{"report_id":"f9f9f095-916b-4d85-a6ee-f7220b597065","version":6,"status":"done","tags":[],"date":"2025-10-24T01:27:59Z","url":{"schema":"https","addr":"vpx-wahst5pp.com/bangzuzhongxin/43656fe2b9c738f.html","fqdn":"vpx-wahst5pp.com","domain":"vpx-wahst5pp.com","tld":"com"},"ip":{"addr":"103.80.133.42","port":0,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"final":{"url":{"schema":"https","addr":"vpx-wahst5pp.com/bangzuzhongxin/43656fe2b9c738f.html","fqdn":"vpx-wahst5pp.com","domain":"vpx-wahst5pp.com","tld":"com"},"title":"通过 WhatsApp Web 在香港市场推广产品的策略与前景(2025) - 帮助中心 - WhatsApp web"},"submit":{"url":{"schema":"https","addr":"vpx-wahst5pp.com/bangzuzhongxin/43656fe2b9c738f.html","fqdn":"vpx-wahst5pp.com","domain":"vpx-wahst5pp.com","tld":"com"},"ip":{"addr":"103.80.133.42","port":0,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-11-28T01:27:59Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":0,"analyzer":10}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-24T01:27:37Z","timestamp":1761269257,"ip_dst":{"addr":"172.18.0.25","port":44652,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"103.80.133.42","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"severity":"medium","alert":"ET DROP Spamhaus DROP Listed Traffic Inbound group 19","source":"{\"timestamp\":\"2025-10-24T01:27:37.661196+0000\",\"flow_id\":2001484120669384,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"103.80.133.42\",\"src_port\":443,\"dest_ip\":\"172.18.0.25\",\"dest_port\":44652,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.Evil\",\"ET.DROPIP\"]},\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2400018,\"rev\":4421,\"signature\":\"ET DROP Spamhaus DROP Listed Traffic Inbound group 19\",\"category\":\"Misc Attack\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Any\"],\"created_at\":[\"2010_12_30\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Minor\"],\"tag\":[\"Dshield\"],\"updated_at\":[\"2025_08_01\"]}},\"flow\":{\"pkts_toserver\":1,\"pkts_toclient\":1,\"bytes_toserver\":74,\"bytes_toclient\":74,\"start\":\"2025-10-24T01:27:37.408776+0000\"}}"}],"analyzer":[{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-10-24","alert":"Phishing - WhatsApp","trigger":"vpx-wahst5pp.com","verdict":"phishing","severity":"medium","comment":"WhatsApp","link":"https://openphish.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-24","alert":"Phishing Block","trigger":"vpx-wahst5pp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"node94.aizhantj.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"openphish","sensor_type":"url","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-10-24","alert":"Phishing - WhatsApp","trigger":"vpx-wahst5pp.com/bangzuzhongxin/43656fe2b9c738f.html","verdict":"phishing","severity":"medium","comment":"WhatsApp","link":"https://openphish.com","meta":null}],"urlquery":null},"summary":[{"fqdn":"vpx-wahst5pp.com","ip":{"addr":"103.80.133.42","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"domain_registered":"2025-10-03","domain_rank":0,"first_seen":"2025-10-21T01:35:05.289894Z","last_seen":"2025-10-21T01:35:05.289894Z","alert_count":48,"request_count":6,"received_data":39709,"sent_data":3192,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"node94.aizhantj.com","ip":{"addr":"43.174.227.42","port":21233,"asn":0,"as":"","country":"Singapore","country_code":"SG"},"domain_registered":"2024-07-29","domain_rank":0,"first_seen":"2025-08-10T13:29:04.56112Z","last_seen":"2025-10-22T08:26:42.734966Z","alert_count":2,"request_count":2,"received_data":36476,"sent_data":1171,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-24T01:27:37Z","timestamp":1761269257,"ip_dst":{"addr":"172.18.0.25","port":44652,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"103.80.133.42","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"severity":"medium","alert":"ET DROP Spamhaus DROP Listed Traffic Inbound group 19","source":"{\"timestamp\":\"2025-10-24T01:27:37.661196+0000\",\"flow_id\":2001484120669384,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"103.80.133.42\",\"src_port\":443,\"dest_ip\":\"172.18.0.25\",\"dest_port\":44652,\"proto\":\"TCP\",\"metadata\":{\"flowbits\":[\"ET.Evil\",\"ET.DROPIP\"]},\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2400018,\"rev\":4421,\"signature\":\"ET DROP Spamhaus DROP Listed Traffic Inbound group 19\",\"category\":\"Misc Attack\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Any\"],\"created_at\":[\"2010_12_30\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Minor\"],\"tag\":[\"Dshield\"],\"updated_at\":[\"2025_08_01\"]}},\"flow\":{\"pkts_toserver\":1,\"pkts_toclient\":1,\"bytes_toserver\":74,\"bytes_toclient\":74,\"start\":\"2025-10-24T01:27:37.408776+0000\"}}"}]}],"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"vpx-wahst5pp.com/tj.js","fqdn":"vpx-wahst5pp.com","domain":"vpx-wahst5pp.com","tld":"com"},"ip":{"addr":"103.80.133.42","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"introduction_type":"scriptElement","is_inline":false,"md5":"820b52daccec8c10cd977f95920c7f20","sha1":"3bea6669b2442ab2c58f23844a32fa92c3221dc5","sha256":"86e4781c7b958de9d6ed39a1d87dd8c7dc0d1788391be832e3662c98ca961e7a","sha512":"b4e7b2787746ab72a41bf754838c2481994b7439f521c259842b6eb666cd2e317d76ba590a7d7d886f6862687a9e7c05a1b9b75feed975cdf9beca6adf1a5d00","ssdeep":"","tlshash":"1041c83895a32420437f913cb76bd69834784017f623d50a755d3f995f80f1c95e9ec4","size":2122,"data":"","first_seen":"2025-10-21T15:49:51.040412Z","last_seen":"2025-10-24T01:32:32.422107Z","times_seen":40,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vpx-wahst5pp.com/bangzuzhongxin/43656fe2b9c738f.html","fqdn":"vpx-wahst5pp.com","domain":"vpx-wahst5pp.com","tld":"com"},"ip":{"addr":"103.80.133.42","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"introduction_type":"Function","is_inline":false,"md5":"1c5c9160600df2d96d69a4ea16cec7ed","sha1":"3cf678c9135cc952ba6970ef545035bb757a443f","sha256":"a3520fe88e248d2b6c9c6db93309a037ef969fe297208e5bd7e49a55bb32c808","sha512":"2a298a8c2552c6a6c6f8d3f7327d2e9abfa87a0dbb27e9e528a8539b416155c0860f54f46464dfe7e5d49c7906a9eacdac7e5181b86ef15a83276a8f4fee0546","ssdeep":"","tlshash":"078004d531c35040475331d400571cd4503444f014444d544040d4511c55030d1154dc","size":37,"data":"","first_seen":"2023-04-11T21:49:14Z","last_seen":"2026-08-11T06:15:00.501926Z","times_seen":121768,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vpx-wahst5pp.com/bangzuzhongxin/43656fe2b9c738f.html","fqdn":"vpx-wahst5pp.com","domain":"vpx-wahst5pp.com","tld":"com"},"ip":{"addr":"103.80.133.42","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"introduction_type":"Function","is_inline":false,"md5":"1c5c9160600df2d96d69a4ea16cec7ed","sha1":"3cf678c9135cc952ba6970ef545035bb757a443f","sha256":"a3520fe88e248d2b6c9c6db93309a037ef969fe297208e5bd7e49a55bb32c808","sha512":"2a298a8c2552c6a6c6f8d3f7327d2e9abfa87a0dbb27e9e528a8539b416155c0860f54f46464dfe7e5d49c7906a9eacdac7e5181b86ef15a83276a8f4fee0546","ssdeep":"","tlshash":"078004d531c35040475331d400571cd4503444f014444d544040d4511c55030d1154dc","size":37,"data":"","first_seen":"2023-04-11T21:49:14Z","last_seen":"2026-08-11T06:15:00.501926Z","times_seen":121768,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vpx-wahst5pp.com/bangzuzhongxin/43656fe2b9c738f.html","fqdn":"vpx-wahst5pp.com","domain":"vpx-wahst5pp.com","tld":"com"},"ip":{"addr":"103.80.133.42","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"introduction_type":"Function","is_inline":false,"md5":"1c5c9160600df2d96d69a4ea16cec7ed","sha1":"3cf678c9135cc952ba6970ef545035bb757a443f","sha256":"a3520fe88e248d2b6c9c6db93309a037ef969fe297208e5bd7e49a55bb32c808","sha512":"2a298a8c2552c6a6c6f8d3f7327d2e9abfa87a0dbb27e9e528a8539b416155c0860f54f46464dfe7e5d49c7906a9eacdac7e5181b86ef15a83276a8f4fee0546","ssdeep":"","tlshash":"078004d531c35040475331d400571cd4503444f014444d544040d4511c55030d1154dc","size":37,"data":"","first_seen":"2023-04-11T21:49:14Z","last_seen":"2026-08-11T06:15:00.501926Z","times_seen":121768,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"node94.aizhantj.com:21233/tjjs/?k=m4fvu9z7ci2","fqdn":"node94.aizhantj.com","domain":"aizhantj.com","tld":"com"},"ip":{"addr":"43.174.227.42","port":21233,"asn":0,"as":"","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"6f42620bc054df1efda11b0aad158e3c","sha1":"a54db3c0d2345518dd364861f918e0c835420ad6","sha256":"741d96815f0685084a39b4dc80010afaa8f371b147f88fd79455b32a3b0e50b1","sha512":"980700ec417577d3bafb126d545b1efe9b75a20f037b52df30b81f8a9d61af2c7700a864fddc1538eac700ce7644a81db04d98766b9558b4e1658db67a985f8a","ssdeep":"768:SsC5kuNkdE4rDE93/7vupsHs27ZyXnD0T:HCOykdE4rDE93/7uYZknDm","tlshash":"a9f2e8d632ca2536a27670a9d95fe50cf4b9aa1437d9ec44590cc0c46d208be83ff9bd","size":35402,"data":"","first_seen":"2025-09-26T05:05:28.305585Z","last_seen":"2025-11-05T16:13:14.200864Z","times_seen":907,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":[{"md5":"d97623d172f087d9640da9acd38830ff","sha1":"515bd358bb7d990930f0e2b3de399db1787a2567","sha256":"fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a","sha512":"ce6a1969f698a616663f1a19ccfa12a37a4f6d782432d8a08aeb7879efd3e2becf168422ea66bc47e74f6ba865efaae6eabe3c4faba280d7a21f3a94d7c55da1","ssdeep":"","tlshash":"f0400000000000000000000000300000000000000003000c000000c0c0000000300000","size":7,"data":"","first_seen":"2023-03-12T20:41:17Z","last_seen":"2026-08-05T21:33:10.000859Z","times_seen":9187,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"console":null},"http":[{"url":{"schema":"https","addr":"vpx-wahst5pp.com/tj.js","fqdn":"vpx-wahst5pp.com","domain":"vpx-wahst5pp.com","tld":"com"},"ip":{"addr":"103.80.133.42","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://vpx-wahst5pp.com/bangzuzhongxin/43656fe2b9c738f.html","date":"2025-10-24T01:27:38.436Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bbj-wahst5pp.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Oct 2025 04:40:07 GMT","end":"Wed, 14 Jan 2026 04:40:06 GMT"},"fingerprint":{"sha1":"AA:8F:92:60:F6:B7:D4:D4:6B:18:55:56:3E:C8:27:5E:2D:62:12:9C","sha256":"4F:8B:FB:15:9A:EF:86:12:EC:67:2F:E0:E5:FD:79:20:57:B0:C6:F2:E4:B3:97:BF:DC:95:22:A9:9D:D8:BC:68"}}},"request":{"raw":"GET /tj.js HTTP/1.1\r\nHost: vpx-wahst5pp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://vpx-wahst5pp.com/bangzuzhongxin/43656fe2b9c738f.html\r\nCookie: server_name_session=c2d885d94779373b313c3b3ec33e8556\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 24 Oct 2025 01:27:38 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 21 Oct 2025 13:43:33 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68f78e05-84a\"\r\nexpires: Fri, 24 Oct 2025 13:27:38 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2122,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"820b52daccec8c10cd977f95920c7f20","sha1":"3bea6669b2442ab2c58f23844a32fa92c3221dc5","sha256":"86e4781c7b958de9d6ed39a1d87dd8c7dc0d1788391be832e3662c98ca961e7a","sha512":"b4e7b2787746ab72a41bf754838c2481994b7439f521c259842b6eb666cd2e317d76ba590a7d7d886f6862687a9e7c05a1b9b75feed975cdf9beca6adf1a5d00","ssdeep":"","tlshash":"1041c83895a32420437f913cb76bd69834784017f623d50a755d3f995f80f1c95e9ec4","first_seen":"2025-10-21T15:49:51.040412Z","last_seen":"2025-10-24T01:32:32.422107Z","times_seen":40,"resource_available":true,"data":null}},"time_used":254,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":254,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-10-24","alert":"Phishing - WhatsApp","trigger":"vpx-wahst5pp.com","verdict":"phishing","severity":"medium","comment":"WhatsApp","link":"https://openphish.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-24","alert":"Phishing Block","trigger":"vpx-wahst5pp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"node94.aizhantj.com:21233/tjjs/?k=m4fvu9z7ci2","fqdn":"node94.aizhantj.com","domain":"aizhantj.com","tld":"com"},"ip":{"addr":"43.174.227.42","port":21233,"asn":0,"as":"","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://vpx-wahst5pp.com/bangzuzhongxin/43656fe2b9c738f.html","date":"2025-10-24T01:27:38.762Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.aizhantj.com","organization":""},"issuer":{"commonName":"Leocert TLS Issuing RSA CA 1","organization":"Leocert LLC"},"validity":{"start":"Tue, 29 Jul 2025 07:48:12 GMT","end":"Sat, 29 Aug 2026 07:48:12 GMT"},"fingerprint":{"sha1":"08:E8:20:3E:64:D6:76:65:C3:01:5A:25:5B:CE:23:E1:04:FF:9D:3A","sha256":"ED:59:41:83:D6:B7:DC:EE:38:8B:4C:EC:A7:BB:DB:86:03:54:41:AF:C0:7D:3F:63:B3:8E:65:A6:75:6E:6C:1B"}}},"request":{"raw":"GET /tjjs/?k=m4fvu9z7ci2 HTTP/1.1\r\nHost: node94.aizhantj.com:21233\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://vpx-wahst5pp.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, PUT, POST, DELETE, OPTIONS\r\nexpires: Fri, 24 Oct 2025 01:31:25 GMT\r\nserver: nginx, Aztj(node90-1)\r\ncontent-length: 11705\r\naccept-ranges: bytes\r\ndate: Fri, 24 Oct 2025 01:27:39 GMT\r\neo-log-uuid: 17129977160683409366\r\neo-cache-status: HIT\r\ncache-control: max-age=1800\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":35402,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text","md5":"6f42620bc054df1efda11b0aad158e3c","sha1":"a54db3c0d2345518dd364861f918e0c835420ad6","sha256":"741d96815f0685084a39b4dc80010afaa8f371b147f88fd79455b32a3b0e50b1","sha512":"980700ec417577d3bafb126d545b1efe9b75a20f037b52df30b81f8a9d61af2c7700a864fddc1538eac700ce7644a81db04d98766b9558b4e1658db67a985f8a","ssdeep":"768:SsC5kuNkdE4rDE93/7vupsHs27ZyXnD0T:HCOykdE4rDE93/7uYZknDm","tlshash":"a9f2e8d632ca2536a27670a9d95fe50cf4b9aa1437d9ec44590cc0c46d208be83ff9bd","first_seen":"2025-09-26T05:05:28.305585Z","last_seen":"2025-11-05T16:13:14.200864Z","times_seen":907,"resource_available":true,"data":null}},"time_used":969,"timings":{"blocked":473,"dns":1,"connect":19,"send":0,"wait":21,"receive":1,"ssl":451},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"node94.aizhantj.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vpx-wahst5pp.com/favicon.ico","fqdn":"vpx-wahst5pp.com","domain":"vpx-wahst5pp.com","tld":"com"},"ip":{"addr":"103.80.133.42","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vpx-wahst5pp.com/bangzuzhongxin/43656fe2b9c738f.html","date":"2025-10-24T01:27:38.860Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bbj-wahst5pp.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Oct 2025 04:40:07 GMT","end":"Wed, 14 Jan 2026 04:40:06 GMT"},"fingerprint":{"sha1":"AA:8F:92:60:F6:B7:D4:D4:6B:18:55:56:3E:C8:27:5E:2D:62:12:9C","sha256":"4F:8B:FB:15:9A:EF:86:12:EC:67:2F:E0:E5:FD:79:20:57:B0:C6:F2:E4:B3:97:BF:DC:95:22:A9:9D:D8:BC:68"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: vpx-wahst5pp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://vpx-wahst5pp.com/bangzuzhongxin/43656fe2b9c738f.html\r\nCookie: server_name_session=c2d885d94779373b313c3b3ec33e8556\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 24 Oct 2025 01:27:38 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 1385\r\nlast-modified: Thu, 16 Oct 2025 05:25:18 GMT\r\netag: \"68f081be-569\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1385,"size_decoded":0,"mime_type":"image/x-icon","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"b70e6078004aeb5146c635cc4c8af761","sha1":"08361cabab0812baeb8ecf4dfbdddd10a9104423","sha256":"20ce7e373448ca2a51d95f60fc906f57cc27d103a6bba4e33be3453f7b23b98e","sha512":"76e0a9f494998151ab5f5d1ef2f1e2cd826135537e6b3e77e6653997d6e073696880a1ab5100c6a85aea926edcfe036c31513d08f58c0bcc02db0a4c8b6bec09","ssdeep":"","tlshash":"bf210bf3e36020e90841d4310333621b57fa4f7b6d909371f071509112b944845a1e97","first_seen":"2024-12-25T11:23:49.33594Z","last_seen":"2026-08-01T18:23:46.596239Z","times_seen":1965,"resource_available":false,"data":null}},"time_used":253,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":253,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-24","alert":"Phishing Block","trigger":"vpx-wahst5pp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-10-24","alert":"Phishing - WhatsApp","trigger":"vpx-wahst5pp.com","verdict":"phishing","severity":"medium","comment":"WhatsApp","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vpx-wahst5pp.com/staticzixun/css/main.css","fqdn":"vpx-wahst5pp.com","domain":"vpx-wahst5pp.com","tld":"com"},"ip":{"addr":"103.80.133.42","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://vpx-wahst5pp.com/bangzuzhongxin/43656fe2b9c738f.html","date":"2025-10-24T01:27:38.398Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bbj-wahst5pp.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Oct 2025 04:40:07 GMT","end":"Wed, 14 Jan 2026 04:40:06 GMT"},"fingerprint":{"sha1":"AA:8F:92:60:F6:B7:D4:D4:6B:18:55:56:3E:C8:27:5E:2D:62:12:9C","sha256":"4F:8B:FB:15:9A:EF:86:12:EC:67:2F:E0:E5:FD:79:20:57:B0:C6:F2:E4:B3:97:BF:DC:95:22:A9:9D:D8:BC:68"}}},"request":{"raw":"GET /staticzixun/css/main.css HTTP/1.1\r\nHost: vpx-wahst5pp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://vpx-wahst5pp.com/bangzuzhongxin/43656fe2b9c738f.html\r\nCookie: server_name_session=c2d885d94779373b313c3b3ec33e8556\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 24 Oct 2025 01:27:38 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 16 Oct 2025 05:25:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68f081be-29d0\"\r\nexpires: Fri, 24 Oct 2025 13:27:38 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10704,"size_decoded":0,"mime_type":"text/css","magic":"exported SGML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"1b3a8e55786f412c5aa196fa9d015b91","sha1":"88cbcb8e2a240b71785782fc2f19460436cf5d13","sha256":"f285e09019d1f3a5847eacae3418cb1269381e265f0da0fd76b8a682195450f5","sha512":"af06e0e4c716ce66b03e53bf805e4d63df18951fa3c8f505ed63958d840cea4cd1b42eb71a99fe853d24868d746ef93e5e047001fa1dc8c246356a89b9ccbab7","ssdeep":"192:j9r9HPGo9e9k/Z30FXIm+gJyuiSufSu5Su1SuBSuVSuKyumz3vK9Q9/69zOLO2Nu:UF4zgJpaHbj+b","tlshash":"2d2247214665102ef53b1c43b2a3fa91391ad097228b43fbfdb67a15c8cf4a767317a4","first_seen":"2025-10-19T11:03:03.867208Z","last_seen":"2025-10-24T10:25:27.996617Z","times_seen":98,"resource_available":false,"data":null}},"time_used":253,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":253,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-24","alert":"Phishing Block","trigger":"vpx-wahst5pp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-10-24","alert":"Phishing - WhatsApp","trigger":"vpx-wahst5pp.com","verdict":"phishing","severity":"medium","comment":"WhatsApp","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vpx-wahst5pp.com/staticzixun/picture/end_tech.png","fqdn":"vpx-wahst5pp.com","domain":"vpx-wahst5pp.com","tld":"com"},"ip":{"addr":"103.80.133.42","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vpx-wahst5pp.com/bangzuzhongxin/43656fe2b9c738f.html","date":"2025-10-24T01:27:38.400Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bbj-wahst5pp.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Oct 2025 04:40:07 GMT","end":"Wed, 14 Jan 2026 04:40:06 GMT"},"fingerprint":{"sha1":"AA:8F:92:60:F6:B7:D4:D4:6B:18:55:56:3E:C8:27:5E:2D:62:12:9C","sha256":"4F:8B:FB:15:9A:EF:86:12:EC:67:2F:E0:E5:FD:79:20:57:B0:C6:F2:E4:B3:97:BF:DC:95:22:A9:9D:D8:BC:68"}}},"request":{"raw":"GET /staticzixun/picture/end_tech.png HTTP/1.1\r\nHost: vpx-wahst5pp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://vpx-wahst5pp.com/bangzuzhongxin/43656fe2b9c738f.html\r\nCookie: server_name_session=c2d885d94779373b313c3b3ec33e8556\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 24 Oct 2025 01:27:38 GMT\r\ncontent-type: image/png\r\ncontent-length: 95\r\nlast-modified: Thu, 16 Oct 2025 05:25:18 GMT\r\netag: \"68f081be-5f\"\r\nexpires: Sun, 23 Nov 2025 01:27:38 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":95,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 13 x 12, 1-bit colormap, non-interlaced","md5":"1834160fc7500d041f1e87a65bf90294","sha1":"0d58313cb0b64ca4a9d2e30468ad6c66c7b343ec","sha256":"20eb6f9f8387899af707a74ea3ea14569730f8771bc463e645c1cdc4396eed8c","sha512":"687a20f20f5180fa97ce18ee249d79c1e1ede1dfe38e29616d511c56ecebb6371ed7d3f8c1d30052edffc00287bbe578db034115a93d20ff00e29a18a457fd3c","ssdeep":"","tlshash":"3eb012d21e7ccf30c635243a12150030ddb901040b101343050b949dcd7251850801ba","first_seen":"2025-10-19T11:03:04.0407Z","last_seen":"2025-10-24T10:25:27.997982Z","times_seen":86,"resource_available":false,"data":null}},"time_used":253,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":253,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-24","alert":"Phishing Block","trigger":"vpx-wahst5pp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-10-24","alert":"Phishing - WhatsApp","trigger":"vpx-wahst5pp.com","verdict":"phishing","severity":"medium","comment":"WhatsApp","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vpx-wahst5pp.com/staticzixun/js/footer.js","fqdn":"vpx-wahst5pp.com","domain":"vpx-wahst5pp.com","tld":"com"},"ip":{"addr":"103.80.133.42","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://vpx-wahst5pp.com/bangzuzhongxin/43656fe2b9c738f.html","date":"2025-10-24T01:27:38.433Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bbj-wahst5pp.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Oct 2025 04:40:07 GMT","end":"Wed, 14 Jan 2026 04:40:06 GMT"},"fingerprint":{"sha1":"AA:8F:92:60:F6:B7:D4:D4:6B:18:55:56:3E:C8:27:5E:2D:62:12:9C","sha256":"4F:8B:FB:15:9A:EF:86:12:EC:67:2F:E0:E5:FD:79:20:57:B0:C6:F2:E4:B3:97:BF:DC:95:22:A9:9D:D8:BC:68"}}},"request":{"raw":"GET /staticzixun/js/footer.js HTTP/1.1\r\nHost: vpx-wahst5pp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://vpx-wahst5pp.com/bangzuzhongxin/43656fe2b9c738f.html\r\nCookie: server_name_session=c2d885d94779373b313c3b3ec33e8556\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 24 Oct 2025 01:27:38 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 3\r\nlast-modified: Thu, 16 Oct 2025 05:25:18 GMT\r\netag: \"68f081be-3\"\r\nexpires: Fri, 24 Oct 2025 13:27:38 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3,"size_decoded":0,"mime_type":"application/javascript","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-12T08:40:50.123104Z","times_seen":17852352,"resource_available":true,"data":null}},"time_used":255,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":253,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-24","alert":"Phishing Block","trigger":"vpx-wahst5pp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-10-24","alert":"Phishing - WhatsApp","trigger":"vpx-wahst5pp.com","verdict":"phishing","severity":"medium","comment":"WhatsApp","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"node94.aizhantj.com:21233/tjpv/?cc=1\u0026ck=1\u0026cl=24-bit\u0026ds=1280x1024\u0026vl=1024\u0026et=0\u0026ja=0\u0026ln=en-us\u0026lo=0\u0026rnd=559111279\u0026si=m4fvu9z7ci2\u0026v=25.01.26\u0026lv=1\u0026api=0\u0026sn=16134\u0026r=0\u0026ww=1280\u0026u=https%3A%2F%2Fvpx-wahst5pp.com%2Fbangzuzhongxin%2F43656fe2b9c738f.html\u0026lvt=1761269259\u0026tf=1761269259\u0026ej=1","fqdn":"node94.aizhantj.com","domain":"aizhantj.com","tld":"com"},"ip":{"addr":"43.174.227.42","port":21233,"asn":0,"as":"","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://vpx-wahst5pp.com/bangzuzhongxin/43656fe2b9c738f.html","date":"2025-10-24T01:27:39.317Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.aizhantj.com","organization":""},"issuer":{"commonName":"Leocert TLS Issuing RSA CA 1","organization":"Leocert LLC"},"validity":{"start":"Tue, 29 Jul 2025 07:48:12 GMT","end":"Sat, 29 Aug 2026 07:48:12 GMT"},"fingerprint":{"sha1":"08:E8:20:3E:64:D6:76:65:C3:01:5A:25:5B:CE:23:E1:04:FF:9D:3A","sha256":"ED:59:41:83:D6:B7:DC:EE:38:8B:4C:EC:A7:BB:DB:86:03:54:41:AF:C0:7D:3F:63:B3:8E:65:A6:75:6E:6C:1B"}}},"request":{"raw":"GET /tjpv/?cc=1\u0026ck=1\u0026cl=24-bit\u0026ds=1280x1024\u0026vl=1024\u0026et=0\u0026ja=0\u0026ln=en-us\u0026lo=0\u0026rnd=559111279\u0026si=m4fvu9z7ci2\u0026v=25.01.26\u0026lv=1\u0026api=0\u0026sn=16134\u0026r=0\u0026ww=1280\u0026u=https%3A%2F%2Fvpx-wahst5pp.com%2Fbangzuzhongxin%2F43656fe2b9c738f.html\u0026lvt=1761269259\u0026tf=1761269259\u0026ej=1 HTTP/1.1\r\nHost: node94.aizhantj.com:21233\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://vpx-wahst5pp.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://vpx-wahst5pp.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, PUT, POST, DELETE, OPTIONS\r\nset-cookie: _aztj_sess=cm11bu8p4hatc0v9iv7rnb8u01; expires=Fri, 07 Nov 2025 01:27:39 GMT; Max-Age=1209600; path=/; secure; SameSite=None\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\npragma: no-cache\r\nx-mtj-pc: 28\r\nx-mtj-ml: 1\r\nserver: nginx, Aztj(node90-1)\r\ncontent-encoding: gzip\r\ndate: Fri, 24 Oct 2025 01:27:39 GMT\r\neo-log-uuid: 13449443356597395557\r\neo-cache-status: MISS\r\ncache-control: max-age=0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"99914b932bd37a50b983c5e7c90ae93b","sha1":"bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f","sha256":"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","sha512":"27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd","ssdeep":"","tlshash":"c7100000000000c00000000c00000000000000000c0000000000000000000000000000","first_seen":"2023-03-07T01:15:26Z","last_seen":"2026-08-12T08:39:22.530531Z","times_seen":759352,"resource_available":true,"data":null}},"time_used":366,"timings":{"blocked":46,"dns":0,"connect":19,"send":0,"wait":273,"receive":0,"ssl":24},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"node94.aizhantj.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vpx-wahst5pp.com/bangzuzhongxin/43656fe2b9c738f.html","fqdn":"vpx-wahst5pp.com","domain":"vpx-wahst5pp.com","tld":"com"},"ip":{"addr":"103.80.133.42","port":443,"asn":205960,"as":"Hdtidc Limited","country":"South Korea","country_code":"KR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-24T01:27:37.228Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bbj-wahst5pp.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Oct 2025 04:40:07 GMT","end":"Wed, 14 Jan 2026 04:40:06 GMT"},"fingerprint":{"sha1":"AA:8F:92:60:F6:B7:D4:D4:6B:18:55:56:3E:C8:27:5E:2D:62:12:9C","sha256":"4F:8B:FB:15:9A:EF:86:12:EC:67:2F:E0:E5:FD:79:20:57:B0:C6:F2:E4:B3:97:BF:DC:95:22:A9:9D:D8:BC:68"}}},"request":{"raw":"GET /bangzuzhongxin/43656fe2b9c738f.html HTTP/1.1\r\nHost: vpx-wahst5pp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 24 Oct 2025 01:27:38 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\nset-cookie: server_name_session=c2d885d94779373b313c3b3ec33e8556; Max-Age=86400; httponly; path=/\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":22404,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (573), with CRLF, LF line terminators","md5":"bc647c403d7061d44d6d13c0c8eb45bb","sha1":"adfeb715d17638f8b3641b62ab20c1d03e1cebdd","sha256":"d981f5b0c3c5556bb3e9490d7e5d0327b7935ca32e0530d672373557ab66d67d","sha512":"7a0086eff07f3c1e4ca8e8c3f8372609fb65f0f7dacc0fe45255fcaeffd6eb4deb6729204bece1f7ecc72cf4cb30d2f3c552d9cd4544f4a5cb0e5ac00a12eca8","ssdeep":"384:iAbQpGio7penyNJsKUhgCUbVRKDilq5TkcuNlWRE4yQQViMsq99mh2eKvQX088HZ:iAbQpGiosny3sKUhgCUbVRKmlyTkcuNt","tlshash":"93a2c804c3cfaeab032606d556a4695ca84e57b18d271e3bb57f0ca77b85761b80b0cf","first_seen":"2025-10-24T01:28:01.542338Z","last_seen":"2025-10-24T01:28:01.542338Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1675,"timings":{"blocked":696,"dns":185,"connect":253,"send":0,"wait":279,"receive":0,"ssl":258},"alerts":{"ids":null,"analyzer":[{"sensor_name":"openphish","sensor_type":"url","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-10-24","alert":"Phishing - WhatsApp","trigger":"vpx-wahst5pp.com/bangzuzhongxin/43656fe2b9c738f.html","verdict":"phishing","severity":"medium","comment":"WhatsApp","link":"https://openphish.com","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-24","alert":"Phishing Block","trigger":"vpx-wahst5pp.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-24","alert":"Sinkholed","trigger":"vpx-wahst5pp.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}