2026年08月14日 谷歌域名防红+QQ微信防红+防反诈屏蔽+APK爆毒 域名被误红怎么申诉？四维检测证据固定与状态快照报告实操教程

# 谷歌 Safe Browsing Lookup API —— 保存原始返回 curl -s -X POST "https://safebrowsing.googleapis.com/v4/threatMatches:find?key=YOUR_KEY" \ -H "Content-Type: application/json" \ -d '{"threatInfo":{"threatTypes":["MALWARE","SOCIAL_ENGINEERING","UNWANTED_SOFTWARE"],"platformTypes":["ANY_PLATFORM"],"threatEntryTypes":["URL"],"threatEntries":[{"url":"http://your-domain.com"}]}}' \ | tee gsb_evidence_$(date +%Y%m%d_%H%M%S).json

# QQ urlsec 检测 —— 保存原始返回 curl -s "https://cgi.urlsec.qq.com/index.php?m=url&a=valid&url=http://your-domain.com" \ | tee qq_evidence_$(date +%Y%m%d_%H%M%S).txt # 微信内置浏览器 UA 模拟 —— 看拦截页 curl -s -A "Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 MicroMessenger/8.0.49" \ -I "http://your-domain.com"

# 四运营商 DNS 对比 —— 逐条保存结果 for d in 114.114.114.114 211.137.130.19 211.137.140.201 211.98.4.1; do echo "== DNS $d ==" >> dns_evidence_$(date +%Y%m%d_%H%M%S).txt dig +short @$d your-domain.com >> dns_evidence_$(date +%Y%m%d_%H%M%S).txt done

# Virustotal 域名报告 —— 保存原始返回 curl -s -H "x-apikey: YOUR_VT_KEY" \ "https://www.virustotal.com/api/v3/domains/your-domain.com" \ | tee vt_evidence_$(date +%Y%m%d_%H%M%S).json # APK 文件哈希固定 sha256sum your-app.apk

# evidence_snapshot.py —— 四维证据固定 + 哈希存证 + 快照报告 import json, hashlib, subprocess, datetime, urllib.request DOMAIN = "your-domain.com" now = datetime.datetime.now(datetime.timezone.utc).isoformat() evidence = {"domain": DOMAIN, "captured_at_utc": now, "dimensions": {}} def gsb(): url = "https://safebrowsing.googleapis.com/v4/threatMatches:find?key=YOUR_KEY" body = {"threatInfo": {"threatTypes":["MALWARE","SOCIAL_ENGINEERING"], "platformTypes":["ANY_PLATFORM"], "threatEntryTypes":["URL"], "threatEntries":[{"url": "http://"+DOMAIN}]}} req = urllib.request.Request(url, json.dumps(body).encode(), {"Content-Type":"application/json"}) return urllib.request.urlopen(req).read().decode() def qq(): u = "https://cgi.urlsec.qq.com/index.php?m=url&a=valid&url=http://" + DOMAIN return urllib.request.urlopen(u).read().decode("utf-8", "ignore") def dns(): dnss = ["114.114.114.114", "211.137.130.19", "211.137.140.201", "211.98.4.1"] out = {} for d in dnss: r = subprocess.run(["dig", "+short", "@"+d, DOMAIN], capture_output=True).stdout.decode().strip() out[d] = r return out def vt(): req = urllib.request.Request("https://www.virustotal.com/api/v3/domains/"+DOMAIN, headers={"x-apikey":"YOUR_VT_KEY"}) return urllib.request.urlopen(req).read().decode() evidence["dimensions"]["gsb"] = gsb() evidence["dimensions"]["qq"] = qq() evidence["dimensions"]["dns"] = dns() evidence["dimensions"]["vt"] = vt() payload = json.dumps(evidence, ensure_ascii=False, sort_keys=True).encode() evidence["sha256"] = hashlib.sha256(payload).hexdigest() with open(f"evidence_{DOMAIN}_{now[:10]}.json", "w") as f: f.write(json.dumps(evidence, ensure_ascii=False, indent=2)) print("证据已固定，哈希：", evidence["sha256"])

python3 evidence_snapshot.py # 输出：证据已固定，哈希：3f8a9c...（示例） sha256sum evidence_your-domain.com_2026-08-14.json # 二次校验