{"report_id":"f36ae6c7-810d-4b6e-8260-507f2879e9fa","version":0,"status":"done","tags":[],"date":"2026-07-17T13:49:02Z","url":{"schema":"https","addr":"cad.xznkjzx.cn/","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":0,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"final":{"url":{"schema":"https","addr":"cad.xznkjzx.cn/","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"title":"AutoCAD下载","dom":{"size":35013,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (367)","md5":"99e81d3871b0deb0831be7b21f5d695c","sha1":"a54dc7dba3624efd114e015295fe1e891eefee4b","sha256":"c57c6fbc65ee2d080b658199ba877d93b0b22c60e2b80881fcc848e3648f129a","sha512":"a84987c3eb50d81cedde2d1d80b2329016d0da678ff8b0f43771149cf733c11ee9a9faed23a6cdd519326dbd4797df10f57777e01d49a64021597b0d02e8d3c5","ssdeep":"768:nUksw72XwDmrg7C7c7VTVTLTVTXTlTjT1byb8bO7WN8LSBABiDS65p57EpxhcxXH:UE2AykG4xJfpb53pGwiqS2ake65s8Zhx","tlshash":"cff20d35a4f289bb01a3e1c0521a276a7de0a113dd0248c4b7fd9be1cf56e63dd3b5a4","dom_hash":"domhash603917dd58f4a59a076b96e33a090097","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"cad.xznkjzx.cn/","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":0,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-21T13:49:02Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"easy.adobecad.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"cad.xznkjzx.cn","ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"domain_registered":"2023-08-10","domain_rank":0,"first_seen":"2026-07-17T13:49:03.046804Z","last_seen":"2026-07-17T13:49:03.046804Z","alert_count":52,"request_count":26,"received_data":820659,"sent_data":13329,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"tb.53kf.com","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2005-11-07","domain_rank":2131794,"first_seen":"2013-04-26T03:20:49Z","last_seen":"2026-07-12T20:10:01.010148Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":486,"comment":"","tags":null,"fingerprints":null},{"fqdn":"easy.adobecad.com.cn","ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":1,"request_count":1,"received_data":305,"sent_data":673,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"cad.xznkjzx.cn/","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":true,"md5":"daa1068c4919ee3893ab3b867ccea67a","sha1":"e756aa01bd261fc38823861f9efb848a32a49554","sha256":"d91b10bb37bf2dfb504f0b9981faafa3d12ee02c766efc555d827cc1ad5ff9b4","sha512":"fa918ec8a23c18879e1a9649482bc9fcc36ed4974c1ad128e707d58a328090ea6383ae285a3f8444d7898f6100a239331d2df21a6ed66549ebc59c7c4ea351e0","ssdeep":"","tlshash":"66d0a75e354018346b8a10f4157bde8c74bd144cb07850c2d989d7440c7cfe69c5a58e","size":237,"data":"","first_seen":"2026-07-17T13:49:10.906042Z","last_seen":"2026-07-17T13:53:36.019691Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cad.xznkjzx.cn/","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":true,"md5":"e323d8b1163e8189c54f5f33b5a0ce8e","sha1":"2856f383dd3e81ed4a102547f464112ee6a924d9","sha256":"9c4655464f21aa715fbb7348106690b42857e5cc8a926a0c7ed49757bc88f184","sha512":"1275620b5d2c6a94fec82655e99d6bc313a177d92a063f467c426c29277121bb0a388a72cfda3a5d3d9ccf4f4f00c109f8137171e74782bbd4f18568eff27126","ssdeep":"","tlshash":"c5f08b08102410b0a0f3ac1547ee5980357230c7a816ac303c8c8d91df6a5ec047e7e8","size":566,"data":"","first_seen":"2026-07-17T13:49:10.908056Z","last_seen":"2026-07-17T13:53:36.020426Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cad.xznkjzx.cn/","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":true,"md5":"035ea26571453ec5562d4a7cc56eafda","sha1":"2319326276ee6b35be1ef13a8eaadf9e36571926","sha256":"a92735916d4348eb77a4da26b48b33a4f7afb84a279ff3dba154691e14708c6f","sha512":"1307b5b2f7f8a3afeccd5a6dc5d97f4c204a959f219a8f3f5ca052a3a73b189eedcc81a79135bb4197cdc117e098a023ce09cf278c4bbcdba1026b06ed99e3ee","ssdeep":"","tlshash":"dee02caf88b508414f5bb02e891fa8097223401bec58bc62bc8d09a80f4877c46b1382","size":424,"data":"","first_seen":"2026-07-17T13:49:10.909791Z","last_seen":"2026-07-17T13:53:36.021212Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cad.xznkjzx.cn/","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":true,"md5":"85bf6f1b74ddeca493b3c01b86e31f48","sha1":"9f59b077840ed542cac02ba08d486fe705646083","sha256":"b8eb4f750a5b6a283b90a8603a01cc3c9b8b9bcb77743b945bea99b8f4809e43","sha512":"36889e417298dd137476d13dae99e9965a9518be579d4fdd4a68234c3ee4732ea03869cf7ce5f4d7601d9ff5b9ef0e24038b556157bcee1662b69d73d6f26145","ssdeep":"","tlshash":"a121be97b1a35c2d5a8f67320f2e179934293543dc142c81f90de2818f24be3d5ab799","size":1261,"data":"","first_seen":"2026-07-17T13:49:10.911586Z","last_seen":"2026-07-17T13:53:36.021914Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cad.xznkjzx.cn/","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":true,"md5":"3728bbcccba07c5bc403e980dbcf3424","sha1":"d49a9b4bf6acb386991978e532333d6e3b600fc6","sha256":"7786005b895821d06d9f5d52fbd7dc5149f50b1b8c5858237c9fa474de367d44","sha512":"383b141b47c57519652265932f20eebfd7037102cd98f54c0665b3445af55f2ed4fcda76097fa3ce0a450ad4946cf1c9e6c117331cb2654299f575e646b9502a","ssdeep":"","tlshash":"c411ef2d8bd310e119db20261b3f360d74aaf0931c87ed023d6c5b506fb8b2b52656f8","size":1061,"data":"","first_seen":"2026-07-17T13:49:10.91333Z","last_seen":"2026-07-17T13:53:36.022694Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cad.xznkjzx.cn/static/js/swiper-bundle.min.js","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"introduction_type":"scriptElement","is_inline":false,"md5":"c44016a358a170c6e50897090ac26e4d","sha1":"286b647921b2f4f5915a3b4ed82b304c4d4da216","sha256":"cc52733b73530cdb8ff7665895e0b1be88f67f1dcf738ec1ca3ec404f2723f97","sha512":"57599406db2e158f5236bfa9b650900253e486c1f44462dc6b3bce085b78d79a1dd817fdfd891d8d7c5909d86b3ff4d562c3de016b876be2982db8cd6de1275a","ssdeep":"3072:4JvSjMdkbrYnafpoy9v8cIWyUaV4y+oGeJUqEfrNK/MxF:4JvSYdkbrYnafpl9v8cIWybV4y+oGMNQ","tlshash":"c3e3f8896360b5a552e3268b93a9c611e3b51400b409c4e871bd0c9b6d7ed9813ffffe","size":143281,"data":"","first_seen":"2023-03-07T01:07:47Z","last_seen":"2026-07-17T13:53:35.953651Z","times_seen":1103,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"cad.xznkjzx.cn/","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-17T13:48:25.673Z","timestamp":1784296105673,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cad.xznkjzx.cn","organization":""},"issuer":{"commonName":"TrustAsia DV TLS RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 27 Apr 2026 00:00:00 GMT","end":"Sat, 25 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D6:6C:AC:EA:A5:F7:C0:0E:B6:90:49:32:E0:35:27:37:52:C7:DD:56","sha256":"0A:78:27:AC:E5:E9:99:A9:D7:67:17:A2:9D:5F:BD:85:F6:D7:03:C0:A0:26:58:DA:B5:B2:D2:92:33:8B:F5:44"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: cad.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 13:48:28 GMT\r\ncontent-type: text/html\r\nlast-modified: Sat, 11 Jul 2026 13:38:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a524762-7e65\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":32357,"size_decoded":6427,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"5268ce543bab0802a1633dbaa6a74d4d","sha1":"61ceef0e7a2848c0e4dfffcd2769b114371048dd","sha256":"3cf3fbbe17687586ca9dc86c96a88ae2b14404c18602f5ea066bcd707b87faa5","sha512":"5f081e1e267a85d227e5154c9404cb816e79c01f2811ff1ecacb4bd8cfd774349981c4a9ea3c495dc1e54c4f8fc9f3b5815380366f3d1b2868ff02cc4095738d","ssdeep":"768:YUivlhmeVFJ3hVR7RNR0ZyZ0ZCZoZSZEZyxjxZxvnFJ9hPLZLvfZk0pkYh0afeyJ:Lieef1TxLuA6wuwSQFLZFvBF7xk34jUc","tlshash":"d4e2de75a5f385f711abe1c0562a232a7ce0a143ed4148c8b3fdabe09f57e63d827464","first_seen":"2026-07-17T13:49:10.844701Z","last_seen":"2026-07-17T13:53:35.951228Z","times_seen":2,"resource_available":true,"data":null}},"time_used":3800,"timings":{"blocked":-1,"dns":32,"connect":304,"send":0,"wait":978,"receive":0,"ssl":1829},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cad.xznkjzx.cn/static/css/index.css","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://cad.xznkjzx.cn/","date":"2026-07-17T13:48:29.707Z","timestamp":1784296109707,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cad.xznkjzx.cn","organization":""},"issuer":{"commonName":"TrustAsia DV TLS RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 27 Apr 2026 00:00:00 GMT","end":"Sat, 25 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D6:6C:AC:EA:A5:F7:C0:0E:B6:90:49:32:E0:35:27:37:52:C7:DD:56","sha256":"0A:78:27:AC:E5:E9:99:A9:D7:67:17:A2:9D:5F:BD:85:F6:D7:03:C0:A0:26:58:DA:B5:B2:D2:92:33:8B:F5:44"}}},"request":{"raw":"GET /static/css/index.css HTTP/1.1\r\nHost: cad.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cad.xznkjzx.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 13:48:29 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 22 Aug 2023 06:26:08 GMT\r\nvary: Accept-Encoding\r\netag: W/\"64e45500-291e\"\r\nexpires: Sat, 18 Jul 2026 01:48:29 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10526,"size_decoded":2817,"mime_type":"text/css","magic":"ASCII text","md5":"ded688a1c79cd3213c0013a6531b2519","sha1":"ce446d8015e58103779ad35a03fb1cc5e602023e","sha256":"772c5d5347271fe576608062298d7fbbb9d53f18930d84a44cfcde06ce0eac59","sha512":"c843aa39763129325b7c9183b92889a7008976b64ae91c5763a4246faad6285383dcabec3d4a7b2fa5ea3b3496d456d46a202c2ccef6a0acef70b48f29fce027","ssdeep":"96:UC+34rlXrDSX5O7kK7CbX5N/ciZ2Nd+h5+Ov6DoGQ5qaTJtk3VHBqnIniStSN1zE:h+IrxrDxmz/cMhLQQ5quihqI+1zE","tlshash":"e222bfa39bb31541f91a84a96f659a95231ea043610fca3cbfc4b61cdf440d4b9b2fcd","first_seen":"2026-07-17T13:49:10.848477Z","last_seen":"2026-07-17T13:53:35.952798Z","times_seen":2,"resource_available":false,"data":null}},"time_used":303,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":303,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cad.xznkjzx.cn/static/picture/star-logo.png","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cad.xznkjzx.cn/","date":"2026-07-17T13:48:29.756Z","timestamp":1784296109756,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cad.xznkjzx.cn","organization":""},"issuer":{"commonName":"TrustAsia DV TLS RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 27 Apr 2026 00:00:00 GMT","end":"Sat, 25 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D6:6C:AC:EA:A5:F7:C0:0E:B6:90:49:32:E0:35:27:37:52:C7:DD:56","sha256":"0A:78:27:AC:E5:E9:99:A9:D7:67:17:A2:9D:5F:BD:85:F6:D7:03:C0:A0:26:58:DA:B5:B2:D2:92:33:8B:F5:44"}}},"request":{"raw":"GET /static/picture/star-logo.png HTTP/1.1\r\nHost: cad.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cad.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 13:48:29 GMT\r\ncontent-type: image/png\r\ncontent-length: 7805\r\nlast-modified: Mon, 11 May 2026 16:36:30 GMT\r\netag: \"6a02058e-1e7d\"\r\nexpires: Sun, 16 Aug 2026 13:48:29 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7805,"size_decoded":8147,"mime_type":"image/png","magic":"PNG image data, 89 x 70, 8-bit/color RGBA, non-interlaced","md5":"2e0d8e821fd7ee616327a7f6fdb6a71a","sha1":"46614b58c28b81d0fbc2be156f0b028cdf4a4ad1","sha256":"820b32fb2611821f767b6584eebd47a668c97bc955a1c5feabcb9f3f2152b4d5","sha512":"056d9495a969e288ee74cfe5cdd8aae6243542707892f4e3df0ee6e0ae749fa18b0f1fac821d7ae48cf5106c5fcfa80893f1a43bc6e00a0ed8a0e52bfb468117","ssdeep":"192:bYfYwPd05R4R3ihEQTlOxdVvKWCUxc03UFmu:qYw1w4UGQTUxdtK75","tlshash":"41f19defc0010a99fc5dddbb6f22a8db172e4524ba87058bf58c5095fa926476833b21","first_seen":"2026-07-17T13:49:10.851672Z","last_seen":"2026-07-17T13:53:36.012112Z","times_seen":2,"resource_available":false,"data":null}},"time_used":5523,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5523,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cad.xznkjzx.cn/static/picture/e7dbb3b7c64b207.png","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cad.xznkjzx.cn/","date":"2026-07-17T13:48:29.765Z","timestamp":1784296109765,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cad.xznkjzx.cn","organization":""},"issuer":{"commonName":"TrustAsia DV TLS RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 27 Apr 2026 00:00:00 GMT","end":"Sat, 25 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D6:6C:AC:EA:A5:F7:C0:0E:B6:90:49:32:E0:35:27:37:52:C7:DD:56","sha256":"0A:78:27:AC:E5:E9:99:A9:D7:67:17:A2:9D:5F:BD:85:F6:D7:03:C0:A0:26:58:DA:B5:B2:D2:92:33:8B:F5:44"}}},"request":{"raw":"GET /static/picture/e7dbb3b7c64b207.png HTTP/1.1\r\nHost: cad.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cad.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 13:48:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 36306\r\nlast-modified: Tue, 22 Aug 2023 06:26:08 GMT\r\netag: \"64e45500-8dd2\"\r\nexpires: Sun, 16 Aug 2026 13:48:31 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":36306,"size_decoded":36649,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"5636d604ec981a476f1f45b14dd7993d","sha1":"02e2ee7039f4bf840684d749dd94a86c11919e89","sha256":"7366fbc20f273e2771bba3f9e795bf9a75b111ef34efbfa105143d352598064d","sha512":"369e96beec2f9c0bbe543b5c0cbd33a10ba331482b5dc85b3aa4c92718e280a69b79f6e58edbc251711da147bacb9d0c178a81dfd6d2bc535d9449edf446b936","ssdeep":"768:qL+2D3PesTQhUOPNth1Kn098BDcMuwkCrWVQljMP4LRbJ3uzxyKhwDcFGJ:qD4hUoNP1N98V6wprGQd0Cb4YKIJ","tlshash":"def2e1e90a72e057c6a91e722c3e41049ded574b32bf3307e8855c8be3069dda7d85ac","first_seen":"2025-07-06T10:34:19.889268Z","last_seen":"2026-07-17T13:53:35.950045Z","times_seen":3,"resource_available":false,"data":null}},"time_used":11581,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7627,"receive":3954,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cad.xznkjzx.cn/static/picture/cad2020.png","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cad.xznkjzx.cn/","date":"2026-07-17T13:48:29.766Z","timestamp":1784296109766,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cad.xznkjzx.cn","organization":""},"issuer":{"commonName":"TrustAsia DV TLS RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 27 Apr 2026 00:00:00 GMT","end":"Sat, 25 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D6:6C:AC:EA:A5:F7:C0:0E:B6:90:49:32:E0:35:27:37:52:C7:DD:56","sha256":"0A:78:27:AC:E5:E9:99:A9:D7:67:17:A2:9D:5F:BD:85:F6:D7:03:C0:A0:26:58:DA:B5:B2:D2:92:33:8B:F5:44"}}},"request":{"raw":"GET /static/picture/cad2020.png HTTP/1.1\r\nHost: cad.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cad.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 13:48:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 57122\r\nlast-modified: Sat, 26 Aug 2023 09:12:18 GMT\r\netag: \"64e9c1f2-df22\"\r\nexpires: Sun, 16 Aug 2026 13:48:31 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":57122,"size_decoded":57465,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"2279231a8da5dad34b54b69b9c0a4881","sha1":"3f587a6edc6a090d2802d2ed73a05fc43f12dca5","sha256":"50f96a29badfcde0ad6df0968931e1abba59d4011329470950cce73ecf4b1b4d","sha512":"e516bac9049e340905f09f7d6d9a510a4e7127a30a09b3abf5e666e8c27c030cc6a244ae5e5b5d736f1a5eda03eeb84237795a587d7e739549530d41c2b5f09f","ssdeep":"1536:XwORFKnW/z+9GdSzzznJ5HI/s0bmO/mtcjBQU4yfBO:ga08y9GQzXHas0yztYQUnJO","tlshash":"314301f30ba86152687694757d812fc5473302dc58a0de247e4aff8f1e342ab9637a47","first_seen":"2026-07-17T13:49:10.857059Z","last_seen":"2026-07-17T13:53:36.013051Z","times_seen":2,"resource_available":false,"data":null}},"time_used":11881,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7626,"receive":4255,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cad.xznkjzx.cn/static/picture/img-014.png","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cad.xznkjzx.cn/","date":"2026-07-17T13:48:29.770Z","timestamp":1784296109770,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cad.xznkjzx.cn","organization":""},"issuer":{"commonName":"TrustAsia DV TLS RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 27 Apr 2026 00:00:00 GMT","end":"Sat, 25 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D6:6C:AC:EA:A5:F7:C0:0E:B6:90:49:32:E0:35:27:37:52:C7:DD:56","sha256":"0A:78:27:AC:E5:E9:99:A9:D7:67:17:A2:9D:5F:BD:85:F6:D7:03:C0:A0:26:58:DA:B5:B2:D2:92:33:8B:F5:44"}}},"request":{"raw":"GET /static/picture/img-014.png HTTP/1.1\r\nHost: cad.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cad.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 13:48:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 145\r\nlast-modified: Tue, 22 Aug 2023 06:26:08 GMT\r\netag: \"64e45500-91\"\r\nexpires: Sun, 16 Aug 2026 13:48:31 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":145,"size_decoded":484,"mime_type":"image/png","magic":"PNG image data, 42 x 37, 2-bit colormap, non-interlaced","md5":"dcd7f1a56d87985732cfad734ac214b3","sha1":"deaad9ba01c1b29a24ffb3eab5751a592ef1748a","sha256":"7ac85680fa231fd079697fc1d08356fbcb77f581a57b1a6a7b878874d601647c","sha512":"d3f06a7022b8a44a1b7729f3e0d59d7a877c81f04fe79d45c3cc0fdf53a6c4a965954351fac911b42b7a653a80f197c665c47ecb9cb6ee7da6b9cc0124c35809","ssdeep":"","tlshash":"2ac02be343458c368ae0c23b823a736b9b1d813ea40cb50f4f0dc4198c4c40e95c1fca","first_seen":"2024-09-19T22:37:12.218239Z","last_seen":"2026-07-17T13:53:35.993407Z","times_seen":5,"resource_available":false,"data":null}},"time_used":11877,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7622,"receive":4255,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cad.xznkjzx.cn/static/css/reset.css","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://cad.xznkjzx.cn/","date":"2026-07-17T13:48:29.706Z","timestamp":1784296109706,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cad.xznkjzx.cn","organization":""},"issuer":{"commonName":"TrustAsia DV TLS RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 27 Apr 2026 00:00:00 GMT","end":"Sat, 25 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D6:6C:AC:EA:A5:F7:C0:0E:B6:90:49:32:E0:35:27:37:52:C7:DD:56","sha256":"0A:78:27:AC:E5:E9:99:A9:D7:67:17:A2:9D:5F:BD:85:F6:D7:03:C0:A0:26:58:DA:B5:B2:D2:92:33:8B:F5:44"}}},"request":{"raw":"GET /static/css/reset.css HTTP/1.1\r\nHost: cad.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cad.xznkjzx.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 13:48:29 GMT\r\ncontent-type: text/css\r\ncontent-length: 954\r\nlast-modified: Tue, 22 Aug 2023 06:26:08 GMT\r\netag: \"64e45500-3ba\"\r\nexpires: Sat, 18 Jul 2026 01:48:29 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":954,"size_decoded":1291,"mime_type":"text/css","magic":"CSV ASCII text","md5":"e3cd35e7c0bdb6f704cca333c3c8f6f3","sha1":"a348716b1728ac0d67dddab7a6e040718f6948e9","sha256":"a73d98bd265f4ee08cb989460e71d33d31152dac86029bc30b9977b03befddb2","sha512":"23f788d4facddf2d15a8cbbd03d268fe859a0baa2bb1c71048aec70edf1b988af5278592cb59b792c10e45290f9e4e1f5b08772a9a9a18572146132c68612742","ssdeep":"","tlshash":"da119c8c110796c156359f3467464631fa0810f79e229231ba99ce245f789729785ebd","first_seen":"2024-09-19T22:37:12.21123Z","last_seen":"2026-07-17T13:53:35.989983Z","times_seen":5,"resource_available":false,"data":null}},"time_used":302,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":302,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cad.xznkjzx.cn/static/picture/autodesk.jpg","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cad.xznkjzx.cn/","date":"2026-07-17T13:48:29.760Z","timestamp":1784296109760,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cad.xznkjzx.cn","organization":""},"issuer":{"commonName":"TrustAsia DV TLS RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 27 Apr 2026 00:00:00 GMT","end":"Sat, 25 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D6:6C:AC:EA:A5:F7:C0:0E:B6:90:49:32:E0:35:27:37:52:C7:DD:56","sha256":"0A:78:27:AC:E5:E9:99:A9:D7:67:17:A2:9D:5F:BD:85:F6:D7:03:C0:A0:26:58:DA:B5:B2:D2:92:33:8B:F5:44"}}},"request":{"raw":"GET /static/picture/autodesk.jpg HTTP/1.1\r\nHost: cad.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cad.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 13:48:31 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 7642\r\nlast-modified: Tue, 22 Aug 2023 06:26:08 GMT\r\netag: \"64e45500-1dda\"\r\nexpires: Sun, 16 Aug 2026 13:48:31 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7642,"size_decoded":7985,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 200x200, components 3","md5":"fe1033a9d223e7e3e748120cbbfd1313","sha1":"8deefb4e2e14ce3cd73fa7c678f7c8e7c1f4aaab","sha256":"7e75d4fcaf1e54966d4e3ffbde0ca6a146aa3c3d031f57c66fca21036282b401","sha512":"7a92aeefb8f3a9be6cf82f7503c11dce8a80519bfb9ace54e141da11fe1f13861578c9a76a76c3cd9b9943705bd2d40aab767240de849f0f6bae30d5eaebd019","ssdeep":"192:1rsdLoplxwB4IQZUvmm+fgONsaX4glQ99AE+xnubqAfnMYv:1W87x4cUvmm+4OuamAE+5sn5","tlshash":"fbf18f5ad34a940cedb5223896c50d3ded273d617e824b606d943dfb654da1e82f0e90","first_seen":"2025-07-06T10:34:19.909932Z","last_seen":"2026-07-17T13:53:35.991772Z","times_seen":3,"resource_available":false,"data":null}},"time_used":9482,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7632,"receive":1850,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cad.xznkjzx.cn/static/picture/sw2.jpeg","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cad.xznkjzx.cn/","date":"2026-07-17T13:48:29.762Z","timestamp":1784296109762,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cad.xznkjzx.cn","organization":""},"issuer":{"commonName":"TrustAsia DV TLS RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 27 Apr 2026 00:00:00 GMT","end":"Sat, 25 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D6:6C:AC:EA:A5:F7:C0:0E:B6:90:49:32:E0:35:27:37:52:C7:DD:56","sha256":"0A:78:27:AC:E5:E9:99:A9:D7:67:17:A2:9D:5F:BD:85:F6:D7:03:C0:A0:26:58:DA:B5:B2:D2:92:33:8B:F5:44"}}},"request":{"raw":"GET /static/picture/sw2.jpeg HTTP/1.1\r\nHost: cad.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cad.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 13:48:31 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 90641\r\nlast-modified: Tue, 22 Aug 2023 06:26:08 GMT\r\netag: \"64e45500-16211\"\r\nexpires: Sun, 16 Aug 2026 13:48:31 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":90641,"size_decoded":90986,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 2064x2068, components 3","md5":"028c87bc5f46dfeb73805d4685cf0803","sha1":"1b409675abddd127e40b84cd71f29db118ee2e10","sha256":"bd437fd343ce117edff52069b274cc6c5d1f0611d26121f2550681cfb3b8c03f","sha512":"4f2f913d828bf03b1f6db9ef0eafe7aea88c03468b88f625be7cb07730e83cf6a97b81e7ad3815c87fbd207b3a72edbc3364a5d081d0164ff14c43e18159ed07","ssdeep":"1536:7QO4Syv7AgQU634xI2dLxJZXnFKEr6B99zhCvH+xpE90xevG:7QOI7AgQU634xt5xJZXnNr6B3hiexiu9","tlshash":"09930263b251d3d2e04de3fc048b13957ee24fbdc18b23a7c05a5aa7b1abb52bd90540","first_seen":"2025-07-06T10:34:19.885432Z","last_seen":"2026-07-17T13:53:35.954224Z","times_seen":3,"resource_available":false,"data":null}},"time_used":12487,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7630,"receive":4857,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cad.xznkjzx.cn/static/picture/sw3.jpeg","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cad.xznkjzx.cn/","date":"2026-07-17T13:48:29.763Z","timestamp":1784296109763,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cad.xznkjzx.cn","organization":""},"issuer":{"commonName":"TrustAsia DV TLS RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 27 Apr 2026 00:00:00 GMT","end":"Sat, 25 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D6:6C:AC:EA:A5:F7:C0:0E:B6:90:49:32:E0:35:27:37:52:C7:DD:56","sha256":"0A:78:27:AC:E5:E9:99:A9:D7:67:17:A2:9D:5F:BD:85:F6:D7:03:C0:A0:26:58:DA:B5:B2:D2:92:33:8B:F5:44"}}},"request":{"raw":"GET /static/picture/sw3.jpeg HTTP/1.1\r\nHost: cad.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cad.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 13:48:31 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 108797\r\nlast-modified: Tue, 22 Aug 2023 06:26:08 GMT\r\netag: \"64e45500-1a8fd\"\r\nexpires: Sun, 16 Aug 2026 13:48:31 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":108797,"size_decoded":109143,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 2000x2000, components 3","md5":"da4aadde003707898f19587a502647e7","sha1":"1612ed6e5eaab44a427e1ed51da35a5e48b6686e","sha256":"e2884b21521fc6e9c02770343776e628ab713515b9e613e0593772b72a89b292","sha512":"43ff928ec22a3e01239e7f9e89db52ae500d7163624226c9c0bc2638a038ecb4b0155a4d239d43c0e43417ea88eed8de217e63a5a21cefb861b5679ad9a52837","ssdeep":"1536:wT4oj5EN0jKymxlNTlK3R7QxU84Kbazf1UkfSqJoM3+GumMws8H7EsdVaT:wU+uaKy0Hs7Ql4cwSqJOGum3ws7G","tlshash":"dcb3f1678f5525a1d920b77084e30a3c3b7314b573eec589ea9b682039ba705bdfc781","first_seen":"2025-07-06T10:34:19.95003Z","last_seen":"2026-07-17T13:53:35.954819Z","times_seen":3,"resource_available":false,"data":null}},"time_used":12527,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7628,"receive":4899,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cad.xznkjzx.cn/static/picture/img-015.png","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cad.xznkjzx.cn/","date":"2026-07-17T13:48:29.771Z","timestamp":1784296109771,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cad.xznkjzx.cn","organization":""},"issuer":{"commonName":"TrustAsia DV TLS RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 27 Apr 2026 00:00:00 GMT","end":"Sat, 25 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D6:6C:AC:EA:A5:F7:C0:0E:B6:90:49:32:E0:35:27:37:52:C7:DD:56","sha256":"0A:78:27:AC:E5:E9:99:A9:D7:67:17:A2:9D:5F:BD:85:F6:D7:03:C0:A0:26:58:DA:B5:B2:D2:92:33:8B:F5:44"}}},"request":{"raw":"GET /static/picture/img-015.png HTTP/1.1\r\nHost: cad.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cad.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 13:48:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 348\r\nlast-modified: Tue, 22 Aug 2023 06:26:08 GMT\r\netag: \"64e45500-15c\"\r\nexpires: Sun, 16 Aug 2026 13:48:31 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":348,"size_decoded":688,"mime_type":"image/png","magic":"PNG image data, 40 x 40, 8-bit colormap, non-interlaced","md5":"27a3e95e0df09d444fcd22033c85a11b","sha1":"6a827aab7ff1a3b61d5179cc11c03e0df481bea6","sha256":"3604f83a65a9ec2fdf0ca36fe758672c28d2daf5ecae40c6b1bad614a207e7a4","sha512":"6b20b48abc85952597993d73263ae3867d2fbfcd7681d1a92e884233c9a1b5571e7491be7298b4d3e10854818dba97e24f410ff01ec954404318b14186aff5df","ssdeep":"","tlshash":"18e07defb761fc3ff9c0823292770485a11d9ae532405a37d5102863db011781c1f89f","first_seen":"2024-09-19T22:37:12.219471Z","last_seen":"2026-07-17T13:53:36.018526Z","times_seen":5,"resource_available":false,"data":null}},"time_used":11873,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7618,"receive":4255,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cad.xznkjzx.cn/static/picture/img-017.png","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cad.xznkjzx.cn/","date":"2026-07-17T13:48:29.774Z","timestamp":1784296109774,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cad.xznkjzx.cn","organization":""},"issuer":{"commonName":"TrustAsia DV TLS RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 27 Apr 2026 00:00:00 GMT","end":"Sat, 25 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D6:6C:AC:EA:A5:F7:C0:0E:B6:90:49:32:E0:35:27:37:52:C7:DD:56","sha256":"0A:78:27:AC:E5:E9:99:A9:D7:67:17:A2:9D:5F:BD:85:F6:D7:03:C0:A0:26:58:DA:B5:B2:D2:92:33:8B:F5:44"}}},"request":{"raw":"GET /static/picture/img-017.png HTTP/1.1\r\nHost: cad.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cad.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 13:48:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 12418\r\nlast-modified: Tue, 22 Aug 2023 06:26:08 GMT\r\netag: \"64e45500-3082\"\r\nexpires: Sun, 16 Aug 2026 13:48:31 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12418,"size_decoded":12761,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"16f87b132b30f1a00a98ba833678bfc8","sha1":"2d6e42e0327a4803174bed8d938051dc72c42dd3","sha256":"fd762d0a8bde64662d65b02fd224c93e9bb7690379aef1afa2508431398d7f93","sha512":"0f4d7f88694bd6e9e8821d59444a927d62fa8e20ef0daa4993614c3e80de37d719d86a8c3f1631fcad51731655f8da81d7ab1d13ffe3885879c0ef8a9528916d","ssdeep":"192:51hZ+Mnt1fif+3HoLcZd2hTithO8x2VUaArxQXCDWnhJaDj5TMJ6OAgZ:51a2t164HOcjeivJr+XiWnhoDKgOAgZ","tlshash":"a642b0459388e866e9dbf84fc0f013b0af53892dab60b1ee1879c17a05b270213955b7","first_seen":"2024-09-19T22:37:12.242146Z","last_seen":"2026-07-17T13:53:35.994332Z","times_seen":9,"resource_available":false,"data":null}},"time_used":11873,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7617,"receive":4256,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cad.xznkjzx.cn/static/picture/img-018.png","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cad.xznkjzx.cn/","date":"2026-07-17T13:48:29.775Z","timestamp":1784296109775,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cad.xznkjzx.cn","organization":""},"issuer":{"commonName":"TrustAsia DV TLS RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 27 Apr 2026 00:00:00 GMT","end":"Sat, 25 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D6:6C:AC:EA:A5:F7:C0:0E:B6:90:49:32:E0:35:27:37:52:C7:DD:56","sha256":"0A:78:27:AC:E5:E9:99:A9:D7:67:17:A2:9D:5F:BD:85:F6:D7:03:C0:A0:26:58:DA:B5:B2:D2:92:33:8B:F5:44"}}},"request":{"raw":"GET /static/picture/img-018.png HTTP/1.1\r\nHost: cad.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cad.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 13:48:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 21842\r\nlast-modified: Tue, 22 Aug 2023 06:26:08 GMT\r\netag: \"64e45500-5552\"\r\nexpires: Sun, 16 Aug 2026 13:48:31 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21842,"size_decoded":22185,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"8e3012d2d5991bdbb776d05244e7d9d3","sha1":"aaa2d7a4ba9941b0e98ef8057025c026389700c8","sha256":"dc332124ca3743fa02c63588ebf9acb3d51ba71fda5111bc286fbf0e731e2d6b","sha512":"707c595a185cea9eb17505884f98780ce87fbf3fb8dde032ba1f9c87109a5ea4e752559eeccaac904fcbdd4c70d6107d3bae0e549b15486fab403c2613006ba0","ssdeep":"384:h5Xa+LFIpHhcabos8mz9xJWYhMYSHqjroW8cXG97yaMsuvFEfl/9nerKuz:qa6HWaboslNR+YF11XG9OaM7W19e5","tlshash":"c9a2e1d075ca9fe6eb15faacb9487692e1042d714896c05b7c26d6731e0a4b37f60c0d","first_seen":"2024-09-19T22:37:12.236922Z","last_seen":"2026-07-17T13:53:35.995015Z","times_seen":9,"resource_available":false,"data":null}},"time_used":12172,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7617,"receive":4555,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cad.xznkjzx.cn/static/picture/img-020.png","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cad.xznkjzx.cn/","date":"2026-07-17T13:48:29.779Z","timestamp":1784296109779,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cad.xznkjzx.cn","organization":""},"issuer":{"commonName":"TrustAsia DV TLS RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 27 Apr 2026 00:00:00 GMT","end":"Sat, 25 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D6:6C:AC:EA:A5:F7:C0:0E:B6:90:49:32:E0:35:27:37:52:C7:DD:56","sha256":"0A:78:27:AC:E5:E9:99:A9:D7:67:17:A2:9D:5F:BD:85:F6:D7:03:C0:A0:26:58:DA:B5:B2:D2:92:33:8B:F5:44"}}},"request":{"raw":"GET /static/picture/img-020.png HTTP/1.1\r\nHost: cad.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cad.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 13:48:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 17669\r\nlast-modified: Tue, 22 Aug 2023 06:26:08 GMT\r\netag: \"64e45500-4505\"\r\nexpires: Sun, 16 Aug 2026 13:48:31 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":17669,"size_decoded":18012,"mime_type":"image/png","magic":"PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced","md5":"17941edcc0dbda75dcda876829ea2e00","sha1":"6753f59e2d5185997e6ae52b890bc488a8bbe650","sha256":"caf18e5eb8d8490c11ed77d8cc2713dc4539384a21de84f880173824b704140c","sha512":"acff677bc05ada73a74928c99fe354acdaa10dd6a595b5e67bb9dc10d7c2c1dd0865c19d85ce40adf7d3853e756d0a98d30b161266e7fc6261aa7d13b06c82e3","ssdeep":"384:S7IgwfviMqI+h1aIit0Iw8a6mmcfGmMMJaFOoDHbOv3smuMn:pyMq/viK6mLKOoDHbg5d","tlshash":"7c82d0e78d423d0dccafd77788f51711ea984a81a0358ee824d311929ec17c4e25bade","first_seen":"2024-09-19T22:37:12.231507Z","last_seen":"2026-07-17T13:53:36.008218Z","times_seen":3,"resource_available":false,"data":null}},"time_used":12469,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7614,"receive":4855,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cad.xznkjzx.cn/static/css/swiper-bundle.min.css","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://cad.xznkjzx.cn/","date":"2026-07-17T13:48:29.746Z","timestamp":1784296109746,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cad.xznkjzx.cn","organization":""},"issuer":{"commonName":"TrustAsia DV TLS RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 27 Apr 2026 00:00:00 GMT","end":"Sat, 25 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D6:6C:AC:EA:A5:F7:C0:0E:B6:90:49:32:E0:35:27:37:52:C7:DD:56","sha256":"0A:78:27:AC:E5:E9:99:A9:D7:67:17:A2:9D:5F:BD:85:F6:D7:03:C0:A0:26:58:DA:B5:B2:D2:92:33:8B:F5:44"}}},"request":{"raw":"GET /static/css/swiper-bundle.min.css HTTP/1.1\r\nHost: cad.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cad.xznkjzx.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 13:48:29 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 22 Aug 2023 06:26:08 GMT\r\nvary: Accept-Encoding\r\netag: W/\"64e45500-37cf\"\r\nexpires: Sat, 18 Jul 2026 01:48:29 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14287,"size_decoded":3558,"mime_type":"text/css","magic":"ASCII text, with very long lines (14034)","md5":"29172a3901cb08a3ea62ea656fddf46d","sha1":"1d0ac2040dc6b268926d790b5844ee8f782d0633","sha256":"7ad86b3405add9e8be115d7ac4ad86210032134274175399ec5dd8a494f19e93","sha512":"eec3425cc208873e3ed6aef761cf27336e4cb9201f9fd51817fc50401ff48f9acde1ab435db1503f256c63ee60b1a1a05fab42431a1ceb775a40f75ceb696d38","ssdeep":"192:8bmT4bHZ+SKbnxup/a2AMQfHff71eesedOJ9A5Pz+c3At2/6:8yMbHZ+Vnh2AVfHfA4XYz","tlshash":"4452e1585340282753274f374bb1cbb9d6b444c14b93896e92c0ee48d7f6cb9236f2e5","first_seen":"2026-07-17T13:49:10.888373Z","last_seen":"2026-07-17T13:53:36.016274Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1171,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1171,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cad.xznkjzx.cn/static/js/swiper-bundle.min.js","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://cad.xznkjzx.cn/","date":"2026-07-17T13:48:29.750Z","timestamp":1784296109750,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cad.xznkjzx.cn","organization":""},"issuer":{"commonName":"TrustAsia DV TLS RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 27 Apr 2026 00:00:00 GMT","end":"Sat, 25 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D6:6C:AC:EA:A5:F7:C0:0E:B6:90:49:32:E0:35:27:37:52:C7:DD:56","sha256":"0A:78:27:AC:E5:E9:99:A9:D7:67:17:A2:9D:5F:BD:85:F6:D7:03:C0:A0:26:58:DA:B5:B2:D2:92:33:8B:F5:44"}}},"request":{"raw":"GET /static/js/swiper-bundle.min.js HTTP/1.1\r\nHost: cad.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cad.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 13:48:29 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 22 Aug 2023 06:26:08 GMT\r\nvary: Accept-Encoding\r\netag: W/\"64e45500-22fb1\"\r\nexpires: Sat, 18 Jul 2026 01:48:29 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":143281,"size_decoded":46377,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65283)","md5":"c44016a358a170c6e50897090ac26e4d","sha1":"286b647921b2f4f5915a3b4ed82b304c4d4da216","sha256":"cc52733b73530cdb8ff7665895e0b1be88f67f1dcf738ec1ca3ec404f2723f97","sha512":"57599406db2e158f5236bfa9b650900253e486c1f44462dc6b3bce085b78d79a1dd817fdfd891d8d7c5909d86b3ff4d562c3de016b876be2982db8cd6de1275a","ssdeep":"3072:4JvSjMdkbrYnafpoy9v8cIWyUaV4y+oGeJUqEfrNK/MxF:4JvSYdkbrYnafpl9v8cIWybV4y+oGMNQ","tlshash":"c3e3f8896360b5a552e3268b93a9c611e3b51400b409c4e871bd0c9b6d7ed9813ffffe","first_seen":"2023-03-07T01:07:47Z","last_seen":"2026-07-17T13:53:35.953651Z","times_seen":1103,"resource_available":true,"data":null}},"time_used":2369,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2369,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cad.xznkjzx.cn/static/picture/cad-img-008.png","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cad.xznkjzx.cn/","date":"2026-07-17T13:48:29.757Z","timestamp":1784296109757,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cad.xznkjzx.cn","organization":""},"issuer":{"commonName":"TrustAsia DV TLS RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 27 Apr 2026 00:00:00 GMT","end":"Sat, 25 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D6:6C:AC:EA:A5:F7:C0:0E:B6:90:49:32:E0:35:27:37:52:C7:DD:56","sha256":"0A:78:27:AC:E5:E9:99:A9:D7:67:17:A2:9D:5F:BD:85:F6:D7:03:C0:A0:26:58:DA:B5:B2:D2:92:33:8B:F5:44"}}},"request":{"raw":"GET /static/picture/cad-img-008.png HTTP/1.1\r\nHost: cad.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cad.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 13:48:29 GMT\r\ncontent-type: image/png\r\ncontent-length: 7338\r\nlast-modified: Tue, 22 Aug 2023 06:26:08 GMT\r\netag: \"64e45500-1caa\"\r\nexpires: Sun, 16 Aug 2026 13:48:29 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7338,"size_decoded":7680,"mime_type":"image/png","magic":"PNG image data, 136 x 88, 8-bit/color RGBA, non-interlaced","md5":"686c4e81a81aeb48964f9801e1f9af78","sha1":"6b5ace87a3698a073995376011572efd6964bc7a","sha256":"85a723db91ad8e58d1dff9f753314b02a27c7f2ed704a59774f9148b8e06ccd6","sha512":"33338de74c26b5fe2710efdda28a187708f8362fd75af703fc6e05cdf8ff14d258bf49dd8a3c43f8e2851021bd54bdfc9031ac2bd95aabc536495a750c9d72f0","ssdeep":"96:Ig9L/EDDznuG8JNH5AJnv1kBXYMH9ntOxmJfIdRzxM+s2gE6+b8AWZqA0jWeAJOW:I2M3J8JNH8GoQOGITK+s23EdDdG4NcBa","tlshash":"58e1bee48967ec9ec1c6000f80200309df75977ca64430b73aabfd9e2a29768de15b4a","first_seen":"2025-07-06T10:34:19.902736Z","last_seen":"2026-07-17T13:53:36.017483Z","times_seen":3,"resource_available":false,"data":null}},"time_used":5826,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5826,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cad.xznkjzx.cn/static/picture/img-013.png","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cad.xznkjzx.cn/","date":"2026-07-17T13:48:29.769Z","timestamp":1784296109769,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cad.xznkjzx.cn","organization":""},"issuer":{"commonName":"TrustAsia DV TLS RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 27 Apr 2026 00:00:00 GMT","end":"Sat, 25 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D6:6C:AC:EA:A5:F7:C0:0E:B6:90:49:32:E0:35:27:37:52:C7:DD:56","sha256":"0A:78:27:AC:E5:E9:99:A9:D7:67:17:A2:9D:5F:BD:85:F6:D7:03:C0:A0:26:58:DA:B5:B2:D2:92:33:8B:F5:44"}}},"request":{"raw":"GET /static/picture/img-013.png HTTP/1.1\r\nHost: cad.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cad.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 13:48:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 152\r\nlast-modified: Tue, 22 Aug 2023 06:26:08 GMT\r\netag: \"64e45500-98\"\r\nexpires: Sun, 16 Aug 2026 13:48:31 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":152,"size_decoded":491,"mime_type":"image/png","magic":"PNG image data, 40 x 40, 2-bit colormap, non-interlaced","md5":"82ed475fc43e07eb70adbb7ec408530c","sha1":"2e78c7fb0ac330a6042a11d7b8059416777f7ff1","sha256":"df7c2c0ed4a6ad44d97861e039535d580a739d3f3ee847ff2d3eb813ccf52779","sha512":"a4776cd3023bc4db319e345f72c390514bd65cc33b56714d309c9870351b9c9cfc16f9311bacc50303d01b41272cbf3c31b497f9ba99dd8644853505984154f4","ssdeep":"","tlshash":"e6c08cf333018c388925d136223401159b28a128a00c860e468441e906ed00da2aeece","first_seen":"2024-09-19T22:37:12.216765Z","last_seen":"2026-07-17T13:53:36.014021Z","times_seen":5,"resource_available":false,"data":null}},"time_used":11879,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7624,"receive":4255,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tb.53kf.com/code/code/b42c571f6a4c7fd01a6b00c3e1591dea7/1","fqdn":"tb.53kf.com","domain":"53kf.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://cad.xznkjzx.cn/","date":"2026-07-17T13:48:31.148Z","timestamp":1784296111148,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /code/code/b42c571f6a4c7fd01a6b00c3e1591dea7/1 HTTP/1.1\r\nHost: tb.53kf.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cad.xznkjzx.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T15:40:28.095252Z","times_seen":17318195,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cad.xznkjzx.cn/static/images/cad-img-001.png","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cad.xznkjzx.cn/","date":"2026-07-17T13:48:31.152Z","timestamp":1784296111152,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cad.xznkjzx.cn","organization":""},"issuer":{"commonName":"TrustAsia DV TLS RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 27 Apr 2026 00:00:00 GMT","end":"Sat, 25 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D6:6C:AC:EA:A5:F7:C0:0E:B6:90:49:32:E0:35:27:37:52:C7:DD:56","sha256":"0A:78:27:AC:E5:E9:99:A9:D7:67:17:A2:9D:5F:BD:85:F6:D7:03:C0:A0:26:58:DA:B5:B2:D2:92:33:8B:F5:44"}}},"request":{"raw":"GET /static/images/cad-img-001.png HTTP/1.1\r\nHost: cad.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cad.xznkjzx.cn/static/css/index.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 13:48:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 128817\r\nlast-modified: Thu, 30 Oct 2025 16:28:59 GMT\r\netag: \"6903924b-1f731\"\r\nexpires: Sun, 16 Aug 2026 13:48:31 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":128817,"size_decoded":129162,"mime_type":"image/png","magic":"PNG image data, 1600 x 1276, 8-bit/color RGBA, non-interlaced","md5":"e5f7f9efdd84e7a044b29a5b6c405756","sha1":"e85626508a8458b523cc4b71e24a26ea2a5beee6","sha256":"84d19b77ce79cde679f392a7ba49f194fbd8b5a65def2a2bbac240b637aaa5b4","sha512":"5b9c6ded523702f31c076ac62719a3a378edee649efb4fa21ad3f0099d9dc5446516011255ef3ff31462025f5f72f36f2345062be7d21ad3708378c645c34314","ssdeep":"3072:XQGDzT6C4mxZ4TCYJkB4+i5t0fVT4Ou3ggctfZZV9/:XQEqCiym+i5tyNYlctBZn","tlshash":"10c31252a69caa3fdc30bd3eca980a39845675d812dc4f5ac561e31ed098c53ff0366b","first_seen":"2026-07-17T13:49:10.898139Z","last_seen":"2026-07-17T13:53:36.010746Z","times_seen":2,"resource_available":false,"data":null}},"time_used":8991,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6241,"receive":2750,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cad.xznkjzx.cn/static/images/img-022.png","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cad.xznkjzx.cn/","date":"2026-07-17T13:48:31.153Z","timestamp":1784296111153,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cad.xznkjzx.cn","organization":""},"issuer":{"commonName":"TrustAsia DV TLS RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 27 Apr 2026 00:00:00 GMT","end":"Sat, 25 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D6:6C:AC:EA:A5:F7:C0:0E:B6:90:49:32:E0:35:27:37:52:C7:DD:56","sha256":"0A:78:27:AC:E5:E9:99:A9:D7:67:17:A2:9D:5F:BD:85:F6:D7:03:C0:A0:26:58:DA:B5:B2:D2:92:33:8B:F5:44"}}},"request":{"raw":"GET /static/images/img-022.png HTTP/1.1\r\nHost: cad.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cad.xznkjzx.cn/static/css/index.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 13:48:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 682\r\nlast-modified: Tue, 22 Aug 2023 06:26:08 GMT\r\netag: \"64e45500-2aa\"\r\nexpires: Sun, 16 Aug 2026 13:48:31 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":682,"size_decoded":1022,"mime_type":"image/png","magic":"PNG image data, 1920 x 10, 8-bit/color RGB, non-interlaced","md5":"1d42f7c4b9fa6f07ac3b509d720bbf80","sha1":"d53e4bd41c381adb2efa25f5017c85a88cef733d","sha256":"cb3e4f8da87ea0683b7fd4eae878920abbdfe863b9816f83cb42ab014b88a1af","sha512":"6a69bb3fd2d3ee7ac44b5ee08a1c60e9621a15d6e9d8d72e999832e24bc27559226b0c169a16f648f85e94061ba91e2a6eddd92d4ee5d3f58b854edc63314f1f","ssdeep":"","tlshash":"bc014e87ea600c31dd58ba320366464a1d974b2d0ca2828c8a3cb9261f32b21a119a0b","first_seen":"2024-08-09T23:38:58Z","last_seen":"2026-07-17T13:53:35.948746Z","times_seen":7,"resource_available":false,"data":null}},"time_used":8089,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6240,"receive":1849,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"easy.adobecad.com.cn/api_visit.php?type=pageview\u0026site=baidu_cad\u0026domain=cad.xznkjzx.cn\u0026path=%2F\u0026url=https%3A%2F%2Fcad.xznkjzx.cn%2F\u0026referrer=\u0026_=178429611475361204","fqdn":"easy.adobecad.com.cn","domain":"adobecad.com.cn","tld":"com.cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cad.xznkjzx.cn/","date":"2026-07-17T13:48:34.757Z","timestamp":1784296114757,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"easy.adobecad.com.cn","organization":""},"issuer":{"commonName":"TrustAsia DV TLS RSA CA 2024","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 22 Jun 2026 18:00:00 GMT","end":"Sun, 20 Sep 2026 17:59:59 GMT"},"fingerprint":{"sha1":"C2:A6:89:0F:27:F1:B5:7E:90:38:61:B4:70:D1:F2:F2:6D:1F:40:69","sha256":"3F:ED:14:DF:FD:D0:7F:5B:50:57:D4:F7:B6:D8:25:DB:B3:A0:27:B8:30:27:18:75:E9:74:36:0D:96:E5:B7:49"}}},"request":{"raw":"GET /api_visit.php?type=pageview\u0026site=baidu_cad\u0026domain=cad.xznkjzx.cn\u0026path=%2F\u0026url=https%3A%2F%2Fcad.xznkjzx.cn%2F\u0026referrer=\u0026_=178429611475361204 HTTP/1.1\r\nHost: easy.adobecad.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cad.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 13:48:36 GMT\r\ncontent-type: image/gif\r\ncache-control: no-store, no-cache, must-revalidate, max-age=0\r\npragma: no-cache\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":34,"size_decoded":305,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1 x 1","md5":"a82ba3a9d42148e9cf209df13d8c3f3d","sha1":"dba80835d31175bdcf0bcad1abafefb06d86e304","sha256":"1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8","sha512":"97777a4b16bedd7547a46b1ab1d146c50c1547bbe23c70708806a357352a1291a4eb6cdae049d0e334f33903dbc98d7054eb5bff84dab0edcd091241ebbe5353","ssdeep":"","tlshash":"d9800023b2a08880c2cac0300c0aab802baaa0200a20230fb0ac038c2c3a3b02c02000","first_seen":"2023-04-19T02:04:42Z","last_seen":"2026-07-17T13:53:35.949295Z","times_seen":8668,"resource_available":true,"data":null}},"time_used":2081,"timings":{"blocked":0,"dns":119,"connect":292,"send":0,"wait":289,"receive":0,"ssl":291},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"easy.adobecad.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cad.xznkjzx.cn/static/picture/cadred.png","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cad.xznkjzx.cn/","date":"2026-07-17T13:48:29.759Z","timestamp":1784296109759,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cad.xznkjzx.cn","organization":""},"issuer":{"commonName":"TrustAsia DV TLS RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 27 Apr 2026 00:00:00 GMT","end":"Sat, 25 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D6:6C:AC:EA:A5:F7:C0:0E:B6:90:49:32:E0:35:27:37:52:C7:DD:56","sha256":"0A:78:27:AC:E5:E9:99:A9:D7:67:17:A2:9D:5F:BD:85:F6:D7:03:C0:A0:26:58:DA:B5:B2:D2:92:33:8B:F5:44"}}},"request":{"raw":"GET /static/picture/cadred.png HTTP/1.1\r\nHost: cad.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cad.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 13:48:29 GMT\r\ncontent-type: image/png\r\ncontent-length: 36306\r\nlast-modified: Tue, 22 Aug 2023 06:46:00 GMT\r\netag: \"64e459a8-8dd2\"\r\nexpires: Sun, 16 Aug 2026 13:48:29 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":36306,"size_decoded":36649,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"5636d604ec981a476f1f45b14dd7993d","sha1":"02e2ee7039f4bf840684d749dd94a86c11919e89","sha256":"7366fbc20f273e2771bba3f9e795bf9a75b111ef34efbfa105143d352598064d","sha512":"369e96beec2f9c0bbe543b5c0cbd33a10ba331482b5dc85b3aa4c92718e280a69b79f6e58edbc251711da147bacb9d0c178a81dfd6d2bc535d9449edf446b936","ssdeep":"768:qL+2D3PesTQhUOPNth1Kn098BDcMuwkCrWVQljMP4LRbJ3uzxyKhwDcFGJ:qD4hUoNP1N98V6wprGQd0Cb4YKIJ","tlshash":"def2e1e90a72e057c6a91e722c3e41049ded574b32bf3307e8855c8be3069dda7d85ac","first_seen":"2025-07-06T10:34:19.889268Z","last_seen":"2026-07-17T13:53:35.950045Z","times_seen":3,"resource_available":false,"data":null}},"time_used":9483,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6726,"receive":2757,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cad.xznkjzx.cn/static/picture/img-012.png","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cad.xznkjzx.cn/","date":"2026-07-17T13:48:29.768Z","timestamp":1784296109768,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cad.xznkjzx.cn","organization":""},"issuer":{"commonName":"TrustAsia DV TLS RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 27 Apr 2026 00:00:00 GMT","end":"Sat, 25 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D6:6C:AC:EA:A5:F7:C0:0E:B6:90:49:32:E0:35:27:37:52:C7:DD:56","sha256":"0A:78:27:AC:E5:E9:99:A9:D7:67:17:A2:9D:5F:BD:85:F6:D7:03:C0:A0:26:58:DA:B5:B2:D2:92:33:8B:F5:44"}}},"request":{"raw":"GET /static/picture/img-012.png HTTP/1.1\r\nHost: cad.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cad.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 13:48:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 176\r\nlast-modified: Tue, 22 Aug 2023 06:26:08 GMT\r\netag: \"64e45500-b0\"\r\nexpires: Sun, 16 Aug 2026 13:48:31 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":176,"size_decoded":515,"mime_type":"image/png","magic":"PNG image data, 38 x 37, 4-bit colormap, non-interlaced","md5":"76175ba7e36118197a8c2f6eb0af5a94","sha1":"1af7e4f3ee77d2a95706b711bb8d0d7a27723f70","sha256":"5c23cdcbccf0d23770721bba2d4994197a966e411e3c63be7d0fffe919510c18","sha512":"c609467a5b890e990921213539b9d8f1036e0da5b688b3dc2164453279337644c4703cac699c55b07dde72d5514407df1e6b40ecd7719fa27c4d2ca04a8b3dd1","ssdeep":"","tlshash":"8cc0c0e3491d4f2fc7316032f1280043e409540f302abc058d8478337c1000830e1e02","first_seen":"2024-09-19T22:37:12.215626Z","last_seen":"2026-07-17T13:53:35.969672Z","times_seen":5,"resource_available":false,"data":null}},"time_used":11880,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7625,"receive":4255,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cad.xznkjzx.cn/static/picture/img-016.png","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cad.xznkjzx.cn/","date":"2026-07-17T13:48:29.772Z","timestamp":1784296109772,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cad.xznkjzx.cn","organization":""},"issuer":{"commonName":"TrustAsia DV TLS RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 27 Apr 2026 00:00:00 GMT","end":"Sat, 25 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D6:6C:AC:EA:A5:F7:C0:0E:B6:90:49:32:E0:35:27:37:52:C7:DD:56","sha256":"0A:78:27:AC:E5:E9:99:A9:D7:67:17:A2:9D:5F:BD:85:F6:D7:03:C0:A0:26:58:DA:B5:B2:D2:92:33:8B:F5:44"}}},"request":{"raw":"GET /static/picture/img-016.png HTTP/1.1\r\nHost: cad.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cad.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 13:48:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 21289\r\nlast-modified: Tue, 22 Aug 2023 06:26:08 GMT\r\netag: \"64e45500-5329\"\r\nexpires: Sun, 16 Aug 2026 13:48:31 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":21289,"size_decoded":21632,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"42585727e776f99f9ad327877bde839a","sha1":"6e76cc5f18e4ac19ab5424a875cb0aa55648c306","sha256":"410ee9acee9033c29a7b9769e5c4e1c456fb354b20131d76b7ecc1deaa93bfe2","sha512":"90b55eedf0ccde96bd8640230e606404fcc1f12fbff629836adbc355e662b42957723033cbebf6c323852f347c13d705a08c4851dba29ad076d42f28dafbc9ad","ssdeep":"384:ep52f0fOR99OowotQf3xquGwHEa+kTr7+CSYazroQYW7sIW1wI6D:ep5282RrwokZAaz+VYKroQR7s+t","tlshash":"cba2e16154d97489d25769e9ca80f3fd408aee5406b7ebd03104d818db2ffceb9c5c4a","first_seen":"2024-09-19T22:37:12.228157Z","last_seen":"2026-07-17T13:53:35.947503Z","times_seen":9,"resource_available":false,"data":null}},"time_used":11873,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7618,"receive":4255,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cad.xznkjzx.cn/static/picture/img-019.png","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cad.xznkjzx.cn/","date":"2026-07-17T13:48:29.778Z","timestamp":1784296109778,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cad.xznkjzx.cn","organization":""},"issuer":{"commonName":"TrustAsia DV TLS RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 27 Apr 2026 00:00:00 GMT","end":"Sat, 25 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D6:6C:AC:EA:A5:F7:C0:0E:B6:90:49:32:E0:35:27:37:52:C7:DD:56","sha256":"0A:78:27:AC:E5:E9:99:A9:D7:67:17:A2:9D:5F:BD:85:F6:D7:03:C0:A0:26:58:DA:B5:B2:D2:92:33:8B:F5:44"}}},"request":{"raw":"GET /static/picture/img-019.png HTTP/1.1\r\nHost: cad.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cad.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 13:48:31 GMT\r\ncontent-type: image/png\r\ncontent-length: 18796\r\nlast-modified: Tue, 22 Aug 2023 06:26:08 GMT\r\netag: \"64e45500-496c\"\r\nexpires: Sun, 16 Aug 2026 13:48:31 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18796,"size_decoded":19139,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"4d818f5a9f232b771439bc4faed212dc","sha1":"86ed9293552b0ff611e7f9dadaa1105df42443d4","sha256":"4081d1f3e8906693cbd318c800ef661bf9b9125116908fe80d1e558d4217ada5","sha512":"80fc828cbcfa90293f10a10dd65cb61d25e5961cbfe70a8bf3ba832d1ed5ebb4d8759096c761c48c0175fa4f75538731a3a9d5c11114b3d0f66d705c1dc7cae4","ssdeep":"384:n5bPIaWl6HbvFDZaW609HPEsLuMU2x4YV7byRj8+GDwwHf7VenW1fZNJOf2gZOj:5NHbvgwHPqMpxDgGwwHfM2JW2gZOj","tlshash":"1782e117e3753f4ba4ac064197585b32956b05e3804f7228fe30b9cc7f6bc4ac396265","first_seen":"2024-09-19T22:37:12.239422Z","last_seen":"2026-07-17T13:53:36.015053Z","times_seen":8,"resource_available":false,"data":null}},"time_used":12171,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7615,"receive":4556,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cad.xznkjzx.cn/hcxt/addFk","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://cad.xznkjzx.cn/","date":"2026-07-17T13:48:34.753Z","timestamp":1784296114753,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cad.xznkjzx.cn","organization":""},"issuer":{"commonName":"TrustAsia DV TLS RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 27 Apr 2026 00:00:00 GMT","end":"Sat, 25 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D6:6C:AC:EA:A5:F7:C0:0E:B6:90:49:32:E0:35:27:37:52:C7:DD:56","sha256":"0A:78:27:AC:E5:E9:99:A9:D7:67:17:A2:9D:5F:BD:85:F6:D7:03:C0:A0:26:58:DA:B5:B2:D2:92:33:8B:F5:44"}}},"request":{"raw":"POST /hcxt/addFk HTTP/1.1\r\nHost: cad.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://cad.xznkjzx.cn/\r\nContent-Type: application/json\r\nContent-Length: 49\r\nOrigin: https://cad.xznkjzx.cn\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":49,"data":"{\"ldy\":\"https://cad.xznkjzx.cn/\",\"project\":\"cad\"}"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 13:48:35 GMT\r\ncontent-length: 0\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":719,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T15:40:28.095252Z","times_seen":17318195,"resource_available":true,"data":null}},"time_used":3287,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":3287,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cad.xznkjzx.cn/static/picture/cadred.png","fqdn":"cad.xznkjzx.cn","domain":"xznkjzx.cn","tld":"cn"},"ip":{"addr":"125.77.165.45","port":443,"asn":133776,"as":"Quanzhou","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cad.xznkjzx.cn/","date":"2026-07-17T13:48:42.395Z","timestamp":1784296122395,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cad.xznkjzx.cn","organization":""},"issuer":{"commonName":"TrustAsia DV TLS RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Mon, 27 Apr 2026 00:00:00 GMT","end":"Sat, 25 Jul 2026 23:59:59 GMT"},"fingerprint":{"sha1":"D6:6C:AC:EA:A5:F7:C0:0E:B6:90:49:32:E0:35:27:37:52:C7:DD:56","sha256":"0A:78:27:AC:E5:E9:99:A9:D7:67:17:A2:9D:5F:BD:85:F6:D7:03:C0:A0:26:58:DA:B5:B2:D2:92:33:8B:F5:44"}}},"request":{"raw":"GET /static/picture/cadred.png HTTP/1.1\r\nHost: cad.xznkjzx.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cad.xznkjzx.cn/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 13:48:42 GMT\r\ncontent-type: image/png\r\ncontent-length: 36306\r\nlast-modified: Tue, 22 Aug 2023 06:46:00 GMT\r\netag: \"64e459a8-8dd2\"\r\nexpires: Sun, 16 Aug 2026 13:48:42 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":36306,"size_decoded":36649,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"5636d604ec981a476f1f45b14dd7993d","sha1":"02e2ee7039f4bf840684d749dd94a86c11919e89","sha256":"7366fbc20f273e2771bba3f9e795bf9a75b111ef34efbfa105143d352598064d","sha512":"369e96beec2f9c0bbe543b5c0cbd33a10ba331482b5dc85b3aa4c92718e280a69b79f6e58edbc251711da147bacb9d0c178a81dfd6d2bc535d9449edf446b936","ssdeep":"768:qL+2D3PesTQhUOPNth1Kn098BDcMuwkCrWVQljMP4LRbJ3uzxyKhwDcFGJ:qD4hUoNP1N98V6wprGQd0Cb4YKIJ","tlshash":"def2e1e90a72e057c6a91e722c3e41049ded574b32bf3307e8855c8be3069dda7d85ac","first_seen":"2025-07-06T10:34:19.889268Z","last_seen":"2026-07-17T13:53:35.950045Z","times_seen":3,"resource_available":false,"data":null}},"time_used":303,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":303,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"cad.xznkjzx.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}