9G84U5xOiKQYHHHsglDep9m1yfB8dKLMyA+LyUyy9:xThP2V/9N4U/gQYPXa8CAPLyrZ","tlshash":"8c92c7e4f36542f6915e6cd4283f104b64a0a4636c1490acbfb5c1e6a9f8fe0647af74","first_seen":"2023-03-07T01:14:56Z","last_seen":"2026-07-21T13:50:38.369546Z","times_seen":65425,"resource_available":true,"data":null}},"time_used":74,"timings":{"blocked":-1,"dns":2,"connect":10,"send":0,"wait":61,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web.dcobxs.com/matomo.js","fqdn":"web.dcobxs.com","domain":"dcobxs.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://app.whatsapp.ih.hl.cn/","date":"2026-07-19T15:08:37.316Z","timestamp":1784473717316,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /matomo.js HTTP/1.1\r\nHost: web.dcobxs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://app.whatsapp.ih.hl.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-21T14:24:28.807251Z","times_seen":17423368,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}