{"report_id":"fff93e4e-078f-4eb3-baae-b40fe4ba96ec","version":6,"status":"done","tags":[],"date":"2026-01-06T14:48:44Z","url":{"schema":"http","addr":"wwt-whatsapp.com.cn","fqdn":"wwt-whatsapp.com.cn","domain":"wwt-whatsapp.com.cn","tld":"com.cn"},"ip":{"addr":"154.12.95.61","port":0,"asn":8796,"as":"FD-298-8796","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"wwt-whatsapp.com.cn/","fqdn":"wwt-whatsapp.com.cn","domain":"wwt-whatsapp.com.cn","tld":"com.cn"},"title":"WhatsApp Web","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"wwt-whatsapp.com.cn","fqdn":"wwt-whatsapp.com.cn","domain":"wwt-whatsapp.com.cn","tld":"com.cn"},"ip":{"addr":"154.12.95.61","port":0,"asn":8796,"as":"FD-298-8796","country":"Hong Kong","country_code":"HK"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-10T14:48:44Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"wwt-whatsapp.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-06","alert":"Phishing Block","trigger":"wwt-whatsapp.com.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"wwt-whatsapp.com.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"wwt-whatsapp.com.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"wwt-whatsapp.com.cn","ip":{"addr":"154.201.79.154","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"domain_registered":"2026-01-05","domain_rank":0,"first_seen":"2026-01-06T14:48:45.486958Z","last_seen":"2026-01-06T14:48:45.486958Z","alert_count":12,"request_count":3,"received_data":1923041,"sent_data":1357,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"wwt-whatsapp.com.cn/assets/main.js","fqdn":"wwt-whatsapp.com.cn","domain":"wwt-whatsapp.com.cn","tld":"com.cn"},"ip":{"addr":"154.201.79.154","port":443,"asn":8796,"as":"FD-298-8796","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://wwt-whatsapp.com.cn/","date":"2026-01-06T14:48:23.701Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wwt-whatsapp.com.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 06 Jan 2026 03:13:44 GMT","end":"Mon, 06 Apr 2026 03:13:43 GMT"},"fingerprint":{"sha1":"7E:69:9D:A0:E9:34:34:CB:5B:48:87:7E:6C:3A:18:08:F4:2F:25:59","sha256":"F4:F2:4D:43:6B:E0:32:40:C5:CC:E4:B7:7B:CB:16:9D:C7:C1:C3:60:CE:F7:76:8E:AA:67:6B:1F:09:34:66:31"}}},"request":{"raw":"GET /assets/main.js HTTP/1.1\r\nHost: wwt-whatsapp.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wwt-whatsapp.com.cn/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 06 Jan 2026 14:48:24 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nlast-modified: Sat, 27 Dec 2025 03:26:13 GMT\r\netag: W/\"78bd6bce591c252520a0e9c4d80e6ee0\"\r\nContent-Encoding: gzip\r\nServer: nginx\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":535336,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (704)","md5":"07cc7bdd910d38bf58c29cacb25839c0","sha1":"6f291a33353b01786422f832e94a10b44455a353","sha256":"c29dfac67fadacee08c7a730815d247ff7ea6305889b26f6c96d58cdcf44b2cf","sha512":"a7e5703c3aefd72e64f427f774f6980e7ee78d8eaea28bce6710c8595a377d05eba370b8167b78c46c66813a411c4f1565808a6a7b2b34f442cf0565872b6187","ssdeep":"6144:KENIh+Ok0O6qMANTcynsA0DJuZImfycty6zmVX:Qh+Okt6qMAQOPmd","tlshash":"f0b431718e936c8c7202d3fba22e50b5a361283f4b967946750cac389fdd91dedb4874","first_seen":"2026-01-06T14:48:50.557084Z","last_seen":"2026-01-06T16:55:50.856678Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1254,"timings":{"blocked":314,"dns":3,"connect":153,"send":0,"wait":302,"receive":321,"ssl":157},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"wwt-whatsapp.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-06","alert":"Phishing Block","trigger":"wwt-whatsapp.com.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"wwt-whatsapp.com.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"wwt-whatsapp.com.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wwt-whatsapp.com.cn/assets/main.css","fqdn":"wwt-whatsapp.com.cn","domain":"wwt-whatsapp.com.cn","tld":"com.cn"},"ip":{"addr":"45.207.207.36","port":443,"asn":8796,"as":"FD-298-8796","country":"Mauritius","country_code":"MU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://wwt-whatsapp.com.cn/","date":"2026-01-06T14:48:23.699Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wwt-whatsapp.com.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 06 Jan 2026 03:13:44 GMT","end":"Mon, 06 Apr 2026 03:13:43 GMT"},"fingerprint":{"sha1":"7E:69:9D:A0:E9:34:34:CB:5B:48:87:7E:6C:3A:18:08:F4:2F:25:59","sha256":"F4:F2:4D:43:6B:E0:32:40:C5:CC:E4:B7:7B:CB:16:9D:C7:C1:C3:60:CE:F7:76:8E:AA:67:6B:1F:09:34:66:31"}}},"request":{"raw":"GET /assets/main.css HTTP/1.1\r\nHost: wwt-whatsapp.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://wwt-whatsapp.com.cn/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 06 Jan 2026 14:48:23 GMT\r\nContent-Type: text/css; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nlast-modified: Tue, 08 Jul 2025 19:01:58 GMT\r\netag: W/\"607553bf10105f172844529383832859\"\r\nContent-Encoding: gzip\r\nServer: nginx\r\nX-Cache-Status: HIT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1386298,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (64783), with CRLF line terminators","md5":"a8775df65efcf734789d2c5070ced1a0","sha1":"99c636d4b0f4768ee1cb4fcbf61820224865816d","sha256":"ee522a1509ea1865d68ea3e3cebc412fea6972db678a6b6e4d5a8d86cc6a08cd","sha512":"5b8ad0516507da45bb2aae56d7724e36b6b90e0e1402bcc101b438bd438600e47c1c35979f2862172ba023bb866e55b840ee69c833ececd95a68433c8c7b53d7","ssdeep":"6144:e+I6RGm7q/QzAr8jSs6MKsdbgVgwWdiyCCofzl9w6jFGvl22q:eJ61zms6MLdbgm5vKfzPVkO","tlshash":"2825e8b697a1533cbc2bd22b92dcb95ca31c6d86fe121be6f591f03496c2be80533514","first_seen":"2025-09-13T10:30:50.335508Z","last_seen":"2026-05-28T10:10:19.175112Z","times_seen":13,"resource_available":false,"data":null}},"time_used":854,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":208,"receive":646,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"wwt-whatsapp.com.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"wwt-whatsapp.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-06","alert":"Phishing Block","trigger":"wwt-whatsapp.com.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"wwt-whatsapp.com.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"wwt-whatsapp.com.cn/","fqdn":"wwt-whatsapp.com.cn","domain":"wwt-whatsapp.com.cn","tld":"com.cn"},"ip":{"addr":"45.207.207.36","port":443,"asn":8796,"as":"FD-298-8796","country":"Mauritius","country_code":"MU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-06T14:48:21.580Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wwt-whatsapp.com.cn","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 06 Jan 2026 03:13:44 GMT","end":"Mon, 06 Apr 2026 03:13:43 GMT"},"fingerprint":{"sha1":"7E:69:9D:A0:E9:34:34:CB:5B:48:87:7E:6C:3A:18:08:F4:2F:25:59","sha256":"F4:F2:4D:43:6B:E0:32:40:C5:CC:E4:B7:7B:CB:16:9D:C7:C1:C3:60:CE:F7:76:8E:AA:67:6B:1F:09:34:66:31"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: wwt-whatsapp.com.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 06 Jan 2026 14:48:23 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 612\r\nConnection: keep-alive\r\nServer: nginx\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":612,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"5ad7670e916ebe059825a274b4fb9125","sha1":"68799d9dee79e9291295332fc1c7680e3cc33d07","sha256":"eecfeeab6103e1abf0bfe11f8fff476822e3aa9dbb902216fe0cbf90c82b9812","sha512":"6b2a80093d6bf4bdf2b439ab767f6e4cdf906a2678dedda4d973d21a556c05fcfc993d5f76fe1fb475f1fd597fc5535283b654b49d8072ab3d29092c229ed1fb","ssdeep":"","tlshash":"cdf0ac63e411180d92208310bdfdf4060d02cb21e32d6d8050e8a0bd4ed8b4eccd359c","first_seen":"2026-01-06T14:48:50.559092Z","last_seen":"2026-01-06T16:55:50.8576Z","times_seen":2,"resource_available":false,"data":null}},"time_used":3527,"timings":{"blocked":1534,"dns":1202,"connect":160,"send":0,"wait":460,"receive":0,"ssl":168},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-06","alert":"Phishing Block","trigger":"wwt-whatsapp.com.cn","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"wwt-whatsapp.com.cn","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"wwt-whatsapp.com.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"wwt-whatsapp.com.cn","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}