{"report_id":"b9285387-4a9a-44fd-a0e8-629476a176ad","version":6,"status":"done","tags":[],"date":"2026-02-06T21:40:36Z","url":{"schema":"https","addr":"telegram.hzxcopka.cn/","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":0,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"title":"Telegram","dom":{"size":3138,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (3138), with no line terminators","md5":"3b31b68bd2fe460c9d4a7ae6cf6aeba3","sha1":"8eca662361c782080d19f31916f0e2149a5843a4","sha256":"490026b58b0863a02fee4514f4d752a911c101f0ceb764bc39a14fa0ee3e6f19","sha512":"aaf8cf36e2040885bfbc2adae62addfa8779ad09fd655432704f63a943c6aa965407878ff0731c04e46f5a30d765ad16726d12c94731af27d2318f13d232a49c","ssdeep":"","tlshash":"335112938728c84e2321863ad9b3f0ccc216d44eeab47c51f58556ab49e5ff0c573266","dom_hash":"domhash0f31abafeaf2029a3dea65104db1780c","first_seen":"2026-02-06T21:12:36.106373Z","last_seen":"2026-02-06T21:40:39.729703Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":0,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-13T21:40:36Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-02-06","alert":"Hunting_JS_WebAssembly","trigger":"telegram.hzxcopka.cn/rlottie-wasm.f013598f1b2ba719f25e.js","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"telegram.hzxcopka.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null},"summary":[{"fqdn":"telegram.hzxcopka.cn","ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"domain_registered":"2024-06-01","domain_rank":0,"first_seen":"2026-02-06T21:12:32.128521Z","last_seen":"2026-02-06T21:12:32.128522Z","alert_count":94,"request_count":30,"received_data":1719711,"sent_data":14013,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/main.2716590fd27c0e233fa0.js","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"1fe605a4c0238078fd73d4c67acc24af","sha1":"22059cb0e6537f70a7336454e2420c24e61c64fd","sha256":"860f36c1ace133e370e2f323cac4292b5154e6f4dbce3029590666ddbfa044cb","sha512":"253ef04d59e9e141c0e71f4492dc6a5e4488ec694d7a403d968e8dc505759e956d1b7733b138c281e9272e70d58111728f3858f4a57494814450e5e0a95cfe2e","ssdeep":"12288:Sr3hQxx4ABgmbxejIPvqwNWB2/VaGE9Jd+uhm/osuDzoq/jbyQ13yBK:SLG9WLcAN+osuD0qd","tlshash":"f3b45cc571c6b4eaa3e309e5a4af0098b63559443809c460f16dfce93e264aeb373f5d","size":507584,"data":"","first_seen":"2026-02-06T21:12:36.108668Z","last_seen":"2026-02-06T21:40:39.734003Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/6708.21b7a34aeb75eaf81b0c.js","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"29d3bf1913c225d571500b115f903241","sha1":"63342f52f478b227194abab68a7b1d08a3c65490","sha256":"f646263ddc453a87b3abb142ea166ef434409303e1e5060a57d1ec909824696b","sha512":"e07c5638c440ec23fc4c2f37c493163ee8ce9b38eb722bbe4a5e611d73a3df46b17f6cb2e6f08d2f5b3866b6a74a4d9a2d5d723794f3e8e308058ad27456425c","ssdeep":"192:KIC6cWQ5hVT1/pammBj+hpYUTaI+ndqK+/GtsV17t1IYZ11:KIzcWKVTPSZ+TYU27nYK+3fR1IYZ11","tlshash":"7a12da56a131747e62a694d6e2140b027a36d0587c09a2bdf73c7cfb2c9680a35bcf78","size":9237,"data":"","first_seen":"2025-08-21T07:49:39.988976Z","last_seen":"2026-05-03T08:34:56.595961Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/redirect.js","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"17773b57b87a678c98e26a7cac72df6c","sha1":"7422857aa75ee81cabcec2eed6c4a6168f363ee1","sha256":"375141f2d3f04c733276dbff5d9208ff36b2db6a64abcee723179ac24797974f","sha512":"28d9e1c2af08154e653e2291db46f4110edbf9f5591192f8d695c8852f9c3c755d69dfb5a032a45f51e0a3fc9417f16c20d0772b1225ca9b85e5531e12fa8bfc","ssdeep":"","tlshash":"e8e07dda0279030417e013f36d82b4709137c2fb604c5d028d984321a1b9b4f5b7b84f","size":325,"data":"","first_seen":"2023-07-27T09:32:34Z","last_seen":"2026-08-11T05:55:54.245741Z","times_seen":11540,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/compatTest.js","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e56b7aaea93e41fa5608aab3653ec69e","sha1":"262982aa7dfdb539070d68e220e0673214d86c47","sha256":"996ed63151d0fbc6f0b7fec827e9ad696a16647bd154c38be4b869c22bf1d9f0","sha512":"a87cd35e857d29ca2058647a66ff46e1eabb130c5549d9d63687dc0753bca17ac3ee4ccee491fde966e00fd87f9669a31ff6384b91e480e82c3b93f49a978992","ssdeep":"","tlshash":"4c51162a4cb5327150796167eb0fb14376298577060ce76ca120cf387eb185b825fee9","size":2914,"data":"","first_seen":"2025-04-25T09:53:23.698524Z","last_seen":"2026-06-20T03:07:39.60827Z","times_seen":309,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/main.2716590fd27c0e233fa0.js","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram.hzxcopka.cn/","date":"2026-02-06T21:40:14.635Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.qianxunsm.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 06:26:39 GMT","end":"Wed, 08 Apr 2026 06:26:38 GMT"},"fingerprint":{"sha1":"13:A8:93:83:98:C2:54:FD:EF:D9:AE:B2:1C:0C:4E:74:2A:21:8C:6F","sha256":"A0:B6:50:7C:E9:E4:5B:99:81:6D:28:6E:B1:F5:FD:A3:DD:61:A7:25:04:4A:95:B8:04:B9:44:83:43:41:FC:BB"}}},"request":{"raw":"GET /main.2716590fd27c0e233fa0.js HTTP/1.1\r\nHost: telegram.hzxcopka.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegram.hzxcopka.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 06 Feb 2026 21:40:14 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 18 Dec 2025 06:26:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69439eb1-7bec7\"\r\nexpires: Sat, 07 Feb 2026 09:40:14 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":507591,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64481), with no line terminators","md5":"1fe605a4c0238078fd73d4c67acc24af","sha1":"22059cb0e6537f70a7336454e2420c24e61c64fd","sha256":"860f36c1ace133e370e2f323cac4292b5154e6f4dbce3029590666ddbfa044cb","sha512":"253ef04d59e9e141c0e71f4492dc6a5e4488ec694d7a403d968e8dc505759e956d1b7733b138c281e9272e70d58111728f3858f4a57494814450e5e0a95cfe2e","ssdeep":"12288:Sr3hQxx4ABgmbxejIPvqwNWB2/VaGE9Jd+uhm/osuDzoq/jbyQ13yBK:SLG9WLcAN+osuD0qd","tlshash":"f3b45cc571c6b4eaa3e309e5a4af0098b63559443809c460f16dfce93e264aeb373f5d","first_seen":"2026-02-06T21:12:36.108668Z","last_seen":"2026-02-06T21:40:39.734003Z","times_seen":2,"resource_available":true,"data":null}},"time_used":588,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":588,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"telegram.hzxcopka.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram.hzxcopka.cn/","date":"2026-02-06T21:40:19.252Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.qianxunsm.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 06:26:39 GMT","end":"Wed, 08 Apr 2026 06:26:38 GMT"},"fingerprint":{"sha1":"13:A8:93:83:98:C2:54:FD:EF:D9:AE:B2:1C:0C:4E:74:2A:21:8C:6F","sha256":"A0:B6:50:7C:E9:E4:5B:99:81:6D:28:6E:B1:F5:FD:A3:DD:61:A7:25:04:4A:95:B8:04:B9:44:83:43:41:FC:BB"}}},"request":{"raw":"GET /9443.f9ec9804d24c995d9869.js HTTP/1.1\r\nHost: telegram.hzxcopka.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegram.hzxcopka.cn/\r\nSec-Fetch-Dest: worker\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 06 Feb 2026 21:40:19 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 18 Dec 2025 06:26:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69439eb1-2cf8\"\r\nexpires: Sat, 07 Feb 2026 09:40:19 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11512,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (11458)","md5":"521a4a850d81ebe0182316a5812623aa","sha1":"01b5fe8376561ca592a46604b5d93f3e3c795eb2","sha256":"fcc6a32088f6a7543d6c9d859d96a08a822f23aa838c0b980c54df9e974c7c1b","sha512":"68cede1060ca952ef66a1fe7c89cf175f3188199842a26f784f4e78a16a0befd0bf872931d983e47e4dfc7285daacf85ad7a9582926d8594ff9b63b9c304dfec","ssdeep":"192:s5MdJOqU8g35HilXzTI5dW1RdjgUEqd9qoEhyKNRERAOCEmYGeaIgtcHu6EjBESk:oivU8g35HilXzTRd0UxwoEhZzAXCEm4n","tlshash":"603207c12351a53ee38b98d9d87a00036130da5c781889687b2e6eeb3c2bdc5f1b1f71","first_seen":"2026-02-06T21:12:36.114126Z","last_seen":"2026-02-06T21:40:39.736742Z","times_seen":2,"resource_available":false,"data":null}},"time_used":293,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":293,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"telegram.hzxcopka.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/7784.2a486dcaaaf47415a095.js","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js","date":"2026-02-06T21:40:19.867Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.qianxunsm.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 06:26:39 GMT","end":"Wed, 08 Apr 2026 06:26:38 GMT"},"fingerprint":{"sha1":"13:A8:93:83:98:C2:54:FD:EF:D9:AE:B2:1C:0C:4E:74:2A:21:8C:6F","sha256":"A0:B6:50:7C:E9:E4:5B:99:81:6D:28:6E:B1:F5:FD:A3:DD:61:A7:25:04:4A:95:B8:04:B9:44:83:43:41:FC:BB"}}},"request":{"raw":"GET /7784.2a486dcaaaf47415a095.js HTTP/1.1\r\nHost: telegram.hzxcopka.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 06 Feb 2026 21:40:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 18 Dec 2025 06:26:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69439eb1-5268\"\r\nexpires: Sat, 07 Feb 2026 09:40:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":21096,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (20959)","md5":"7dc8152b66709fb680cef0db2612ed8c","sha1":"e74591cf18b30dc6246228a0ee5cbd4895ab40dc","sha256":"83d4b9cca15b21490235040ecd1c9bf691569ec51e5b9757f0799eec8b9765b5","sha512":"ee30fff33646fa2480e06a2f2e9a9c74ba1df396749124839392e5145194fe4b6da4ad936066c2438a65b2f82dbf6e8b5b7e4faa8d4b5d9dd5f849c24c6e9734","ssdeep":"384:FAfpRdH3KLSWInGDrQ+YW5LhoASLv5S8VwktQ0CSRU6f/k5MC6LEmYwt/9RXC6ia:FAfpRdX+DrQ2LhoASLFtQUU63k5MC6Lh","tlshash":"5a92187a56ad05c252ec48e908cb1c9951b8e0233c871d7e9174fdd630f28e7e2ead79","first_seen":"2025-06-07T09:51:34.136663Z","last_seen":"2026-07-16T16:02:47.586596Z","times_seen":220,"resource_available":true,"data":null}},"time_used":293,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":293,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"telegram.hzxcopka.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.465390c6e54c60f4a15f.woff2","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://telegram.hzxcopka.cn/","date":"2026-02-06T21:40:15.937Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.qianxunsm.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 06:26:39 GMT","end":"Wed, 08 Apr 2026 06:26:38 GMT"},"fingerprint":{"sha1":"13:A8:93:83:98:C2:54:FD:EF:D9:AE:B2:1C:0C:4E:74:2A:21:8C:6F","sha256":"A0:B6:50:7C:E9:E4:5B:99:81:6D:28:6E:B1:F5:FD:A3:DD:61:A7:25:04:4A:95:B8:04:B9:44:83:43:41:FC:BB"}}},"request":{"raw":"GET /KFOmCnqEu92Fr1Mu4mxKKTU1Kg.465390c6e54c60f4a15f.woff2 HTTP/1.1\r\nHost: telegram.hzxcopka.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegram.hzxcopka.cn/main.0f98df2c44734de67a19.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 06 Feb 2026 21:40:16 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 11016\r\nlast-modified: Thu, 18 Dec 2025 06:26:57 GMT\r\netag: \"69439eb1-2b08\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11016,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 11016, version 1.0","md5":"15fa3062f8929bd3b05fdca5259db412","sha1":"6ff06a34f68ad0324ddec1bbe4d453c959178b36","sha256":"5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479","sha512":"07e96d7520b4ede158e77bef10a01a33cd8be7d263fe6900f89c023e65e4a63570e8a442dec2e96030fb563b25610005a748d48f9330fd31eb91b37d1003d376","ssdeep":"192:Tysuo7z1NVoTUYAKVOO7YVxRwHQUXFI5xoBwH9f4d9QFmOfiS:TvdvVoTSjOYR4QUVIgBwpFLaS","tlshash":"6e32af8071ff1c50ff85c2f69be68efa2c2b1895c619016f5240b476397525e9c294bb","first_seen":"2023-04-05T09:25:54Z","last_seen":"2026-08-13T14:07:18.895634Z","times_seen":34553,"resource_available":false,"data":null}},"time_used":295,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":294,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"telegram.hzxcopka.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/9357.d9202e40e5c5f92f4b52.js","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js","date":"2026-02-06T21:40:20.180Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.qianxunsm.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 06:26:39 GMT","end":"Wed, 08 Apr 2026 06:26:38 GMT"},"fingerprint":{"sha1":"13:A8:93:83:98:C2:54:FD:EF:D9:AE:B2:1C:0C:4E:74:2A:21:8C:6F","sha256":"A0:B6:50:7C:E9:E4:5B:99:81:6D:28:6E:B1:F5:FD:A3:DD:61:A7:25:04:4A:95:B8:04:B9:44:83:43:41:FC:BB"}}},"request":{"raw":"GET /9357.d9202e40e5c5f92f4b52.js HTTP/1.1\r\nHost: telegram.hzxcopka.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 06 Feb 2026 21:40:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 18 Dec 2025 06:26:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69439eb1-a7b\"\r\nexpires: Sat, 07 Feb 2026 09:40:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2683,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2629)","md5":"36ed20df5cbd94fdb50844faff536ad5","sha1":"91bd3d87f668739b9e48ac57ec51d9c8bd2c5f81","sha256":"f22ff57ae3a00e1e9d6f2e98dee1af7b5d37dfa0de72188ef417bab6514182a5","sha512":"a49faf03d34f935f1453203723b97639ee574ac927c3c1d02bc259b2601a66227aed011d04263611490cd264e3fcac17c3f9acfe2e1919cc708d8cdadb66d1d3","ssdeep":"","tlshash":"a251da445a72387a5ce386abf05b3b110c2513b13819f45316199eeb47b728f5f13f49","first_seen":"2026-02-06T21:12:36.111845Z","last_seen":"2026-02-06T21:40:39.742189Z","times_seen":2,"resource_available":false,"data":null}},"time_used":292,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":292,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"telegram.hzxcopka.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/rlottie-wasm.f013598f1b2ba719f25e.js","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js","date":"2026-02-06T21:40:20.786Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.qianxunsm.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 06:26:39 GMT","end":"Wed, 08 Apr 2026 06:26:38 GMT"},"fingerprint":{"sha1":"13:A8:93:83:98:C2:54:FD:EF:D9:AE:B2:1C:0C:4E:74:2A:21:8C:6F","sha256":"A0:B6:50:7C:E9:E4:5B:99:81:6D:28:6E:B1:F5:FD:A3:DD:61:A7:25:04:4A:95:B8:04:B9:44:83:43:41:FC:BB"}}},"request":{"raw":"GET /rlottie-wasm.f013598f1b2ba719f25e.js HTTP/1.1\r\nHost: telegram.hzxcopka.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 06 Feb 2026 21:40:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 18 Dec 2025 06:26:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69439eb1-10037\"\r\nexpires: Sat, 07 Feb 2026 09:40:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":65591,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"4441938ee433d3657c20d454d352a336","sha1":"dd67121d7fda7c17be196f60c72dfa06bcb5bc6f","sha256":"659bf63501a8054ef0eedda3dec466dbc1e9a1b2c4d5d59a285b005215e16679","sha512":"f90da6f2003442e547813d62f44e22e688f637616dd7f7f33c81e73d05a3a3de39947c0a8f580002cc96a716caecc4bcd988644ad78b01ae2e9a9792c726604e","ssdeep":"768:O6T4cK2yQ6eO1P2WgcdxazvszXIgBB1ARna76Ae/FqsSwYxRrqhlr3NqR:m1Q6eO4+IUzXXsjvi1alrcR","tlshash":"6153e88535d9b0ab42837878946f310bf2ab6d52641c8410db1dd4dabcb4e49e63ffe8","first_seen":"2024-05-16T20:37:02Z","last_seen":"2026-08-11T05:55:54.142228Z","times_seen":15255,"resource_available":true,"data":null}},"time_used":295,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":295,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-02-06","alert":"Hunting_JS_WebAssembly","trigger":"telegram.hzxcopka.cn/rlottie-wasm.f013598f1b2ba719f25e.js","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"telegram.hzxcopka.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/5905.04b286b6eff2126d05dc.js","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js","date":"2026-02-06T21:40:19.871Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.qianxunsm.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 06:26:39 GMT","end":"Wed, 08 Apr 2026 06:26:38 GMT"},"fingerprint":{"sha1":"13:A8:93:83:98:C2:54:FD:EF:D9:AE:B2:1C:0C:4E:74:2A:21:8C:6F","sha256":"A0:B6:50:7C:E9:E4:5B:99:81:6D:28:6E:B1:F5:FD:A3:DD:61:A7:25:04:4A:95:B8:04:B9:44:83:43:41:FC:BB"}}},"request":{"raw":"GET /5905.04b286b6eff2126d05dc.js HTTP/1.1\r\nHost: telegram.hzxcopka.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 06 Feb 2026 21:40:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 18 Dec 2025 06:26:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69439eb1-25e25\"\r\nexpires: Sat, 07 Feb 2026 09:40:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":155173,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"353bd230c8bed14cd25d2d5c930f4f82","sha1":"bd3987c8fba61d3d5ae0dace22d099553d205db0","sha256":"4db4cb681f199d995ea8613c37d9b1f17238bf9c0f41386a183df6783d468cf9","sha512":"7a0f674bdcabf84df189a21d146c108044ff5e7a56571f1b99de4e8f7ef2142e52c6d463a29d0de1d8374f2aa540c5969ddbd547e455d126eb1cffa1bf2ad3be","ssdeep":"1536:ouG3B/McaUFrnb3wHkgJ4K9pKMwHI/CglGQnAnkY0tfXuYEU3:YlrbBgXGsQkyK","tlshash":"0ce3b682f86424161392a1e654b60749b739f41ca8c540acfb7cfed52dbcd8e36ab734","first_seen":"2025-06-07T09:51:34.132674Z","last_seen":"2026-07-16T16:02:47.588262Z","times_seen":220,"resource_available":true,"data":null}},"time_used":578,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":578,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"telegram.hzxcopka.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/5905.04b286b6eff2126d05dc.js","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js","date":"2026-02-06T21:40:20.174Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.qianxunsm.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 06:26:39 GMT","end":"Wed, 08 Apr 2026 06:26:38 GMT"},"fingerprint":{"sha1":"13:A8:93:83:98:C2:54:FD:EF:D9:AE:B2:1C:0C:4E:74:2A:21:8C:6F","sha256":"A0:B6:50:7C:E9:E4:5B:99:81:6D:28:6E:B1:F5:FD:A3:DD:61:A7:25:04:4A:95:B8:04:B9:44:83:43:41:FC:BB"}}},"request":{"raw":"GET /5905.04b286b6eff2126d05dc.js HTTP/1.1\r\nHost: telegram.hzxcopka.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 06 Feb 2026 21:40:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 18 Dec 2025 06:26:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69439eb1-25e25\"\r\nexpires: Sat, 07 Feb 2026 09:40:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":155173,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"353bd230c8bed14cd25d2d5c930f4f82","sha1":"bd3987c8fba61d3d5ae0dace22d099553d205db0","sha256":"4db4cb681f199d995ea8613c37d9b1f17238bf9c0f41386a183df6783d468cf9","sha512":"7a0f674bdcabf84df189a21d146c108044ff5e7a56571f1b99de4e8f7ef2142e52c6d463a29d0de1d8374f2aa540c5969ddbd547e455d126eb1cffa1bf2ad3be","ssdeep":"1536:ouG3B/McaUFrnb3wHkgJ4K9pKMwHI/CglGQnAnkY0tfXuYEU3:YlrbBgXGsQkyK","tlshash":"0ce3b682f86424161392a1e654b60749b739f41ca8c540acfb7cfed52dbcd8e36ab734","first_seen":"2025-06-07T09:51:34.132674Z","last_seen":"2026-07-16T16:02:47.588262Z","times_seen":220,"resource_available":true,"data":null}},"time_used":296,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":296,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"telegram.hzxcopka.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/9357.d9202e40e5c5f92f4b52.js","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js","date":"2026-02-06T21:40:20.489Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.qianxunsm.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 06:26:39 GMT","end":"Wed, 08 Apr 2026 06:26:38 GMT"},"fingerprint":{"sha1":"13:A8:93:83:98:C2:54:FD:EF:D9:AE:B2:1C:0C:4E:74:2A:21:8C:6F","sha256":"A0:B6:50:7C:E9:E4:5B:99:81:6D:28:6E:B1:F5:FD:A3:DD:61:A7:25:04:4A:95:B8:04:B9:44:83:43:41:FC:BB"}}},"request":{"raw":"GET /9357.d9202e40e5c5f92f4b52.js HTTP/1.1\r\nHost: telegram.hzxcopka.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 06 Feb 2026 21:40:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 18 Dec 2025 06:26:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69439eb1-a7b\"\r\nexpires: Sat, 07 Feb 2026 09:40:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2683,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2629)","md5":"36ed20df5cbd94fdb50844faff536ad5","sha1":"91bd3d87f668739b9e48ac57ec51d9c8bd2c5f81","sha256":"f22ff57ae3a00e1e9d6f2e98dee1af7b5d37dfa0de72188ef417bab6514182a5","sha512":"a49faf03d34f935f1453203723b97639ee574ac927c3c1d02bc259b2601a66227aed011d04263611490cd264e3fcac17c3f9acfe2e1919cc708d8cdadb66d1d3","ssdeep":"","tlshash":"a251da445a72387a5ce386abf05b3b110c2513b13819f45316199eeb47b728f5f13f49","first_seen":"2026-02-06T21:12:36.111845Z","last_seen":"2026-02-06T21:40:39.742189Z","times_seen":2,"resource_available":false,"data":null}},"time_used":296,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":296,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"telegram.hzxcopka.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-06T21:40:13.419Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.qianxunsm.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 06:26:39 GMT","end":"Wed, 08 Apr 2026 06:26:38 GMT"},"fingerprint":{"sha1":"13:A8:93:83:98:C2:54:FD:EF:D9:AE:B2:1C:0C:4E:74:2A:21:8C:6F","sha256":"A0:B6:50:7C:E9:E4:5B:99:81:6D:28:6E:B1:F5:FD:A3:DD:61:A7:25:04:4A:95:B8:04:B9:44:83:43:41:FC:BB"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: telegram.hzxcopka.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 06 Feb 2026 21:40:14 GMT\r\ncontent-type: text/html\r\nlast-modified: Thu, 18 Dec 2025 06:26:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69439eb1-c13\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3091,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (3091), with no line terminators","md5":"8e43aaeb57bc87d17e690bac074650cb","sha1":"cb0d4fae6e2eea64f7a8a2b3ea7261f48d3c929e","sha256":"f90afec4eaab410cc37809aaa2104865dae0ef3f46e5d4be1236a8a0ec678cbb","sha512":"c469fa2181c05941f97461ca2eb8f1b6a3539cc0d48b14792723a2e6f6b1383c09c41c2900a79c3ca18485d14e89e093840845630cf1117d656a8157d79f3882","ssdeep":"","tlshash":"8a5100938b28c84e2321863adab3f0c8c616d40ee9b47c50f58556eb49f5ff0d5b3266","first_seen":"2026-02-06T21:12:36.11726Z","last_seen":"2026-02-06T21:40:39.746639Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1845,"timings":{"blocked":773,"dns":186,"connect":292,"send":0,"wait":292,"receive":0,"ssl":297},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"telegram.hzxcopka.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/main.0f98df2c44734de67a19.css","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://telegram.hzxcopka.cn/","date":"2026-02-06T21:40:14.637Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.qianxunsm.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 06:26:39 GMT","end":"Wed, 08 Apr 2026 06:26:38 GMT"},"fingerprint":{"sha1":"13:A8:93:83:98:C2:54:FD:EF:D9:AE:B2:1C:0C:4E:74:2A:21:8C:6F","sha256":"A0:B6:50:7C:E9:E4:5B:99:81:6D:28:6E:B1:F5:FD:A3:DD:61:A7:25:04:4A:95:B8:04:B9:44:83:43:41:FC:BB"}}},"request":{"raw":"GET /main.0f98df2c44734de67a19.css HTTP/1.1\r\nHost: telegram.hzxcopka.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegram.hzxcopka.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 06 Feb 2026 21:40:14 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 18 Dec 2025 06:26:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69439eb1-1ffad\"\r\nexpires: Sat, 07 Feb 2026 09:40:14 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":130989,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (15445)","md5":"9c3ca412c89bfaae035f6452a532f4a3","sha1":"924e1ddda0f3ee43719027263f941a8838e78ae9","sha256":"bdb2a83f2ea09eba142f6b366994b8da3fec51c72ca2707026d0e7a04cbec512","sha512":"679a2c909c2be7ed034c9ef1a5f49818bdbf1a140e1ed5c883bbef8329b8239be7813d8b53f6b7f29f5b2097d68d3bc3d62b98d674148a5b1a2306010b527846","ssdeep":"768:w10Q9RiIf6m3lPrChnv3drscbWydO9wpXasUgknLLoo9+b6UbdWAkcI5/ydO8Qtk:IPRiSOrscb5SsUgknU7WF5oYfN+","tlshash":"70d3a6a4e98411e9a733c63e97c4e76c8d38f451de610f6bf247a11c4bca7da12d2b18","first_seen":"2025-10-12T15:34:45.602484Z","last_seen":"2026-05-03T08:34:56.587743Z","times_seen":22,"resource_available":false,"data":null}},"time_used":1173,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1173,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"telegram.hzxcopka.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/icon-192x192.png","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegram.hzxcopka.cn/","date":"2026-02-06T21:40:16.162Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.qianxunsm.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 06:26:39 GMT","end":"Wed, 08 Apr 2026 06:26:38 GMT"},"fingerprint":{"sha1":"13:A8:93:83:98:C2:54:FD:EF:D9:AE:B2:1C:0C:4E:74:2A:21:8C:6F","sha256":"A0:B6:50:7C:E9:E4:5B:99:81:6D:28:6E:B1:F5:FD:A3:DD:61:A7:25:04:4A:95:B8:04:B9:44:83:43:41:FC:BB"}}},"request":{"raw":"GET /icon-192x192.png HTTP/1.1\r\nHost: telegram.hzxcopka.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegram.hzxcopka.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 06 Feb 2026 21:40:16 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 18 Dec 2025 06:27:02 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69439eb6-bf3\"\r\nexpires: Sun, 08 Mar 2026 21:40:16 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3059,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 192 x 192, 8-bit colormap, non-interlaced","md5":"1a1650d2c76bfc1ac484646c19e495b9","sha1":"fe58d66042ce9241226f5da9370230285ff604fc","sha256":"6e587a62c9d7a97f25265ab5eb29d101ad2e36810042a4116d2dd29da96b0bf8","sha512":"79c5c9278959bc94f66434779bebc1b46c055655f0bc58aa375f179c227e7ac0e52dea196764719d42aadcf98e4fd3b5a4488f2db977edde430aa3df733c03bc","ssdeep":"","tlshash":"bd514cd3253318e8e2dbfd7ace62041f656691ce5638ec120568de720c8985dc070caa","first_seen":"2023-05-16T22:57:55Z","last_seen":"2026-08-11T05:55:54.190987Z","times_seen":16536,"resource_available":false,"data":null}},"time_used":293,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":293,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"telegram.hzxcopka.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/6708.21b7a34aeb75eaf81b0c.js","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram.hzxcopka.cn/","date":"2026-02-06T21:40:18.942Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.qianxunsm.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 06:26:39 GMT","end":"Wed, 08 Apr 2026 06:26:38 GMT"},"fingerprint":{"sha1":"13:A8:93:83:98:C2:54:FD:EF:D9:AE:B2:1C:0C:4E:74:2A:21:8C:6F","sha256":"A0:B6:50:7C:E9:E4:5B:99:81:6D:28:6E:B1:F5:FD:A3:DD:61:A7:25:04:4A:95:B8:04:B9:44:83:43:41:FC:BB"}}},"request":{"raw":"GET /6708.21b7a34aeb75eaf81b0c.js HTTP/1.1\r\nHost: telegram.hzxcopka.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegram.hzxcopka.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 06 Feb 2026 21:40:19 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 18 Dec 2025 06:26:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69439eb1-2415\"\r\nexpires: Sat, 07 Feb 2026 09:40:19 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9237,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (9183)","md5":"29d3bf1913c225d571500b115f903241","sha1":"63342f52f478b227194abab68a7b1d08a3c65490","sha256":"f646263ddc453a87b3abb142ea166ef434409303e1e5060a57d1ec909824696b","sha512":"e07c5638c440ec23fc4c2f37c493163ee8ce9b38eb722bbe4a5e611d73a3df46b17f6cb2e6f08d2f5b3866b6a74a4d9a2d5d723794f3e8e308058ad27456425c","ssdeep":"192:KIC6cWQ5hVT1/pammBj+hpYUTaI+ndqK+/GtsV17t1IYZ11:KIzcWKVTPSZ+TYU27nYK+3fR1IYZ11","tlshash":"7a12da56a131747e62a694d6e2140b027a36d0587c09a2bdf73c7cfb2c9680a35bcf78","first_seen":"2025-08-21T07:49:39.988976Z","last_seen":"2026-05-03T08:34:56.595961Z","times_seen":23,"resource_available":true,"data":null}},"time_used":293,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":293,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"telegram.hzxcopka.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram.hzxcopka.cn/","date":"2026-02-06T21:40:19.261Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.qianxunsm.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 06:26:39 GMT","end":"Wed, 08 Apr 2026 06:26:38 GMT"},"fingerprint":{"sha1":"13:A8:93:83:98:C2:54:FD:EF:D9:AE:B2:1C:0C:4E:74:2A:21:8C:6F","sha256":"A0:B6:50:7C:E9:E4:5B:99:81:6D:28:6E:B1:F5:FD:A3:DD:61:A7:25:04:4A:95:B8:04:B9:44:83:43:41:FC:BB"}}},"request":{"raw":"GET /9443.f9ec9804d24c995d9869.js HTTP/1.1\r\nHost: telegram.hzxcopka.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegram.hzxcopka.cn/\r\nSec-Fetch-Dest: worker\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 06 Feb 2026 21:40:19 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 18 Dec 2025 06:26:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69439eb1-2cf8\"\r\nexpires: Sat, 07 Feb 2026 09:40:19 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11512,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (11458)","md5":"521a4a850d81ebe0182316a5812623aa","sha1":"01b5fe8376561ca592a46604b5d93f3e3c795eb2","sha256":"fcc6a32088f6a7543d6c9d859d96a08a822f23aa838c0b980c54df9e974c7c1b","sha512":"68cede1060ca952ef66a1fe7c89cf175f3188199842a26f784f4e78a16a0befd0bf872931d983e47e4dfc7285daacf85ad7a9582926d8594ff9b63b9c304dfec","ssdeep":"192:s5MdJOqU8g35HilXzTI5dW1RdjgUEqd9qoEhyKNRERAOCEmYGeaIgtcHu6EjBESk:oivU8g35HilXzTRd0UxwoEhZzAXCEm4n","tlshash":"603207c12351a53ee38b98d9d87a00036130da5c781889687b2e6eeb3c2bdc5f1b1f71","first_seen":"2026-02-06T21:12:36.114126Z","last_seen":"2026-02-06T21:40:39.736742Z","times_seen":2,"resource_available":false,"data":null}},"time_used":579,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":579,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"telegram.hzxcopka.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/5905.04b286b6eff2126d05dc.js","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js","date":"2026-02-06T21:40:19.868Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.qianxunsm.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 06:26:39 GMT","end":"Wed, 08 Apr 2026 06:26:38 GMT"},"fingerprint":{"sha1":"13:A8:93:83:98:C2:54:FD:EF:D9:AE:B2:1C:0C:4E:74:2A:21:8C:6F","sha256":"A0:B6:50:7C:E9:E4:5B:99:81:6D:28:6E:B1:F5:FD:A3:DD:61:A7:25:04:4A:95:B8:04:B9:44:83:43:41:FC:BB"}}},"request":{"raw":"GET /5905.04b286b6eff2126d05dc.js HTTP/1.1\r\nHost: telegram.hzxcopka.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 06 Feb 2026 21:40:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 18 Dec 2025 06:26:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69439eb1-25e25\"\r\nexpires: Sat, 07 Feb 2026 09:40:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":155173,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"353bd230c8bed14cd25d2d5c930f4f82","sha1":"bd3987c8fba61d3d5ae0dace22d099553d205db0","sha256":"4db4cb681f199d995ea8613c37d9b1f17238bf9c0f41386a183df6783d468cf9","sha512":"7a0f674bdcabf84df189a21d146c108044ff5e7a56571f1b99de4e8f7ef2142e52c6d463a29d0de1d8374f2aa540c5969ddbd547e455d126eb1cffa1bf2ad3be","ssdeep":"1536:ouG3B/McaUFrnb3wHkgJ4K9pKMwHI/CglGQnAnkY0tfXuYEU3:YlrbBgXGsQkyK","tlshash":"0ce3b682f86424161392a1e654b60749b739f41ca8c540acfb7cfed52dbcd8e36ab734","first_seen":"2025-06-07T09:51:34.132674Z","last_seen":"2026-07-16T16:02:47.588262Z","times_seen":220,"resource_available":true,"data":null}},"time_used":298,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":298,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"telegram.hzxcopka.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram.hzxcopka.cn/","date":"2026-02-06T21:40:19.259Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.qianxunsm.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 06:26:39 GMT","end":"Wed, 08 Apr 2026 06:26:38 GMT"},"fingerprint":{"sha1":"13:A8:93:83:98:C2:54:FD:EF:D9:AE:B2:1C:0C:4E:74:2A:21:8C:6F","sha256":"A0:B6:50:7C:E9:E4:5B:99:81:6D:28:6E:B1:F5:FD:A3:DD:61:A7:25:04:4A:95:B8:04:B9:44:83:43:41:FC:BB"}}},"request":{"raw":"GET /9443.f9ec9804d24c995d9869.js HTTP/1.1\r\nHost: telegram.hzxcopka.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegram.hzxcopka.cn/\r\nSec-Fetch-Dest: worker\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 06 Feb 2026 21:40:19 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 18 Dec 2025 06:26:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69439eb1-2cf8\"\r\nexpires: Sat, 07 Feb 2026 09:40:19 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11512,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (11458)","md5":"521a4a850d81ebe0182316a5812623aa","sha1":"01b5fe8376561ca592a46604b5d93f3e3c795eb2","sha256":"fcc6a32088f6a7543d6c9d859d96a08a822f23aa838c0b980c54df9e974c7c1b","sha512":"68cede1060ca952ef66a1fe7c89cf175f3188199842a26f784f4e78a16a0befd0bf872931d983e47e4dfc7285daacf85ad7a9582926d8594ff9b63b9c304dfec","ssdeep":"192:s5MdJOqU8g35HilXzTI5dW1RdjgUEqd9qoEhyKNRERAOCEmYGeaIgtcHu6EjBESk:oivU8g35HilXzTRd0UxwoEhZzAXCEm4n","tlshash":"603207c12351a53ee38b98d9d87a00036130da5c781889687b2e6eeb3c2bdc5f1b1f71","first_seen":"2026-02-06T21:12:36.114126Z","last_seen":"2026-02-06T21:40:39.736742Z","times_seen":2,"resource_available":false,"data":null}},"time_used":293,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":293,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"telegram.hzxcopka.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/9357.d9202e40e5c5f92f4b52.js","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js","date":"2026-02-06T21:40:20.469Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.qianxunsm.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 06:26:39 GMT","end":"Wed, 08 Apr 2026 06:26:38 GMT"},"fingerprint":{"sha1":"13:A8:93:83:98:C2:54:FD:EF:D9:AE:B2:1C:0C:4E:74:2A:21:8C:6F","sha256":"A0:B6:50:7C:E9:E4:5B:99:81:6D:28:6E:B1:F5:FD:A3:DD:61:A7:25:04:4A:95:B8:04:B9:44:83:43:41:FC:BB"}}},"request":{"raw":"GET /9357.d9202e40e5c5f92f4b52.js HTTP/1.1\r\nHost: telegram.hzxcopka.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 06 Feb 2026 21:40:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 18 Dec 2025 06:26:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69439eb1-a7b\"\r\nexpires: Sat, 07 Feb 2026 09:40:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2683,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2629)","md5":"36ed20df5cbd94fdb50844faff536ad5","sha1":"91bd3d87f668739b9e48ac57ec51d9c8bd2c5f81","sha256":"f22ff57ae3a00e1e9d6f2e98dee1af7b5d37dfa0de72188ef417bab6514182a5","sha512":"a49faf03d34f935f1453203723b97639ee574ac927c3c1d02bc259b2601a66227aed011d04263611490cd264e3fcac17c3f9acfe2e1919cc708d8cdadb66d1d3","ssdeep":"","tlshash":"a251da445a72387a5ce386abf05b3b110c2513b13819f45316199eeb47b728f5f13f49","first_seen":"2026-02-06T21:12:36.111845Z","last_seen":"2026-02-06T21:40:39.742189Z","times_seen":2,"resource_available":false,"data":null}},"time_used":294,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":294,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"telegram.hzxcopka.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/9357.d9202e40e5c5f92f4b52.js","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js","date":"2026-02-06T21:40:20.483Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.qianxunsm.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 06:26:39 GMT","end":"Wed, 08 Apr 2026 06:26:38 GMT"},"fingerprint":{"sha1":"13:A8:93:83:98:C2:54:FD:EF:D9:AE:B2:1C:0C:4E:74:2A:21:8C:6F","sha256":"A0:B6:50:7C:E9:E4:5B:99:81:6D:28:6E:B1:F5:FD:A3:DD:61:A7:25:04:4A:95:B8:04:B9:44:83:43:41:FC:BB"}}},"request":{"raw":"GET /9357.d9202e40e5c5f92f4b52.js HTTP/1.1\r\nHost: telegram.hzxcopka.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 06 Feb 2026 21:40:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 18 Dec 2025 06:26:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69439eb1-a7b\"\r\nexpires: Sat, 07 Feb 2026 09:40:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2683,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2629)","md5":"36ed20df5cbd94fdb50844faff536ad5","sha1":"91bd3d87f668739b9e48ac57ec51d9c8bd2c5f81","sha256":"f22ff57ae3a00e1e9d6f2e98dee1af7b5d37dfa0de72188ef417bab6514182a5","sha512":"a49faf03d34f935f1453203723b97639ee574ac927c3c1d02bc259b2601a66227aed011d04263611490cd264e3fcac17c3f9acfe2e1919cc708d8cdadb66d1d3","ssdeep":"","tlshash":"a251da445a72387a5ce386abf05b3b110c2513b13819f45316199eeb47b728f5f13f49","first_seen":"2026-02-06T21:12:36.111845Z","last_seen":"2026-02-06T21:40:39.742189Z","times_seen":2,"resource_available":false,"data":null}},"time_used":292,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":292,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"telegram.hzxcopka.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/compatTest.js","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram.hzxcopka.cn/","date":"2026-02-06T21:40:14.639Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.qianxunsm.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 06:26:39 GMT","end":"Wed, 08 Apr 2026 06:26:38 GMT"},"fingerprint":{"sha1":"13:A8:93:83:98:C2:54:FD:EF:D9:AE:B2:1C:0C:4E:74:2A:21:8C:6F","sha256":"A0:B6:50:7C:E9:E4:5B:99:81:6D:28:6E:B1:F5:FD:A3:DD:61:A7:25:04:4A:95:B8:04:B9:44:83:43:41:FC:BB"}}},"request":{"raw":"GET /compatTest.js HTTP/1.1\r\nHost: telegram.hzxcopka.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegram.hzxcopka.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 06 Feb 2026 21:40:14 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 18 Dec 2025 06:27:02 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69439eb6-b62\"\r\nexpires: Sat, 07 Feb 2026 09:40:14 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2914,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (413)","md5":"e56b7aaea93e41fa5608aab3653ec69e","sha1":"262982aa7dfdb539070d68e220e0673214d86c47","sha256":"996ed63151d0fbc6f0b7fec827e9ad696a16647bd154c38be4b869c22bf1d9f0","sha512":"a87cd35e857d29ca2058647a66ff46e1eabb130c5549d9d63687dc0753bca17ac3ee4ccee491fde966e00fd87f9669a31ff6384b91e480e82c3b93f49a978992","ssdeep":"","tlshash":"4c51162a4cb5327150796167eb0fb14376298577060ce76ca120cf387eb185b825fee9","first_seen":"2025-04-25T09:53:23.698524Z","last_seen":"2026-06-20T03:07:39.60827Z","times_seen":309,"resource_available":true,"data":null}},"time_used":1171,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1171,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"telegram.hzxcopka.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/notification.mp3","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://telegram.hzxcopka.cn/","date":"2026-02-06T21:40:15.961Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.qianxunsm.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 06:26:39 GMT","end":"Wed, 08 Apr 2026 06:26:38 GMT"},"fingerprint":{"sha1":"13:A8:93:83:98:C2:54:FD:EF:D9:AE:B2:1C:0C:4E:74:2A:21:8C:6F","sha256":"A0:B6:50:7C:E9:E4:5B:99:81:6D:28:6E:B1:F5:FD:A3:DD:61:A7:25:04:4A:95:B8:04:B9:44:83:43:41:FC:BB"}}},"request":{"raw":"GET /notification.mp3 HTTP/1.1\r\nHost: telegram.hzxcopka.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegram.hzxcopka.cn/\r\nSec-Fetch-Dest: audio\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 Partial Content\r\nserver: nginx\r\ndate: Fri, 06 Feb 2026 21:40:16 GMT\r\ncontent-type: audio/mpeg\r\ncontent-length: 10880\r\nlast-modified: Thu, 18 Dec 2025 06:27:02 GMT\r\netag: \"69439eb6-2a80\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-range: bytes 0-10879/10880\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10880,"size_decoded":0,"mime_type":"audio/mpeg","magic":"Audio file with ID3 version 2.3.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, JntStereo","md5":"eba09b6a457792c52fc610b5f9f974b3","sha1":"95e6e0f7648e28ea21bc434054ea59aba3a35aea","sha256":"86093551f5a7f68c7dcac947bd8dc54c6a79dd9a5d83f7e40116d640eb28c7d6","sha512":"9dfc5ff830c9ed75c9923528c31e1361fa36500d76a209cd475984e5585a644c8aff1600bf02a658ef363436a51988ff1e63aa7606e541dc4a7b3449c5be4852","ssdeep":"192:RuQQeX7rYX/WUUIk8DLh+2BHpZqlXCYP69tuORf6tVQRa/nwNQBv5JC:RRYeUUEDLk2VClyaV0aZ5g","tlshash":"37226b18af11056ef4866bf0b3939b8dc42d26c37a26d4cdd3a5d7e369430e2a7d500d","first_seen":"2023-05-16T22:57:55Z","last_seen":"2026-08-11T05:55:54.328987Z","times_seen":16895,"resource_available":false,"data":null}},"time_used":294,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":293,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"telegram.hzxcopka.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram.hzxcopka.cn/","date":"2026-02-06T21:40:19.263Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.qianxunsm.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 06:26:39 GMT","end":"Wed, 08 Apr 2026 06:26:38 GMT"},"fingerprint":{"sha1":"13:A8:93:83:98:C2:54:FD:EF:D9:AE:B2:1C:0C:4E:74:2A:21:8C:6F","sha256":"A0:B6:50:7C:E9:E4:5B:99:81:6D:28:6E:B1:F5:FD:A3:DD:61:A7:25:04:4A:95:B8:04:B9:44:83:43:41:FC:BB"}}},"request":{"raw":"GET /9443.f9ec9804d24c995d9869.js HTTP/1.1\r\nHost: telegram.hzxcopka.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegram.hzxcopka.cn/\r\nSec-Fetch-Dest: worker\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 06 Feb 2026 21:40:19 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 18 Dec 2025 06:26:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69439eb1-2cf8\"\r\nexpires: Sat, 07 Feb 2026 09:40:19 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11512,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (11458)","md5":"521a4a850d81ebe0182316a5812623aa","sha1":"01b5fe8376561ca592a46604b5d93f3e3c795eb2","sha256":"fcc6a32088f6a7543d6c9d859d96a08a822f23aa838c0b980c54df9e974c7c1b","sha512":"68cede1060ca952ef66a1fe7c89cf175f3188199842a26f784f4e78a16a0befd0bf872931d983e47e4dfc7285daacf85ad7a9582926d8594ff9b63b9c304dfec","ssdeep":"192:s5MdJOqU8g35HilXzTI5dW1RdjgUEqd9qoEhyKNRERAOCEmYGeaIgtcHu6EjBESk:oivU8g35HilXzTRd0UxwoEhZzAXCEm4n","tlshash":"603207c12351a53ee38b98d9d87a00036130da5c781889687b2e6eeb3c2bdc5f1b1f71","first_seen":"2026-02-06T21:12:36.114126Z","last_seen":"2026-02-06T21:40:39.736742Z","times_seen":2,"resource_available":false,"data":null}},"time_used":578,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":578,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"telegram.hzxcopka.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/rlottie-wasm.f013598f1b2ba719f25e.js","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js","date":"2026-02-06T21:40:20.777Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.qianxunsm.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 06:26:39 GMT","end":"Wed, 08 Apr 2026 06:26:38 GMT"},"fingerprint":{"sha1":"13:A8:93:83:98:C2:54:FD:EF:D9:AE:B2:1C:0C:4E:74:2A:21:8C:6F","sha256":"A0:B6:50:7C:E9:E4:5B:99:81:6D:28:6E:B1:F5:FD:A3:DD:61:A7:25:04:4A:95:B8:04:B9:44:83:43:41:FC:BB"}}},"request":{"raw":"GET /rlottie-wasm.f013598f1b2ba719f25e.js HTTP/1.1\r\nHost: telegram.hzxcopka.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 06 Feb 2026 21:40:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 18 Dec 2025 06:26:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69439eb1-10037\"\r\nexpires: Sat, 07 Feb 2026 09:40:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":65591,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"4441938ee433d3657c20d454d352a336","sha1":"dd67121d7fda7c17be196f60c72dfa06bcb5bc6f","sha256":"659bf63501a8054ef0eedda3dec466dbc1e9a1b2c4d5d59a285b005215e16679","sha512":"f90da6f2003442e547813d62f44e22e688f637616dd7f7f33c81e73d05a3a3de39947c0a8f580002cc96a716caecc4bcd988644ad78b01ae2e9a9792c726604e","ssdeep":"768:O6T4cK2yQ6eO1P2WgcdxazvszXIgBB1ARna76Ae/FqsSwYxRrqhlr3NqR:m1Q6eO4+IUzXXsjvi1alrcR","tlshash":"6153e88535d9b0ab42837878946f310bf2ab6d52641c8410db1dd4dabcb4e49e63ffe8","first_seen":"2024-05-16T20:37:02Z","last_seen":"2026-08-11T05:55:54.142228Z","times_seen":15255,"resource_available":true,"data":null}},"time_used":296,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":296,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-02-06","alert":"Hunting_JS_WebAssembly","trigger":"telegram.hzxcopka.cn/rlottie-wasm.f013598f1b2ba719f25e.js","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"telegram.hzxcopka.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/rlottie-wasm.f013598f1b2ba719f25e.js","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js","date":"2026-02-06T21:40:20.793Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.qianxunsm.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 06:26:39 GMT","end":"Wed, 08 Apr 2026 06:26:38 GMT"},"fingerprint":{"sha1":"13:A8:93:83:98:C2:54:FD:EF:D9:AE:B2:1C:0C:4E:74:2A:21:8C:6F","sha256":"A0:B6:50:7C:E9:E4:5B:99:81:6D:28:6E:B1:F5:FD:A3:DD:61:A7:25:04:4A:95:B8:04:B9:44:83:43:41:FC:BB"}}},"request":{"raw":"GET /rlottie-wasm.f013598f1b2ba719f25e.js HTTP/1.1\r\nHost: telegram.hzxcopka.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 06 Feb 2026 21:40:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 18 Dec 2025 06:26:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69439eb1-10037\"\r\nexpires: Sat, 07 Feb 2026 09:40:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":65591,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"4441938ee433d3657c20d454d352a336","sha1":"dd67121d7fda7c17be196f60c72dfa06bcb5bc6f","sha256":"659bf63501a8054ef0eedda3dec466dbc1e9a1b2c4d5d59a285b005215e16679","sha512":"f90da6f2003442e547813d62f44e22e688f637616dd7f7f33c81e73d05a3a3de39947c0a8f580002cc96a716caecc4bcd988644ad78b01ae2e9a9792c726604e","ssdeep":"768:O6T4cK2yQ6eO1P2WgcdxazvszXIgBB1ARna76Ae/FqsSwYxRrqhlr3NqR:m1Q6eO4+IUzXXsjvi1alrcR","tlshash":"6153e88535d9b0ab42837878946f310bf2ab6d52641c8410db1dd4dabcb4e49e63ffe8","first_seen":"2024-05-16T20:37:02Z","last_seen":"2026-08-11T05:55:54.142228Z","times_seen":15255,"resource_available":true,"data":null}},"time_used":296,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":296,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-02-06","alert":"Hunting_JS_WebAssembly","trigger":"telegram.hzxcopka.cn/rlottie-wasm.f013598f1b2ba719f25e.js","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"telegram.hzxcopka.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/favicon.svg","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://telegram.hzxcopka.cn/","date":"2026-02-06T21:40:16.163Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.qianxunsm.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 06:26:39 GMT","end":"Wed, 08 Apr 2026 06:26:38 GMT"},"fingerprint":{"sha1":"13:A8:93:83:98:C2:54:FD:EF:D9:AE:B2:1C:0C:4E:74:2A:21:8C:6F","sha256":"A0:B6:50:7C:E9:E4:5B:99:81:6D:28:6E:B1:F5:FD:A3:DD:61:A7:25:04:4A:95:B8:04:B9:44:83:43:41:FC:BB"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: telegram.hzxcopka.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegram.hzxcopka.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 06 Feb 2026 21:40:16 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 892\r\nlast-modified: Thu, 18 Dec 2025 06:27:02 GMT\r\netag: \"69439eb6-37c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":892,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d9ee2d4b0edd9f8ba2fb7242162c2c47","sha1":"398522893cf2cdefb5176f11bc67eab31c2d7382","sha256":"a462f1c5333e16b48335054493cfd1d0a13a96847b4b9ffe2cf24403e6e86010","sha512":"e404678e96fe6f6d1fe6c1390e4a64d90844a2d8903f84f1a34b23137593da5ba04112d9504b8bf480b392b294830a363344c5767e3bb5b7a3cb6f5df2a3aa45","ssdeep":"","tlshash":"97114493d060e71ad4c9e16bef61fca0116720cee5b745d485d95a34500fcdbfc08668","first_seen":"2023-05-09T00:01:39Z","last_seen":"2026-08-11T05:55:54.238794Z","times_seen":15703,"resource_available":false,"data":null}},"time_used":293,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":293,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"telegram.hzxcopka.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/7784.2a486dcaaaf47415a095.js","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js","date":"2026-02-06T21:40:19.864Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.qianxunsm.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 06:26:39 GMT","end":"Wed, 08 Apr 2026 06:26:38 GMT"},"fingerprint":{"sha1":"13:A8:93:83:98:C2:54:FD:EF:D9:AE:B2:1C:0C:4E:74:2A:21:8C:6F","sha256":"A0:B6:50:7C:E9:E4:5B:99:81:6D:28:6E:B1:F5:FD:A3:DD:61:A7:25:04:4A:95:B8:04:B9:44:83:43:41:FC:BB"}}},"request":{"raw":"GET /7784.2a486dcaaaf47415a095.js HTTP/1.1\r\nHost: telegram.hzxcopka.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 06 Feb 2026 21:40:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 18 Dec 2025 06:26:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69439eb1-5268\"\r\nexpires: Sat, 07 Feb 2026 09:40:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21096,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (20959)","md5":"7dc8152b66709fb680cef0db2612ed8c","sha1":"e74591cf18b30dc6246228a0ee5cbd4895ab40dc","sha256":"83d4b9cca15b21490235040ecd1c9bf691569ec51e5b9757f0799eec8b9765b5","sha512":"ee30fff33646fa2480e06a2f2e9a9c74ba1df396749124839392e5145194fe4b6da4ad936066c2438a65b2f82dbf6e8b5b7e4faa8d4b5d9dd5f849c24c6e9734","ssdeep":"384:FAfpRdH3KLSWInGDrQ+YW5LhoASLv5S8VwktQ0CSRU6f/k5MC6LEmYwt/9RXC6ia:FAfpRdX+DrQ2LhoASLFtQUU63k5MC6Lh","tlshash":"5a92187a56ad05c252ec48e908cb1c9951b8e0233c871d7e9174fdd630f28e7e2ead79","first_seen":"2025-06-07T09:51:34.136663Z","last_seen":"2026-07-16T16:02:47.586596Z","times_seen":220,"resource_available":true,"data":null}},"time_used":294,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":294,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"telegram.hzxcopka.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/rlottie-wasm.f013598f1b2ba719f25e.js","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js","date":"2026-02-06T21:40:20.487Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.qianxunsm.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 06:26:39 GMT","end":"Wed, 08 Apr 2026 06:26:38 GMT"},"fingerprint":{"sha1":"13:A8:93:83:98:C2:54:FD:EF:D9:AE:B2:1C:0C:4E:74:2A:21:8C:6F","sha256":"A0:B6:50:7C:E9:E4:5B:99:81:6D:28:6E:B1:F5:FD:A3:DD:61:A7:25:04:4A:95:B8:04:B9:44:83:43:41:FC:BB"}}},"request":{"raw":"GET /rlottie-wasm.f013598f1b2ba719f25e.js HTTP/1.1\r\nHost: telegram.hzxcopka.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 06 Feb 2026 21:40:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 18 Dec 2025 06:26:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69439eb1-10037\"\r\nexpires: Sat, 07 Feb 2026 09:40:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":65591,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"4441938ee433d3657c20d454d352a336","sha1":"dd67121d7fda7c17be196f60c72dfa06bcb5bc6f","sha256":"659bf63501a8054ef0eedda3dec466dbc1e9a1b2c4d5d59a285b005215e16679","sha512":"f90da6f2003442e547813d62f44e22e688f637616dd7f7f33c81e73d05a3a3de39947c0a8f580002cc96a716caecc4bcd988644ad78b01ae2e9a9792c726604e","ssdeep":"768:O6T4cK2yQ6eO1P2WgcdxazvszXIgBB1ARna76Ae/FqsSwYxRrqhlr3NqR:m1Q6eO4+IUzXXsjvi1alrcR","tlshash":"6153e88535d9b0ab42837878946f310bf2ab6d52641c8410db1dd4dabcb4e49e63ffe8","first_seen":"2024-05-16T20:37:02Z","last_seen":"2026-08-11T05:55:54.142228Z","times_seen":15255,"resource_available":true,"data":null}},"time_used":295,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":295,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"user_akbkyowd9geqr98","sensor_type":"yara","title":"Private YARA rules","description":"Private YARA rules","scan_date":"2026-02-06","alert":"Hunting_JS_WebAssembly","trigger":"telegram.hzxcopka.cn/rlottie-wasm.f013598f1b2ba719f25e.js","verdict":"audit","severity":"audit","comment":"","link":"","meta":{"description":"Looking for manual construction of JS wasmCode used in exploits","rule":"Hunting_JS_WebAssembly"},"detection_meta":{"user_id":"akbkyowd9geqr98","detection_id":"01K9VTTZ58QH7V4PSKSDDP3N4H","visibility":"private"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"telegram.hzxcopka.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/redirect.js","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram.hzxcopka.cn/","date":"2026-02-06T21:40:14.633Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.qianxunsm.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 06:26:39 GMT","end":"Wed, 08 Apr 2026 06:26:38 GMT"},"fingerprint":{"sha1":"13:A8:93:83:98:C2:54:FD:EF:D9:AE:B2:1C:0C:4E:74:2A:21:8C:6F","sha256":"A0:B6:50:7C:E9:E4:5B:99:81:6D:28:6E:B1:F5:FD:A3:DD:61:A7:25:04:4A:95:B8:04:B9:44:83:43:41:FC:BB"}}},"request":{"raw":"GET /redirect.js HTTP/1.1\r\nHost: telegram.hzxcopka.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegram.hzxcopka.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 06 Feb 2026 21:40:14 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 325\r\nlast-modified: Thu, 18 Dec 2025 06:27:02 GMT\r\netag: \"69439eb6-145\"\r\nexpires: Sat, 07 Feb 2026 09:40:14 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":325,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"17773b57b87a678c98e26a7cac72df6c","sha1":"7422857aa75ee81cabcec2eed6c4a6168f363ee1","sha256":"375141f2d3f04c733276dbff5d9208ff36b2db6a64abcee723179ac24797974f","sha512":"28d9e1c2af08154e653e2291db46f4110edbf9f5591192f8d695c8852f9c3c755d69dfb5a032a45f51e0a3fc9417f16c20d0772b1225ca9b85e5531e12fa8bfc","ssdeep":"","tlshash":"e8e07dda0279030417e013f36d82b4709137c2fb604c5d028d984321a1b9b4f5b7b84f","first_seen":"2023-07-27T09:32:34Z","last_seen":"2026-08-11T05:55:54.245741Z","times_seen":11540,"resource_available":true,"data":null}},"time_used":292,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":292,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"telegram.hzxcopka.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/7784.2a486dcaaaf47415a095.js","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js","date":"2026-02-06T21:40:19.558Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.qianxunsm.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 06:26:39 GMT","end":"Wed, 08 Apr 2026 06:26:38 GMT"},"fingerprint":{"sha1":"13:A8:93:83:98:C2:54:FD:EF:D9:AE:B2:1C:0C:4E:74:2A:21:8C:6F","sha256":"A0:B6:50:7C:E9:E4:5B:99:81:6D:28:6E:B1:F5:FD:A3:DD:61:A7:25:04:4A:95:B8:04:B9:44:83:43:41:FC:BB"}}},"request":{"raw":"GET /7784.2a486dcaaaf47415a095.js HTTP/1.1\r\nHost: telegram.hzxcopka.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 06 Feb 2026 21:40:19 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 18 Dec 2025 06:26:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69439eb1-5268\"\r\nexpires: Sat, 07 Feb 2026 09:40:19 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":21096,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (20959)","md5":"7dc8152b66709fb680cef0db2612ed8c","sha1":"e74591cf18b30dc6246228a0ee5cbd4895ab40dc","sha256":"83d4b9cca15b21490235040ecd1c9bf691569ec51e5b9757f0799eec8b9765b5","sha512":"ee30fff33646fa2480e06a2f2e9a9c74ba1df396749124839392e5145194fe4b6da4ad936066c2438a65b2f82dbf6e8b5b7e4faa8d4b5d9dd5f849c24c6e9734","ssdeep":"384:FAfpRdH3KLSWInGDrQ+YW5LhoASLv5S8VwktQ0CSRU6f/k5MC6LEmYwt/9RXC6ia:FAfpRdX+DrQ2LhoASLFtQUU63k5MC6Lh","tlshash":"5a92187a56ad05c252ec48e908cb1c9951b8e0233c871d7e9174fdd630f28e7e2ead79","first_seen":"2025-06-07T09:51:34.136663Z","last_seen":"2026-07-16T16:02:47.586596Z","times_seen":220,"resource_available":true,"data":null}},"time_used":293,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":293,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"telegram.hzxcopka.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/7784.2a486dcaaaf47415a095.js","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js","date":"2026-02-06T21:40:19.554Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.qianxunsm.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 06:26:39 GMT","end":"Wed, 08 Apr 2026 06:26:38 GMT"},"fingerprint":{"sha1":"13:A8:93:83:98:C2:54:FD:EF:D9:AE:B2:1C:0C:4E:74:2A:21:8C:6F","sha256":"A0:B6:50:7C:E9:E4:5B:99:81:6D:28:6E:B1:F5:FD:A3:DD:61:A7:25:04:4A:95:B8:04:B9:44:83:43:41:FC:BB"}}},"request":{"raw":"GET /7784.2a486dcaaaf47415a095.js HTTP/1.1\r\nHost: telegram.hzxcopka.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 06 Feb 2026 21:40:19 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 18 Dec 2025 06:26:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69439eb1-5268\"\r\nexpires: Sat, 07 Feb 2026 09:40:19 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":21096,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (20959)","md5":"7dc8152b66709fb680cef0db2612ed8c","sha1":"e74591cf18b30dc6246228a0ee5cbd4895ab40dc","sha256":"83d4b9cca15b21490235040ecd1c9bf691569ec51e5b9757f0799eec8b9765b5","sha512":"ee30fff33646fa2480e06a2f2e9a9c74ba1df396749124839392e5145194fe4b6da4ad936066c2438a65b2f82dbf6e8b5b7e4faa8d4b5d9dd5f849c24c6e9734","ssdeep":"384:FAfpRdH3KLSWInGDrQ+YW5LhoASLv5S8VwktQ0CSRU6f/k5MC6LEmYwt/9RXC6ia:FAfpRdX+DrQ2LhoASLFtQUU63k5MC6Lh","tlshash":"5a92187a56ad05c252ec48e908cb1c9951b8e0233c871d7e9174fdd630f28e7e2ead79","first_seen":"2025-06-07T09:51:34.136663Z","last_seen":"2026-07-16T16:02:47.586596Z","times_seen":220,"resource_available":true,"data":null}},"time_used":294,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":294,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"telegram.hzxcopka.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"telegram.hzxcopka.cn/5905.04b286b6eff2126d05dc.js","fqdn":"telegram.hzxcopka.cn","domain":"hzxcopka.cn","tld":"cn"},"ip":{"addr":"38.175.198.28","port":443,"asn":400304,"as":"REDOUBT-NET","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js","date":"2026-02-06T21:40:20.166Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.qianxunsm.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 08 Jan 2026 06:26:39 GMT","end":"Wed, 08 Apr 2026 06:26:38 GMT"},"fingerprint":{"sha1":"13:A8:93:83:98:C2:54:FD:EF:D9:AE:B2:1C:0C:4E:74:2A:21:8C:6F","sha256":"A0:B6:50:7C:E9:E4:5B:99:81:6D:28:6E:B1:F5:FD:A3:DD:61:A7:25:04:4A:95:B8:04:B9:44:83:43:41:FC:BB"}}},"request":{"raw":"GET /5905.04b286b6eff2126d05dc.js HTTP/1.1\r\nHost: telegram.hzxcopka.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://telegram.hzxcopka.cn/9443.f9ec9804d24c995d9869.js\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 06 Feb 2026 21:40:20 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 18 Dec 2025 06:26:57 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69439eb1-25e25\"\r\nexpires: Sat, 07 Feb 2026 09:40:20 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":155173,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"353bd230c8bed14cd25d2d5c930f4f82","sha1":"bd3987c8fba61d3d5ae0dace22d099553d205db0","sha256":"4db4cb681f199d995ea8613c37d9b1f17238bf9c0f41386a183df6783d468cf9","sha512":"7a0f674bdcabf84df189a21d146c108044ff5e7a56571f1b99de4e8f7ef2142e52c6d463a29d0de1d8374f2aa540c5969ddbd547e455d126eb1cffa1bf2ad3be","ssdeep":"1536:ouG3B/McaUFrnb3wHkgJ4K9pKMwHI/CglGQnAnkY0tfXuYEU3:YlrbBgXGsQkyK","tlshash":"0ce3b682f86424161392a1e654b60749b739f41ca8c540acfb7cfed52dbcd8e36ab734","first_seen":"2025-06-07T09:51:34.132674Z","last_seen":"2026-07-16T16:02:47.588262Z","times_seen":220,"resource_available":true,"data":null}},"time_used":296,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":296,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"telegram.hzxcopka.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"telegram.hzxcopka.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}