{"report_id":"12e728d7-d68b-4be9-a7c3-49b7b12fa7bc","version":0,"status":"done","tags":[],"date":"2026-09-27T15:04:15Z","url":{"schema":"http","addr":"gh11.top/","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":0,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"final":{"url":{"schema":"https","addr":"gh11.top/","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"title":"Bet365","dom":{"size":26589,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (16138)","md5":"1848f6bbb244af626082c421fa644062","sha1":"564706e1d542da54cf79fd51f5a055d3fda6c6b8","sha256":"db273e3b51a424944a8b5040259d16562c9a56f24c0c6d9c331cddc4e1270cd6","sha512":"766de5f2752780030f3c792dbf7b3a73099c654e915bbf56b5bdc7b4a7b3b12c78a5c7e68583c3c4cc31096fa916bbf378183c65d582af54a2b60f8ef667dff5","ssdeep":"768:hg7hGg//oDnnnnvTh6u3ExM3qFk69W8teh2Wkl:hg7h9//oDnnnnvexM3qFk69WZel","tlshash":"dfc25d33a6976717133541c8a97e2f2c54c7020fcb928e86f1ed1266afcda616d1f449","dom_hash":"domhash4ba6dff49f7e7479b2c75bf55f93b46e","first_seen":"2026-09-27T15:04:32.821721Z","last_seen":"2026-09-27T15:04:32.821721Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"gh11.top/","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":0,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-01T15:04:15Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"31pu2ilhjrkmwpf"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":6}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"sdk.51.la","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"4436544.com","ip":{"addr":"137.220.157.60","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":1,"received_data":230,"sent_data":546,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"collect-v6.51.la","ip":{"addr":"43.159.107.113","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"domain_registered":"2005-01-17","domain_rank":348646,"first_seen":"2021-03-08T16:03:54Z","last_seen":"2026-09-22T08:25:05.640931Z","alert_count":0,"request_count":1,"received_data":336,"sent_data":499,"comment":"","tags":null,"fingerprints":[{"name":"EdgeOne","description":"EdgeOne is an edge-service platform that delivers global content distribution, network acceleration, and integrated security protections for distributed applications.","website":"https://edgeone.ai","common_platform_enumeration":"","icon":"EdgeOne.svg","categories":["CDN"]}]},{"fqdn":"lwjhnxkrk.kuixvydtrifgltby.top","ip":{"addr":"40.81.20.145","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":1,"received_data":20270,"sent_data":478,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"gh11.top","ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"domain_registered":"2026-01-26","domain_rank":0,"first_seen":"2026-09-27T14:55:45.958127Z","last_seen":"2026-09-27T14:55:45.958127Z","alert_count":280,"request_count":56,"received_data":2390601,"sent_data":31791,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"jQuery:1.8.3","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]},{"fqdn":"103.27.177.224","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":1,"received_data":0,"sent_data":549,"comment":"","tags":null,"fingerprints":null},{"fqdn":"4436566.com","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2024-04-13","domain_rank":0,"first_seen":"2026-09-27T13:09:48.053338Z","last_seen":"2026-09-27T13:09:55.963148Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":546,"comment":"","tags":null,"fingerprints":null},{"fqdn":"hcdream.com","ip":{"addr":"172.67.202.65","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2018-06-21","domain_rank":0,"first_seen":"2019-01-18T16:52:36Z","last_seen":"2026-09-16T18:38:51.235135Z","alert_count":0,"request_count":3,"received_data":50021,"sent_data":1546,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"4436555.com","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2024-04-13","domain_rank":0,"first_seen":"2026-09-27T14:54:50.46412Z","last_seen":"2026-09-27T14:54:54.644916Z","alert_count":0,"request_count":1,"received_data":0,"sent_data":546,"comment":"","tags":null,"fingerprints":null},{"fqdn":"sdk.51.la","ip":{"addr":"43.159.107.113","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"domain_registered":"2005-01-17","domain_rank":347679,"first_seen":"2021-03-08T16:03:51Z","last_seen":"2026-09-22T20:37:33.176088Z","alert_count":1,"request_count":1,"received_data":34775,"sent_data":450,"comment":"","tags":null,"fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"gh11.top/","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"domTimer","is_inline":false,"md5":"d2838a0accfec8e141832d3566d0f5b5","sha1":"3428de6c4e43c039accad4824988cb4d337a046b","sha256":"1d017f2e749b90c03d931037a0f7b33e5e4fc900d59c74e8eb30776d53a8f154","sha512":"d195f2c9f388a62eead17fe641b05c512ecb0359679f7c7fe5260a83ea0e70bd3567e38f8ca7fd55f7446dab2f24949939d880d050a496f5d7ede5cfa70d1f10","ssdeep":"","tlshash":"f04000000000000cc0000000000000000000000c000000000000000030003303000000","size":6,"data":"","first_seen":"2023-05-26T00:21:19Z","last_seen":"2026-09-27T15:04:32.893657Z","times_seen":271,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"eventHandler","is_inline":false,"md5":"a704141f98adcbfe48095ecd68b2272f","sha1":"91215f8d4020ac1c58d621d58a55f17ecf3b82df","sha256":"f44e6b47284ccaa081e9491820e83e39cb2cfbef6b7b13ae05eee33614c80440","sha512":"6ba263efd25417959eae45cdada164b99a66b1dfdfb891b4373128741314365d842a96ac63098c3dd554a4176058653e9145aa05023ce3d05628d9eca5563971","ssdeep":"","tlshash":"4960003828020020802c80200808002002008ab30f0000a080000a0a8a080300388828","size":17,"data":"","first_seen":"2023-07-21T06:11:13Z","last_seen":"2026-09-27T15:04:32.895041Z","times_seen":169,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"eventHandler","is_inline":false,"md5":"b1694e306404f22d786019360a175f80","sha1":"3d952d305a2f41859a3224ee96de6322d633c5c5","sha256":"e26802a195410a4fa3e77d6cf28789b2d53694b3fe0cfc85be99ace1bbb81da5","sha512":"ca6c13a36a64e0c18b61e63824e8b854618b12d27f2c43c3a66afa71e2e67b533a05ba8cd0c3c724436a2fc35b6254b2635f067e9aa808c95984ae2e8cfb0f29","ssdeep":"","tlshash":"6b9004731541c30447441045c5011d74441355070cd055c0fdd005000dcc3711735311","size":39,"data":"","first_seen":"2026-09-27T13:09:56.002227Z","last_seen":"2026-09-27T15:04:32.896765Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":true,"md5":"cbe7c10d299fb1fcbc8d58c30aff35f1","sha1":"429987a30c39c99b58861d17a663bfb66072f8c0","sha256":"990fd0d55849208f701449c57afe648e567401f9c16d28ea198334d4f8edecb2","sha512":"c60cfdd2dfaf4117570380f9b8c6c9dbee34ef78410c925ce6a9255caa2eaba285bb676467d2aa60ce15f583e9b13aca16a955a8878dc814e3fba0bd9feb1cfa","ssdeep":"","tlshash":"e7e0124af241eff905bf313e94292d5917021e127d559f01d0b7a13196a88593e13ed6","size":293,"data":"","first_seen":"2026-09-27T13:09:56.005011Z","last_seen":"2026-09-27T15:04:32.897915Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":true,"md5":"8afdc75a1f734872c4175fb4d50f7e4c","sha1":"6f2fdf2884e677582b0858b464731f737be52e21","sha256":"881e543070c776c9930fb173ab1d668336741395722735f18f4b48b87e9bbb34","sha512":"5572b026771cd268a49504889b54712308ee72ddf9c799836c929dd994916433a8cc6a1abc1dc6e30f9e0b0595181a08ae2f483540e8930e378451e5c7e5bd65","ssdeep":"","tlshash":"06c0805da5d52ede70840191044d264724d12843c7975646f11765899cb44574555563","size":163,"data":"","first_seen":"2026-09-27T13:09:56.006206Z","last_seen":"2026-09-27T15:04:32.898785Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":true,"md5":"ed58685bba26550bc893d30977a72633","sha1":"c38fa07dbe22ecf30becfd658a38ac40eded5bd8","sha256":"7f1a189d8dc4b852cb158ab67c2dc60dd6c16f909e57e55d946f6e162ef67ad4","sha512":"c985484c762f0698b017d4ee9f81f1f2b471004be1e206f087e30d334f58312c3f600dbabcf70b110e14c616baf313386ff48dd54d3653e6492a65f319bcc0bd","ssdeep":"","tlshash":"a4a0025be6ffdc21a6dc502d0d0b42c18e71010823100c8ec9d4ca51ac69000f06d102","size":60,"data":"","first_seen":"2026-09-27T13:09:56.007335Z","last_seen":"2026-09-27T15:04:32.899673Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sdk.51.la/js-sdk-pro.min.js","fqdn":"sdk.51.la","domain":"51.la","tld":"la"},"ip":{"addr":"43.159.107.113","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"8fc0b01d35300e8398d6e957987c01e7","sha1":"f1eb32c75b8d8e4b0555ebc2a5f5d1d60296f41e","sha256":"b164aafa0bb83dfe511912ca2ca475880bfffac8d8f098c947fd3d4af440d3a4","sha512":"fab84d067e724d45f35821d8f37c0cd4f608af2975de48a61b905dba89189ca8778b04b4d507e6417a4187193a3da2d0a8939c02bf2d39adb9733cffd2358401","ssdeep":"768:Xzz9qAO+a/y1jaKUiQU5enEU9GMXB0XXQVEXB3CNSPf:Xzz9qnT/c+KUc5enEU9GMXB/EXB3LPf","tlshash":"55f22d9577c0717cc3c782e9361b401ae1a69e810099a8acf345f594bd74e66a33ffa8","size":34329,"data":"","first_seen":"2023-04-05T07:31:50Z","last_seen":"2026-09-27T21:33:56.003963Z","times_seen":10862,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"eventHandler","is_inline":false,"md5":"3e8f05048457fbb231ba416c16481f0a","sha1":"cf379e0c0a4562c3a32b512c11b6a3642f39eb18","sha256":"52b06df39bfc32e1e91e9a88e13f6f62f066f5eaf0de307c8235f2df51fd15b8","sha512":"3d9e171d098a6a3fd01d987b79be90a4860cb28e99c1beb28b5b771d6f6bd7420a636974083ad260d443d19b100724d56e49a201d6cb1c34dfb2b8e60666f7a1","ssdeep":"","tlshash":"a58004730511535451101055d4011c54c107534f4cc1434170d44f1005445737714113","size":36,"data":"","first_seen":"2026-09-27T13:09:56.001025Z","last_seen":"2026-09-27T15:04:32.900515Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/js/flexible.js","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"96223580d12e0cbd98c84915c2af1d2c","sha1":"5e17485a20c35bec07fb3fc311865858dbe0d914","sha256":"e2b391cfd47f90d343acd3facc1b7fe3f77784e1de3cc81657c1ca690ffa5428","sha512":"bd9801055bcba67d91b275cd7aeca823a59bdeedcd9b93b6fac8c5d30b7d11adb71cc2a9bca6db86713e4595671ed2a2a0c91ea0ee5709dcb0bedb21f9c23a51","ssdeep":"","tlshash":"2d51c8b536123a750953247b8a3d62011d13867b545a4580f04feeea3f9cea49d33cfb","size":2470,"data":"","first_seen":"2025-11-01T14:35:41.753156Z","last_seen":"2026-09-27T15:04:32.840871Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hcdream.com/akai/customer-service/67latest.js","fqdn":"hcdream.com","domain":"hcdream.com","tld":"com"},"ip":{"addr":"172.67.202.65","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"40636eae6aa805be7ca7a06b8a4f4cc0","sha1":"af993434d76db8435a2b84c3d3a092adb36d3df4","sha256":"ced73457a64e924c172560153b2e3a290e2f3a2556444272c8d5b396ff480100","sha512":"68cd9f50e046d62a91e545dc7158044aca24723c2ac93a8a24d28895a51f57aca21eacedb1122618b6b0e40b182ced850009d275e24e69b28c309267779b2fcf","ssdeep":"","tlshash":"26212bdea3691a27322336a0a4c7a428675be4875d8c6083f21e795c4f6eeef0d1d435","size":1242,"data":"","first_seen":"2026-09-27T13:09:55.933938Z","last_seen":"2026-09-27T15:04:32.847545Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"lwjhnxkrk.kuixvydtrifgltby.top/widget/linkchat.1.1.0.js","fqdn":"lwjhnxkrk.kuixvydtrifgltby.top","domain":"kuixvydtrifgltby.top","tld":"top"},"ip":{"addr":"40.81.20.145","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"59b0c9f1c537544a364cc03e11815b34","sha1":"88c488181283b1ed9bf3e3c48ac056a312e47506","sha256":"afd9b6f3b5ea5286fe30818f301786af0f5c79890e873ccf2b8d0ce2c1e65fe6","sha512":"fa4961eca50806364cf62f8c817cde4dfaa9d44ac7e1a7cb7376b08a4047d9bf6f5660417872bf03b6cd0167f8987985806697c7bd5fc1f014c053ddbf2ab98e","ssdeep":"384:s/AmLO+73nnnnOGyME7k6yr3ExMdRQjFFk5o9WenZbFnIE2OeIy4jAZktY9xkSxM:s/hiannnnvTh6u3ExM3qFk69W8teh2Wa","tlshash":"dd92b034f748652ad02d407921be7a4c799a386f9b054aec30b2e5e39dfc95c3571a3c","size":19939,"data":"","first_seen":"2023-09-02T04:11:25Z","last_seen":"2026-09-27T15:04:32.881804Z","times_seen":42,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/js/ms.js","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"ebc17eac49f0abe955cca0918d371444","sha1":"65858a9ab33533beb1df2de2f6a4741eeaf564e2","sha256":"4fd881de3072427623fd047cbdbf86092887726a6b8ff78c8bd3cca9a58ba256","sha512":"2597f93469cc6ac01725c2e4a493bb0777fe1613d387497e46cd38dd18fc4d9c567e6c95075859192bb118707998810bdd746c6638645999930a4313d2af4c8d","ssdeep":"","tlshash":"b6119131b664571f618c186702fe1a81eff48be744e1bcbad630e89559e0a20352aea5","size":981,"data":"","first_seen":"2025-11-01T14:35:41.745036Z","last_seen":"2026-09-27T15:04:32.824546Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/js/jquery-1.8.3.min.js?44","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"69ecd99e201c97170d8b1735877c5c6f","sha1":"acbbbf3197c7ae19982ce6ef9ff6932593ea85d8","sha256":"ef45c2b4676161897f63a84bddd4a8d7e33e98d5477e8bda3ca8173b222b8a9c","sha512":"3d97dca1cf3e459586b63a2cf49d9bafd54ff56001bc44d3963f2bf2ae1fc0ffbd260aea09986e37ebb00e969f4b95502f37f654fd97a49a40ae0a97a720ecb9","ssdeep":"1536:ln6I5cEDlV0YjGaWQb6u6xvkT4ys33lt4WXgVInEG0vd007pNTbyT+SAy+uu49Jg:Z/Yi6Jnys3PN+RwFj2ShosS9","tlshash":"9293f7edb3c6717243ab31a910af650ff2366869284d8410f138e8f4bc75a499277e7d","size":94213,"data":"","first_seen":"2023-03-07T01:06:41Z","last_seen":"2026-09-27T15:04:32.842427Z","times_seen":1396,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/js/himg.js","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"93c0a93c4139421fdcce0545a8fc0e28","sha1":"acc055ffe549d060a343824f3d2334adeb375947","sha256":"52d194ec74c73520460b5315e59e27b07a02f83e96cf0a1ccb8aef723a6846b7","sha512":"fb9d4c43b513502b930f7ce09644b4b0a5c88ba937ec0231ae74d4d64cce1a4a8aacad779d267eaa7605586600695b4c0531542ec64b8659b4236f9b3d481587","ssdeep":"","tlshash":"49213ee7e518a92209171bee16c9794d91bf6caede82f7237309c04d0bc5cdf901d05a","size":1243,"data":"","first_seen":"2026-09-27T13:09:55.98905Z","last_seen":"2026-09-27T15:04:32.846884Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"hcdream.com/berlin/customer-service/kefu67.js","fqdn":"hcdream.com","domain":"hcdream.com","tld":"com"},"ip":{"addr":"172.67.202.65","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"6bfc5acdb84d90756937655f38ddb767","sha1":"3e0b8a539df54ae4196c3a61e59e1647216f42a7","sha256":"7fc9ad8c99de300c4d36d772f9540669524146fb51fbcf2ee9620591164dd9c3","sha512":"52d3a36309d27e81ffd759ff0d832741c6bc41eb4c1558895ee62a1e31acdf57893ccfa26c0be5e5c6a9b8544f500aa80f20e08892ad5498b0d73cca1584ec69","ssdeep":"","tlshash":"0e61438e67b70527111330e0a6db96247736b0473e0e9c86b64c9e4c4f49def5c1eab5","size":3441,"data":"","first_seen":"2026-09-16T18:38:53.946148Z","last_seen":"2026-09-27T15:04:32.857748Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"eventHandler","is_inline":false,"md5":"d2c567f82866eeda0d2c682731beaaca","sha1":"1f2628b74a81ca4580c9ac3c75891bc932ab2cf4","sha256":"36451ce357ab21e9f057caf239e373fd5ecbb429394d6657cba9b1c441328825","sha512":"0f87aa5665c458f8a56c092b2fa5160da759d530f98144132f29c0854e6cfd822fb1cc53d2b5176f6b2a6df884d43988d0d8e23cc58ede4e2b297747aac0af40","ssdeep":"","tlshash":"918004731701534441101455d4051c54c113530f0cc1414170f45d1005445755510415","size":36,"data":"","first_seen":"2026-09-27T13:09:56.008263Z","last_seen":"2026-09-27T15:04:32.901335Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"introduction_type":"eventHandler","is_inline":false,"md5":"2aa1043d705959df3c29cb062aa1e223","sha1":"c3c3c9ec1e609a8dd438ef021abe6d8660f70515","sha256":"e41deed517abbac8b0edcd06aab4d79afa8be62b1eaea34ac71de04408a1d90a","sha512":"79eee4c6f4cc25e6b509074f4fbe06d8d326fa734c4cfc8ed47b39c31d5b5ad12ea7eac14ca6e4cdaabc84e16f88b1fde61f71ef6072915d5640fb0f8e8cfc2c","ssdeep":"","tlshash":"108004730d01734441111455d4411c7cc107530f0dc341d570d44d1005545715d10035","size":36,"data":"","first_seen":"2026-09-27T13:09:56.003992Z","last_seen":"2026-09-27T15:04:32.902173Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"warn","text":"将根据已有的meta标签来设置缩放比例","filename":"https://gh11.top/js/flexible.js","line_number":1,"column_number":312}]},"http":[{"url":{"schema":"https","addr":"gh11.top/images/img05.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.359Z","timestamp":1790521417359,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/img05.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 11 Jun 2021 13:29:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"60c36528-664\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1636,"size_decoded":2395,"mime_type":"image/png","magic":"PNG image data, 32 x 28, 8-bit/color RGBA, non-interlaced","md5":"2dc8f80290773856d1919ad12486facc","sha1":"c151e2abae202da7ef6eff90409798ed2e5979f3","sha256":"62b4baef843b114045fdd3285e511aa56935d5b8256f4654cd7438c411e5ad8e","sha512":"1d3a94858ce26370db10f9735b419e0b78f5e15423a121402acbf5b95ddf6bb7d13f4de7c68af452d65c9c0f6b2e30adb595986bedf86deb0ce4c8ecf19add2e","ssdeep":"","tlshash":"1631a609f6816d8190dcf6c360f94553dd234d80fee9e4a9b8c9824706b01f8462aacb","first_seen":"2026-05-18T02:20:43.097018Z","last_seen":"2026-09-27T15:04:32.823682Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1201,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1201,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/js/ms.js","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.312Z","timestamp":1790521417312,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /js/ms.js HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 981\r\nlast-modified: Fri, 11 Jun 2021 13:30:04 GMT\r\netag: \"60c3655c-3d5\"\r\nexpires: Mon, 28 Sep 2026 03:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=43200, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":981,"size_decoded":2034,"mime_type":"application/javascript","magic":"ASCII text, with CRLF line terminators","md5":"ebc17eac49f0abe955cca0918d371444","sha1":"65858a9ab33533beb1df2de2f6a4741eeaf564e2","sha256":"4fd881de3072427623fd047cbdbf86092887726a6b8ff78c8bd3cca9a58ba256","sha512":"2597f93469cc6ac01725c2e4a493bb0777fe1613d387497e46cd38dd18fc4d9c567e6c95075859192bb118707998810bdd746c6638645999930a4313d2af4c8d","ssdeep":"","tlshash":"b6119131b664571f618c186702fe1a81eff48be744e1bcbad630e89559e0a20352aea5","first_seen":"2025-11-01T14:35:41.745036Z","last_seen":"2026-09-27T15:04:32.824546Z","times_seen":6,"resource_available":true,"data":null}},"time_used":681,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":681,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/g09.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.347Z","timestamp":1790521417347,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/g09.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 13 Sep 2024 12:46:22 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66e4341e-13654\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":79444,"size_decoded":80537,"mime_type":"image/png","magic":"PNG image data, 186 x 170, 8-bit/color RGBA, non-interlaced","md5":"a8fb0c567314fb5dcb27c4e133069c98","sha1":"bff13ff30bb865ebbbe5955f78f5ef4e1d12ee45","sha256":"3965268ec6366001ab13b3a2d7cbf233d7fa1738779d9ddd2a6439972c3ba5cb","sha512":"8e7c8f6b7bba3d60ddba4d7746b544d9f69ca84f261152977784c53ab53fe26d286777c8321a09f805d62428d6c00de5d8a6467cfba598e2721e42d2b6f16310","ssdeep":"1536:5BDOqLByJNEtQzNgV1I24BIE6rKbhDmX9RrzGsyALJYhif78ambQY3r6c2Ta4:XBqNEazNgVXEzrDqRrnN0QO176cY","tlshash":"7873026dfa640b618d7e8f29c259794c4cb3bf392f691ffb21c90640422a7ca54064bd","first_seen":"2026-05-18T02:20:43.373277Z","last_seen":"2026-09-27T15:04:32.825355Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1198,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1198,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/yh02.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.352Z","timestamp":1790521417352,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/yh02.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 12 Sep 2024 21:58:14 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66e363f6-7b4b\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":31563,"size_decoded":32640,"mime_type":"image/png","magic":"PNG image data, 186 x 186, 8-bit/color RGBA, non-interlaced","md5":"d4f473de10aa942d43bb17618d5b6026","sha1":"ba7d1f8a874bb36182fe3ebad793fb2aa29dee68","sha256":"c24e25816073fc006377f5d12d190b23d2e125c5a565590e4b68f66207fb4df0","sha512":"af55c8e21e43c8d0f16eaed13c2ef164a68c169d0a834f477a5c9dd3f1fdd9a3dbb6106150fca6cb795f33e7d7dbae9abe3d1a36807cab2f277d11359c1e04c8","ssdeep":"768:xIJ9wDR9sHMJn8tQsXejQ2fD9/7VMT46P2Nfeqk7:aJ9wNpJn8uLhB/7CT46eJzk7","tlshash":"b1e2f11819c3e49a726a7717ba2712f83d81a0639c72d43f9e70c23adb9d4ec59dc860","first_seen":"2026-05-18T02:20:43.495425Z","last_seen":"2026-09-27T15:04:32.826161Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1193,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1193,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"4436544.com/?a=395671/0.6614973515283131","fqdn":"4436544.com","domain":"4436544.com","tld":"com"},"ip":{"addr":"137.220.157.60","port":443,"asn":152194,"as":"CTG Server Limited","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:38.035Z","timestamp":1790521418035,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /?a=395671/0.6614973515283131 HTTP/1.1\r\nHost: 4436544.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:40 GMT\r\ncontent-type: text/html\r\nlast-modified: Thu, 06 Aug 2026 16:18:28 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a74b3d4-5dce\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T21:46:31.540354Z","times_seen":18695517,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/h_bg.jpg","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:38.063Z","timestamp":1790521418063,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/h_bg.jpg HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/css/style.css?1\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:38 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Fri, 11 Jun 2021 13:28:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"60c3650e-1973\"\r\nexpires: Tue, 27 Oct 2026 15:03:38 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6515,"size_decoded":6605,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 750x108, components 3","md5":"2ecca95cb7516868d403300c20ac25fb","sha1":"e40fb320f4636a9d95ebd49cc85e45590f907026","sha256":"ee53d82f480b06c5fc69cba0fe091e280705b3aa1eabc1053260707f8ed4617d","sha512":"a54726701276954c636ba4db7db36568de625246e778d15d9a19771b88ae11d5d60ee2f76393ad236ea6790509ab7ec6fff78d1c45e42f7bf32de66472f52c6f","ssdeep":"96:qikScVrGTmhA9xFMHtxszTCZwjrzTAHSEW/rwhAn2Q38ZZZKLlLmDPSEVFrcaZO:yfrExmHFZOrzRZn2QshKLlLIrO","tlshash":"cad17d0991036880e48c5d391cbfc1ae262bd750bca3e5ba14c58a16d7c85f711599bb","first_seen":"2026-05-18T02:20:43.469048Z","last_seen":"2026-09-27T15:04:32.82781Z","times_seen":6,"resource_available":false,"data":null}},"time_used":635,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":635,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/phone.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.334Z","timestamp":1790521417334,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/phone.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 13 Sep 2024 13:01:38 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66e437b2-916ea\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":595690,"size_decoded":596223,"mime_type":"image/png","magic":"PNG image data, 728 x 631, 8-bit/color RGBA, non-interlaced","md5":"34ddf3bccc8688dd847c8670b5515590","sha1":"e54d9ae6788dbde96b9efd8c7bd58cbfbe408216","sha256":"892e6dca7011eeea345ae56e2e644135b02a35f2dc890786d749a96f006a87d5","sha512":"8e93495260c5cc5ce42ea8d795b3431efa7c7515cc3a512fb6558de2a9c737a75e0c3db2e91a683c2dc01e6a8d31572499f1c273eae8eac4d0bb81d6218b0c20","ssdeep":"12288:2aepVOcMYmgNAO2J2QzaKdORCM3UdEu95Fq:27fxMEmJgK4RbkH3Fq","tlshash":"ddc423f05f89bcde6e46b93a0377af855b3b475e91e31041ea24c00e885eeb20e9f051","first_seen":"2026-05-18T02:20:43.649245Z","last_seen":"2026-09-27T15:04:32.828543Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1039,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1039,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/ios.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.335Z","timestamp":1790521417335,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/ios.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 12 Sep 2024 22:24:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66e36a2e-2cf1\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11505,"size_decoded":12582,"mime_type":"image/png","magic":"PNG image data, 313 x 96, 8-bit/color RGBA, non-interlaced","md5":"866da8214b2b4284699b81145e90d58c","sha1":"ac44261366cfb8080726b203da06765ada25fbbf","sha256":"ce92335aad6db711925871e45a7a5efe70313e44675edb4096d40696b3d52d85","sha512":"236aff4c406cbdbdba2ceb97cd0c63f7c83047d2c1842a196f8c90de86bf6a8f6b314cf31852d9d6664cde035964d17e57e6441f26b1805aeb017b2f459ac9bd","ssdeep":"192:g2SB63GhEQjUTOyw5IzF4GrWvwRLvzR5E/bF0YMoLIb3ElNctOy2AYWa99i96Ld2:yB6qE2Uqywy5pCvKLvzRO/bF0VhsOtOc","tlshash":"0232bff426038fdd24fc8845d0576c74b64588e89f5e013aead711e4f57bfe889819a2","first_seen":"2026-05-18T02:20:43.691651Z","last_seen":"2026-09-27T15:04:32.829723Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1208,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1208,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/g04.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.341Z","timestamp":1790521417341,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/g04.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 13 Sep 2024 12:41:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66e432ec-12f5f\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":77663,"size_decoded":78756,"mime_type":"image/png","magic":"PNG image data, 178 x 178, 8-bit/color RGBA, non-interlaced","md5":"7cedab2a645cd10351d0b4c77f77162d","sha1":"6219a677449fd2f6d582982f25868901987ab7cc","sha256":"ef32db47e5229ac17c76cff07e3e207e07cf2e6ab6751d0dc10838659232521d","sha512":"181d004a6d73c96470493a2e758d5c7f5a360b6ca6d0d7668b9f9bc7b42510b0fc0e1b1c6e8321eafd2ef4f49f91a06e3265b4beebe677b4d83b701427be6ffe","ssdeep":"1536:YN0FIIZUMI4aduqff9DvErKnFH9gd4nixBBUNQErgB+H4oEauTRW2u7wRbr:ZFIIZUtldTNDhnFH9gd4izjcgByFuTRP","tlshash":"0873027262fd65984c525e0a2efd46b11da3e8344d9d1cacea764404f883dbc4dd2acb","first_seen":"2026-05-18T02:20:43.813204Z","last_seen":"2026-09-27T15:04:32.830591Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1202,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1202,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/g12.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.350Z","timestamp":1790521417350,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/g12.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 12 Sep 2024 21:39:10 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66e35f7e-ec2\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3778,"size_decoded":4812,"mime_type":"image/png","magic":"PNG image data, 186 x 186, 8-bit/color RGBA, non-interlaced","md5":"b9b7390701284d3b66abd52617e4a377","sha1":"1246bb4c60b7b6148f4e6ee3eb64eb62d910f273","sha256":"5ee360b04e4c57f29bedbb15c14591abdfce2492f21d0fa24bf7d410494980ce","sha512":"3d6c9ce53bb9879595f21de5368248b3507bde5ddbd693119310895aef74403eb34a4ae457f7b3ef22b50439ec8ed8ef8a51195c2cb0c7144bc72ab5a4f20035","ssdeep":"","tlshash":"6f714b8cc7623d8dc3b4b4eb221ad6951ad984f17bfd017e88f46868d34a4466468286","first_seen":"2026-05-18T02:20:43.441058Z","last_seen":"2026-09-27T15:04:32.831382Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1195,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1195,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/img06.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.360Z","timestamp":1790521417360,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/img06.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 11 Jun 2021 13:29:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"60c36528-52a\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1322,"size_decoded":2060,"mime_type":"image/png","magic":"PNG image data, 32 x 28, 8-bit/color RGBA, non-interlaced","md5":"92e401cc4173bae68487e14568d92480","sha1":"be25448bd90318b8cd48871933dd9f22f0d1eca3","sha256":"41111e7f0c162ba59a442462e30f36127fe1785364358abe1f49d8f294a2983f","sha512":"859a421eca5d43b4d16adbce706886c69449789bc4d17f35770a73426d34fc6860c7e6209bd51901ac29bb7fcd19b02a1e058666e19e4d535440ef3098292e56","ssdeep":"","tlshash":"ee21451afa401840a09de9c550ff8057ee214e80ea9df1697dca91264e741fe85296df","first_seen":"2026-05-18T02:20:43.739695Z","last_seen":"2026-09-27T15:04:32.832192Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1201,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1201,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"103.27.177.224/?a=395671/0.5470784261751076","fqdn":"103.27.177.224","domain":"103.27.177.224","tld":""},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:38.032Z","timestamp":1790521418032,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"103.27.177.215","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Sun, 04 Jan 2026 00:00:00 GMT","end":"Mon, 04 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"1F:9E:2D:C8:BB:ED:8E:C5:84:96:3C:6A:3E:D4:D4:41:DD:40:87:39","sha256":"1A:60:C0:82:1F:F6:42:7D:66:0D:7D:A3:17:9C:67:76:AB:42:C0:3F:AB:D7:A1:E1:CE:F0:BA:D0:02:BA:16:D6"}}},"request":{"raw":"GET /?a=395671/0.5470784261751076 HTTP/1.1\r\nHost: 103.27.177.224\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T21:46:31.540354Z","times_seen":18695517,"resource_available":true,"data":null}},"time_used":491,"timings":{"blocked":-1,"dns":0,"connect":235,"send":0,"wait":0,"receive":0,"ssl":256},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"4436566.com/?a=395671/0.9319593839910394","fqdn":"4436566.com","domain":"4436566.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:38.045Z","timestamp":1790521418045,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /?a=395671/0.9319593839910394 HTTP/1.1\r\nHost: 4436566.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T21:46:31.540354Z","times_seen":18695517,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/undefined/0.09429692871674411","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:38.054Z","timestamp":1790521418054,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /undefined/0.09429692871674411 HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:38 GMT\r\ncontent-type: text/html\r\nvary: Accept-Encoding\r\netag: W/\"69a690eb-e3b8\"\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":18820,"size_decoded":14997,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (17723)","md5":"f2e05a32914eab21294bf83d41c63e21","sha1":"b605a61a03b1b90ef55d517a5b9946f810cb7543","sha256":"c7636c815389288a70e92b7458b32b9680bc572f004ffae44e11ab1359d2a4d9","sha512":"124e3f634a4c476111ba176ead5c3d080115ca0cff4cbe9ecc802e4df858f72ba17ee8ecc9b8d004f1e18baaaee3244ce33c273b6611fc9775979032e392751c","ssdeep":"384:Qye7HzNL56DwmbkPPVZf4OR9uvs9WmT6VVwYdKiEESJBM6gBeU:cHJYDDQHVZHIs91TXESJBjgBz","tlshash":"a782cfe453ca6a83962ed4b4071d2f9e402e95f7ce4d88ac6e1a3ff9d10e47115883f2","first_seen":"2026-09-27T15:04:32.833367Z","last_seen":"2026-09-27T15:04:32.833367Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1089,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":643,"receive":446,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/undefined/0.4308961230855677","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:38.058Z","timestamp":1790521418058,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /undefined/0.4308961230855677 HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:38 GMT\r\ncontent-type: text/html\r\nvary: Accept-Encoding\r\netag: W/\"69a690eb-e3b8\"\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4021,"size_decoded":3788,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (2924)","md5":"b8fb9cee82b187c8d99c4ee3dbbd91ff","sha1":"5d134c35b9fba9acbb9f7c634da1b462782bffdd","sha256":"56039666f44cbafb84ebec978fa7f314473f0b8cae38a91a2c8d44b5876bd86d","sha512":"974b60e2e064c89d15d189845464983e38f7492dbeb56d5c7d9220c04da7b994178a399edec6898ef7e351ade7bc3e14756cabb4799ed08842d9d9e0565a130d","ssdeep":"","tlshash":"92814c63eb4e35a3a34f40a82c5463d5d16ec87746834d773d023736d88e09959a93f8","first_seen":"2026-09-27T15:04:32.835355Z","last_seen":"2026-09-27T15:04:32.835355Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1092,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":640,"receive":452,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/undefined/0.3697058677106704","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:38.060Z","timestamp":1790521418060,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /undefined/0.3697058677106704 HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:38 GMT\r\ncontent-type: text/html\r\nvary: Accept-Encoding\r\netag: W/\"69a690eb-e3b8\"\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10863,"size_decoded":8954,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (9766)","md5":"3a72e97d21c15127b3e0898343ad0881","sha1":"1047737cce38cdfc2bbfc34358a045ad7387ae9d","sha256":"b051e6a7eb5889d5a4fb7aaece8cd4a3d43c7bf38f3c863606542ebdaca5094d","sha512":"975b4792ead02d82938481b20b467d414f3699a0f2cb54c6aaa1d1174cd6b0cf97fed966c8a736faaf3fd32106ab4bb26478002c685678b374f978dbdc530150","ssdeep":"192:vSavmhMeICO8z/d5ocLj13JUDRSo1bTeVBLTIi7+W8BQZf4OND9uPkcid9C:Qye7HzNL56DwmbkPPVZf4OR9uvs9C","tlshash":"5322c0d0534d2ad2321be061452977ea402e81b7ca45bd77bf0b3bf1da0e9a04b893f1","first_seen":"2026-09-27T15:04:32.838292Z","last_seen":"2026-09-27T15:04:32.838292Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1098,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":639,"receive":459,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/css/style.css?1","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.294Z","timestamp":1790521417294,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /css/style.css?1 HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 09 Feb 2026 11:01:33 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6989be8d-1aeb\"\r\nexpires: Mon, 28 Sep 2026 03:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=43200, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6891,"size_decoded":2737,"mime_type":"text/css","magic":"ASCII text","md5":"a304fe13f4222d74bf96a1ea9d06af02","sha1":"1920d5ca726367fd11122e6546b14de9e45e6faa","sha256":"5f3ee00687a4e82c43fd1a1db30f92a783ab5f63b2b197849f3868404aa38fba","sha512":"36824f89c8dd1e6313c90c0abadd45f74a10d840bd8a6cbba2be4c5d9e52f7b16521b8918729f8a4e41211f622ca6db7889d787f9406bf0ecad94e49163aea7d","ssdeep":"96:UF7QqsRfkToY5Xeo3izJszOdrMVBXT2pphbzVssPCjRQCrpqgqQ:UBQqj1322gkBqHy+CCQ","tlshash":"c6e10e1e6e421dcde40750d8ae1a67e89b0c8518df0d6f6ef53b68bc9fce1a08573681","first_seen":"2026-09-27T13:09:55.963074Z","last_seen":"2026-09-27T15:04:32.839657Z","times_seen":5,"resource_available":true,"data":null}},"time_used":259,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":259,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/js/flexible.js","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.297Z","timestamp":1790521417297,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /js/flexible.js HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 12 Sep 2024 21:34:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66e35e78-9a6\"\r\nexpires: Mon, 28 Sep 2026 03:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=43200, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2470,"size_decoded":2317,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (1793)","md5":"96223580d12e0cbd98c84915c2af1d2c","sha1":"5e17485a20c35bec07fb3fc311865858dbe0d914","sha256":"e2b391cfd47f90d343acd3facc1b7fe3f77784e1de3cc81657c1ca690ffa5428","sha512":"bd9801055bcba67d91b275cd7aeca823a59bdeedcd9b93b6fac8c5d30b7d11adb71cc2a9bca6db86713e4595671ed2a2a0c91ea0ee5709dcb0bedb21f9c23a51","ssdeep":"","tlshash":"2d51c8b536123a750953247b8a3d62011d13867b545a4580f04feeea3f9cea49d33cfb","first_seen":"2025-11-01T14:35:41.753156Z","last_seen":"2026-09-27T15:04:32.840871Z","times_seen":7,"resource_available":true,"data":null}},"time_used":554,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":554,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/js/jquery-1.8.3.min.js?44","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.302Z","timestamp":1790521417302,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /js/jquery-1.8.3.min.js?44 HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 11 Jun 2021 13:30:02 GMT\r\nvary: Accept-Encoding\r\netag: W/\"60c3655a-17005\"\r\nexpires: Mon, 28 Sep 2026 03:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=43200, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":94213,"size_decoded":34854,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65481), with CRLF line terminators","md5":"69ecd99e201c97170d8b1735877c5c6f","sha1":"acbbbf3197c7ae19982ce6ef9ff6932593ea85d8","sha256":"ef45c2b4676161897f63a84bddd4a8d7e33e98d5477e8bda3ca8173b222b8a9c","sha512":"3d97dca1cf3e459586b63a2cf49d9bafd54ff56001bc44d3963f2bf2ae1fc0ffbd260aea09986e37ebb00e969f4b95502f37f654fd97a49a40ae0a97a720ecb9","ssdeep":"1536:ln6I5cEDlV0YjGaWQb6u6xvkT4ys33lt4WXgVInEG0vd007pNTbyT+SAy+uu49Jg:Z/Yi6Jnys3PN+RwFj2ShosS9","tlshash":"9293f7edb3c6717243ab31a910af650ff2366869284d8410f138e8f4bc75a499277e7d","first_seen":"2023-03-07T01:06:41Z","last_seen":"2026-09-27T15:04:32.842427Z","times_seen":1396,"resource_available":true,"data":null}},"time_used":549,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":549,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/img07.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.361Z","timestamp":1790521417361,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/img07.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 11 Jun 2021 13:29:14 GMT\r\nvary: Accept-Encoding\r\netag: W/\"60c3652a-743\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1859,"size_decoded":2628,"mime_type":"image/png","magic":"PNG image data, 32 x 28, 8-bit/color RGBA, non-interlaced","md5":"3b117894ddc68197f88f3180c353911f","sha1":"437dcab514c1d8ad222cff0f32bdefb692302bac","sha256":"a9d1176985ba7fc58e2944db63702b02bf254a1286ebce93c9281eb235a4d5f4","sha512":"1035e203cc6c5fa2c60cbaf85239da82fc3b7ac90898d14ff8e302b3854d89c8acb3cd7b9c8f2d430d6899a61cfd0ede854e8bae558a572d6b858ec6c6d38465","ssdeep":"","tlshash":"6331f74bed90650054cceac328e68826de29e550d7edf2587ec6c60548a81f549186cf","first_seen":"2026-05-18T02:20:43.720879Z","last_seen":"2026-09-27T15:04:32.845027Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1200,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1200,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hcdream.com/berlin/customer-service/kf.png","fqdn":"hcdream.com","domain":"hcdream.com","tld":"com"},"ip":{"addr":"172.67.202.65","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:38.538Z","timestamp":1790521418538,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hcdream.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 12 Aug 2026 22:13:42 GMT","end":"Tue, 10 Nov 2026 23:11:28 GMT"},"fingerprint":{"sha1":"2E:A8:C5:85:B3:79:60:C6:81:3F:58:4C:BF:62:F4:6C:90:9E:F6:1D","sha256":"C2:BE:4A:A2:75:C7:4F:A3:98:F9:00:DD:ED:6A:30:C0:0A:C0:4D:6D:61:6B:B8:2E:F9:F4:0E:6D:E8:1F:EF:02"}}},"request":{"raw":"GET /berlin/customer-service/kf.png HTTP/1.1\r\nHost: hcdream.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=a98cbc377971c34938f3cb7e77d50377\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 27 Sep 2026 15:03:38 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 28 Aug 2024 11:50:24 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66cf0f00-a706\"\r\nexpires: Tue, 27 Oct 2026 13:09:03 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nage: 6874\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0zhiK%2B9u%2FOiENg6tCgPKenkNWxKXv8ZOPagMqUKmJ0H89CtnXJPHLwvb%2FkuF4z51cvEKQBrP5jnzS%2BzcB2e76y5TP3tIJvrr0%2FjfFPkjMwH0cgRm5nKn6IOIxhx8jA%3D%3D\"}]}\r\ncf-cache-status: HIT\r\npriority: u=5,i\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a41b6571d9801ae6-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":42758,"size_decoded":43362,"mime_type":"image/png","magic":"PNG image data, 124 x 192, 8-bit/color RGBA, non-interlaced","md5":"bbe4771e00c05b055e6f3c7ac6255dfe","sha1":"bedd994bc8e4335e9eaffa8110bbdd2f6e4058bd","sha256":"5106b72f4feea5c35a33c7991fa8a62cc767731e201b97cc6cb30261c75032c5","sha512":"ede1970e182368460879f599eb120c5f6194cf447231cf3088d7f32d57ae8a63996777d48fce3d5a7a4c826a28d9a2cd2b6817def5731ee641890dcfe878ed2a","ssdeep":"768:pn+PwVBUErUTNnGNvw7mss0eKFtqWAEa6RNVpjgc4cPnXS88H+cwGIlwsxTf:pn3US9viC0eeDbfRRUcfi8zXGIJxTf","tlshash":"ca13f125a8a0b5c2e09c05f99af7804dff5cc100799ab907391a8e75fb3b29e067dd07","first_seen":"2024-08-19T13:15:43.299706Z","last_seen":"2026-09-27T15:04:32.846171Z","times_seen":27,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/js/himg.js","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.314Z","timestamp":1790521417314,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /js/himg.js HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 09 Feb 2026 11:17:17 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6989c23d-4db\"\r\nexpires: Mon, 28 Sep 2026 03:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=43200, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1243,"size_decoded":1454,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"93c0a93c4139421fdcce0545a8fc0e28","sha1":"acc055ffe549d060a343824f3d2334adeb375947","sha256":"52d194ec74c73520460b5315e59e27b07a02f83e96cf0a1ccb8aef723a6846b7","sha512":"fb9d4c43b513502b930f7ce09644b4b0a5c88ba937ec0231ae74d4d64cce1a4a8aacad779d267eaa7605586600695b4c0531542ec64b8659b4236f9b3d481587","ssdeep":"","tlshash":"49213ee7e518a92209171bee16c9794d91bf6caede82f7237309c04d0bc5cdf901d05a","first_seen":"2026-09-27T13:09:55.98905Z","last_seen":"2026-09-27T15:04:32.846884Z","times_seen":5,"resource_available":true,"data":null}},"time_used":690,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":690,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hcdream.com/akai/customer-service/67latest.js","fqdn":"hcdream.com","domain":"hcdream.com","tld":"com"},"ip":{"addr":"172.67.202.65","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.316Z","timestamp":1790521417316,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hcdream.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 12 Aug 2026 22:13:42 GMT","end":"Tue, 10 Nov 2026 23:11:28 GMT"},"fingerprint":{"sha1":"2E:A8:C5:85:B3:79:60:C6:81:3F:58:4C:BF:62:F4:6C:90:9E:F6:1D","sha256":"C2:BE:4A:A2:75:C7:4F:A3:98:F9:00:DD:ED:6A:30:C0:0A:C0:4D:6D:61:6B:B8:2E:F9:F4:0E:6D:E8:1F:EF:02"}}},"request":{"raw":"GET /akai/customer-service/67latest.js HTTP/1.1\r\nHost: hcdream.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 27 Sep 2026 15:03:38 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 02 Sep 2026 07:46:31 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a97d457-4da\"\r\nset-cookie: server_name_session=a98cbc377971c34938f3cb7e77d50377; Max-Age=86400; httponly; path=/\r\nexpires: Mon, 28 Sep 2026 03:03:38 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: BYPASS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NAGgeCZIRPAwbwjNBLnVS%2FDWjpOomLS2JwTBqrcjBMPJOx%2FEav4O2eLN%2FFgBenWtBiGKeBYDy9VOL5sUvFWqta0krlCzKC2tIqgpsi1N%2BtUb1yIMy8Y5c2sjenODWg%3D%3D\"}]}\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a41b656a68ea1ae6-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"server_name_session","value":"a98cbc377971c34938f3cb7e77d50377","quoted":false,"path":"/","max_age":86400,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"server_name_session=a98cbc377971c34938f3cb7e77d50377; Max-Age=86400; httponly; path=/"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1242,"size_decoded":1307,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"40636eae6aa805be7ca7a06b8a4f4cc0","sha1":"af993434d76db8435a2b84c3d3a092adb36d3df4","sha256":"ced73457a64e924c172560153b2e3a290e2f3a2556444272c8d5b396ff480100","sha512":"68cd9f50e046d62a91e545dc7158044aca24723c2ac93a8a24d28895a51f57aca21eacedb1122618b6b0e40b182ced850009d275e24e69b28c309267779b2fcf","ssdeep":"","tlshash":"26212bdea3691a27322336a0a4c7a428675be4875d8c6083f21e795c4f6eeef0d1d435","first_seen":"2026-09-27T13:09:55.933938Z","last_seen":"2026-09-27T15:04:32.847545Z","times_seen":2,"resource_available":true,"data":null}},"time_used":1192,"timings":{"blocked":-1,"dns":8,"connect":19,"send":0,"wait":1165,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"4436555.com/?a=395671/0.5827632174784456","fqdn":"4436555.com","domain":"4436555.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:38.040Z","timestamp":1790521418040,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /?a=395671/0.5827632174784456 HTTP/1.1\r\nHost: 4436555.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T21:46:31.540354Z","times_seen":18695517,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/icon01.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:38.065Z","timestamp":1790521418065,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/icon01.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/css/style.css?1\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:38 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 11 Jun 2021 13:28:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"60c36512-423\"\r\nexpires: Tue, 27 Oct 2026 15:03:38 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1059,"size_decoded":1749,"mime_type":"image/png","magic":"PNG image data, 13 x 6, 8-bit/color RGBA, non-interlaced","md5":"1106d3ce42dd60a62fa36d129db8c258","sha1":"ba43094c56be08676465ca26225135f768fb3f4a","sha256":"49e765e1cc7847b7bced9aba936029224fa4326c739aab893b6e6058809e38b7","sha512":"b2531126ed15a17ffe402caaf67f49b233ef32e6e12e6393375c012f0b34cdb717216b99606c3583a5794406df7d745f2977b3bb6878a342760ff35af7f905d9","ssdeep":"","tlshash":"5911754ffa812c51549cea4a54f68432d87245c0eae8f09579cec42b2ef02f9026a5cf","first_seen":"2026-05-18T02:20:43.237646Z","last_seen":"2026-09-27T15:04:32.848643Z","times_seen":6,"resource_available":false,"data":null}},"time_used":633,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":633,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/icon-144.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:39.470Z","timestamp":1790521419470,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /icon-144.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99; __vtins__3PBpqvV8Lrtd7ki6=%7B%22sid%22%3A%20%22fc891aee-635a-531d-bf20-a70b02d17e45%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201790523218517%2C%20%22ct%22%3A%201790521418517%7D; __51uvsct__3PBpqvV8Lrtd7ki6=1; __51vcke__3PBpqvV8Lrtd7ki6=69dd3c44-3294-594e-abd7-44a8c615abed; __51vuft__3PBpqvV8Lrtd7ki6=1790521418521\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:39 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 03 Mar 2026 07:42:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69a690eb-6ea6\"\r\nexpires: Tue, 27 Oct 2026 15:03:39 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28326,"size_decoded":28840,"mime_type":"image/png","magic":"PNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced","md5":"40a618b112653e2df36dea3129978187","sha1":"e93e0c460697e8f42e9509ed261173725e6d9821","sha256":"d5e6a2d60fbe3e24aa778cd2603523f4283d5490ddb7fae828c118a2757cf7f4","sha512":"184786e88fbb7cf4ff11e7a920264055ed10b14f994e4d8f873527e978f4864500c85e62a1de72aad730d187d7f7ec66d48b9a2305a14e1c9ec834f109468e48","ssdeep":"768:F+p8T/CGrPMLN797zcHV6FB4P1TsBC7FaqFQ9Z:guT6GjMR97z6n1YBCkqy9Z","tlshash":"75d2d069f5c858cc70917441cef421a6cff6969e29d58082f72f7412bf8898f62164cf","first_seen":"2025-11-01T14:35:41.742409Z","last_seen":"2026-09-27T15:04:32.849371Z","times_seen":6,"resource_available":false,"data":null}},"time_used":218,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":218,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/css/reset.css","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.292Z","timestamp":1790521417292,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /css/reset.css HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 11 Jun 2021 13:27:56 GMT\r\nvary: Accept-Encoding\r\netag: W/\"60c364dc-40e\"\r\nexpires: Mon, 28 Sep 2026 03:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=43200, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1038,"size_decoded":1582,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"7647a50fed51d3b167e510c898de753f","sha1":"651f1bbf5dd60f79064962e9f98dc1c02c24cc63","sha256":"4cd21d35ef4791f296b09bcfc690ff1ee06f3663c37df9fdd9f3e0ef01c3e5d6","sha512":"9dafa6b5f38a3083744a28ce43414fdcc77218823072b535f8b4069b27c776c1c437a345babae457202d6b8510317e767653a0f54a2fee224599bcd74c9257fd","ssdeep":"","tlshash":"6011356913212e5051b34e39277ea61c1e070132c9276d21f61145f9cdcb17f6780b9c","first_seen":"2025-11-01T14:35:41.747299Z","last_seen":"2026-09-27T15:04:32.850197Z","times_seen":7,"resource_available":true,"data":null}},"time_used":254,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":254,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/g01.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.337Z","timestamp":1790521417337,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/g01.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 13 Sep 2024 12:41:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66e432ee-fc27\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":64551,"size_decoded":65638,"mime_type":"image/png","magic":"PNG image data, 178 x 170, 8-bit/color RGBA, non-interlaced","md5":"40e59d159cb1e21a223f4c46059acc6f","sha1":"fa0d1c9629e670dbaf6fc280b223735c500afde3","sha256":"d8c5e3172d9836f9941b8d3454087f2b882669660dbae8f6394bbf8b9771d37a","sha512":"1447f5d99f9f9d8cb7b79263598fbf2e35239e002bd6c7ece5cb9556680edfe738d50af8a527077994c4d2c72afaa59269dc2e4cbc2ff13dffc60ddb33bf8506","ssdeep":"1536:VLLjaHWuxDUhfHE5R2wvC5Q7oAFfccAuOMVfLDHco7:VLHwR69wPjFfsuOMJff","tlshash":"3b53026324f08be0450aa6652dc84343f885c177af2874da8feb9514f1191f2d1e77eb","first_seen":"2026-05-18T02:20:43.42329Z","last_seen":"2026-09-27T15:04:32.8508Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1204,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1204,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/g05.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.343Z","timestamp":1790521417343,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/g05.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 13 Sep 2024 12:41:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66e432ec-fca2\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":64674,"size_decoded":65761,"mime_type":"image/png","magic":"PNG image data, 178 x 178, 8-bit/color RGBA, non-interlaced","md5":"05dede46ca33badb04a427c3fa8ece87","sha1":"3161bbfbe763bc4a45bdde1553e0d380a3733eca","sha256":"a857380e497702805eb2b1e0a773aae46f3ad3c3eba1edbd29c0f3cf53ae826c","sha512":"4e5e1d3415025c88bb35303ff0cbc5c628b9b5e7192844d0ad7e4e5c10ee8e567b71e0c56e1054772e92e3c670c155628f5b8c9382a8e373f95ff819da69e4cf","ssdeep":"1536:Dsj48RbLRJblmqe5FRHLhnsg51/21Ozsh:DO4WnblY5FRLhnsg/0OAh","tlshash":"ef5302b510ed45177a118813531816aa906fc3bf3b3ea07c79dba81e01c277a3fab953","first_seen":"2026-05-18T02:20:43.569333Z","last_seen":"2026-09-27T15:04:32.851461Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1201,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1201,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/yh08.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.358Z","timestamp":1790521417358,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/yh08.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 12 Sep 2024 21:58:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66e363f4-a6b2\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":42674,"size_decoded":43756,"mime_type":"image/png","magic":"PNG image data, 186 x 186, 8-bit/color RGBA, non-interlaced","md5":"33ab8b9cca7bdbcfa1ae64c525583cca","sha1":"ec28223915f236d045c6066cfbc3d577a7c92c16","sha256":"197f7f46f7320cb5cac50192d81ddc46c3fbe5fc1ef4564d8f08ca442b4f3b6f","sha512":"d304f37834c541c696191ed174106a7a9ac21d41d28e96c1de7a2b6245751e32076d0b1ad63d219a588a261603afbf4dcf2e95afdc11ab054acc461d8e569455","ssdeep":"768:fYvtFTKYm4ripsJIpHrokZnwx/kasUrwsUfdSOjvuoicGXKlaHeiOYaPUKMsO7qu:iKY1rhrMDqhUV1j2YM+DYaBkGON","tlshash":"1e13e11a73f47e747ceb345be7a9440de7af10322071e4bde0e815e2d711ba9672aa01","first_seen":"2026-05-18T02:20:43.677307Z","last_seen":"2026-09-27T15:04:32.852101Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1202,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1202,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/undefined/0.777067860375465","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:38.061Z","timestamp":1790521418061,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /undefined/0.777067860375465 HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:38 GMT\r\ncontent-type: text/html\r\nvary: Accept-Encoding\r\netag: W/\"69a690eb-e3b8\"\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":17694,"size_decoded":14111,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (16597)","md5":"9e237f185c49b37e2ff081ad3e34b683","sha1":"52c84e15e3e956ee579968a628cc589e9b37029b","sha256":"5923e521f00acc2872102035efff42c0bd05f06d39c8d5a218bf6cb48d0e953a","sha512":"286186f9db504dc392d0a5b1b9e6fd0600f789e94a36d63f785ce162314fe9ac293c6b0d292acb0ae3bc4234817bd54af1dd0b03a3c9f866fa6f070d32db424c","ssdeep":"384:Qye7HzNL56DwmbkPPVZf4OR9uvs9WmT6VVwYdKiEESJo:cHJYDDQHVZHIs91TXESJo","tlshash":"3682d0d053caaa83562dd8b4062d7f9e402e94b7ce4d986c7f127bf5d10d922198c3f0","first_seen":"2026-09-27T15:04:32.8538Z","last_seen":"2026-09-27T15:04:32.8538Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1105,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":637,"receive":468,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"collect-v6.51.la/v6/collect?dt=4","fqdn":"collect-v6.51.la","domain":"51.la","tld":"la"},"ip":{"addr":"43.159.107.113","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:38.525Z","timestamp":1790521418525,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.51.la","organization":""},"issuer":{"commonName":"Keymatic Secure Domain RSA CA G1","organization":"PKI(Chongqing) Limited"},"validity":{"start":"Wed, 01 Apr 2026 06:48:26 GMT","end":"Fri, 16 Oct 2026 15:59:59 GMT"},"fingerprint":{"sha1":"F0:4F:0E:62:84:89:BD:2B:8E:53:1E:AC:20:70:16:C2:F7:E9:C1:C0","sha256":"54:9F:ED:D0:8F:D4:0A:5F:31:95:55:FD:E0:E6:13:F2:09:8C:39:E1:01:31:98:FA:1D:DC:20:CD:20:19:7C:F5"}}},"request":{"raw":"POST /v6/collect?dt=4 HTTP/1.1\r\nHost: collect-v6.51.la\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nContent-Length: 240\r\nOrigin: https://gh11.top\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":351,"data":"\u001f‹\b\u0000J0¹j\u0000\u0003]PAnà \u0010üJı*5\u000b‹\u001csî¡RÕÞ1à$rä¸68‡ªo–$—ÜfgF³³ûˎ‘m7L}즟õÛ¾Ï9šáز×\r›óU\u0001ㄖ€`5˜+™‰d»”U«É4\\h\u0026\u0014—\u0007Zn™}°\u000e|J¼UÚs­ ò®—‚{#:!#˜„5\"\u0014r\u001frž–mÓì\u000f\u0000où\u003c5$MUªeN„@Zñ\u0002B\"Q'?î‰L#ÿú¬Aµ[\u0019‡ñ|©=Vê\u0001¤¤\u0007 F\"‰õ\u0012AÅç;(ë\u0012î¾r;¡u1ª€È•tȵÃÄ}\u0017\rGô6´ }—\"m*ýÓ¯$üý\u0003ˆÎ—@[\u0001\u0000\u0000"}},"response":{"raw":"HTTP/2 210 \r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://gh11.top\r\naccess-control-allow-credentials: true\r\nserver: TencentEdgeOne\r\ncontent-length: 0\r\ndate: Sun, 27 Sep 2026 15:03:38 GMT\r\neo-log-uuid: 9557156592032512882\r\neo-cache-status: MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"210","status_text":"","fingerprints":[{"name":"EdgeOne","description":"EdgeOne is an edge-service platform that delivers global content distribution, network acceleration, and integrated security protections for distributed applications.","website":"https://edgeone.ai","common_platform_enumeration":"","icon":"EdgeOne.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":1075,"mime_type":"text/xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-27T21:46:31.540354Z","times_seen":18695517,"resource_available":true,"data":null}},"time_used":269,"timings":{"blocked":-1,"dns":3,"connect":19,"send":0,"wait":266,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/favicon.ico","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:39.471Z","timestamp":1790521419471,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99; __vtins__3PBpqvV8Lrtd7ki6=%7B%22sid%22%3A%20%22fc891aee-635a-531d-bf20-a70b02d17e45%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201790523218517%2C%20%22ct%22%3A%201790521418517%7D; __51uvsct__3PBpqvV8Lrtd7ki6=1; __51vcke__3PBpqvV8Lrtd7ki6=69dd3c44-3294-594e-abd7-44a8c615abed; __51vuft__3PBpqvV8Lrtd7ki6=1790521418521\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:39 GMT\r\ncontent-type: text/html\r\nvary: Accept-Encoding\r\netag: W/\"69a690eb-e3b8\"\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":58296,"size_decoded":44878,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (56756)","md5":"cbb42513032d6c09e496731ac16c20a9","sha1":"c92f38a701aad58408451d24dd4c47b05f158cf0","sha256":"d189695b2f3bb92369881f2428fa861dca9d9a94c638d9bdc4e2fa747d6f315b","sha512":"3d76f1018afceaba7cbb4083f4a5b5758966ec2aa5d5c6b07d72361782809f7ed4bd34ed9e0c4154d01a2db7192155de8251e5a834dd90b8d9823d916e1b7285","ssdeep":"768:cHJYDDQHVZHIs91TXESJBjgBSp00yCqJ3Z+IYM3WiesRQiULO0bpD9tcNQEfdom2:cmDD6oeFUycwpk06hWp1b99c7VM","tlshash":"8443021803de40a2cd8978d9426f2f3d842a1863da1c94bd1f5b6df4ca0d8a4767f1e9","first_seen":"2024-11-25T13:26:01.204756Z","last_seen":"2026-09-27T21:44:41.579392Z","times_seen":15089,"resource_available":true,"data":null}},"time_used":223,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":223,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/css/iconfont.css","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.296Z","timestamp":1790521417296,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /css/iconfont.css HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 11 Jun 2021 13:27:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"60c364ce-653a\"\r\nexpires: Mon, 28 Sep 2026 03:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=43200, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":25914,"size_decoded":18711,"mime_type":"text/css","magic":"ASCII text, with very long lines (21815)","md5":"d397fe8f0525f7af07939f5f364b5b51","sha1":"5b5eaee6085f6f7454e0d9175aea716d8f999f69","sha256":"d656d07369891d0686bddf70eee23097f0cea1509b7a27511670cf03e476bed6","sha512":"9e33c300f107959b8fec1b4d48044997a13fc09c6a5ffdbc40ef4541388891e1434b7d0f88ceaa016c6ac0caa3196c95560c686c7d9678ccbdc6c644d9c15455","ssdeep":"768:bj0DmZTtCHviZHhjwCm5lCSSUgiFbLo3sCrGBEQqNUh:bj0qT86ZBiqvKLfCaBEQ0a","tlshash":"f9c24bf2893d6df10711e090325762849fa5762d8a855c5ff6026c9ce7f37187287aec","first_seen":"2026-05-18T02:20:43.809217Z","last_seen":"2026-09-27T15:04:32.856341Z","times_seen":6,"resource_available":true,"data":null}},"time_used":555,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":555,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sdk.51.la/js-sdk-pro.min.js","fqdn":"sdk.51.la","domain":"51.la","tld":"la"},"ip":{"addr":"43.159.107.113","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.317Z","timestamp":1790521417317,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.51.la","organization":""},"issuer":{"commonName":"Keymatic Secure Domain RSA CA G1","organization":"PKI(Chongqing) Limited"},"validity":{"start":"Wed, 01 Apr 2026 06:48:26 GMT","end":"Fri, 16 Oct 2026 15:59:59 GMT"},"fingerprint":{"sha1":"F0:4F:0E:62:84:89:BD:2B:8E:53:1E:AC:20:70:16:C2:F7:E9:C1:C0","sha256":"54:9F:ED:D0:8F:D4:0A:5F:31:95:55:FD:E0:E6:13:F2:09:8C:39:E1:01:31:98:FA:1D:DC:20:CD:20:19:7C:F5"}}},"request":{"raw":"GET /js-sdk-pro.min.js HTTP/1.1\r\nHost: sdk.51.la\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Sat, 10 Jun 2023 08:47:40 GMT\r\ncontent-encoding: gzip\r\netag: W/\"648438ac-861a\"\r\nserver: openresty\r\ncontent-type: application/javascript; charset=utf-8\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\ncache-control: max-age=1296000\r\ncontent-length: 12853\r\naccept-ranges: bytes\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\neo-log-uuid: 18103937449801051736\r\neo-cache-status: HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":34330,"size_decoded":13298,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (34109)","md5":"8fc0b01d35300e8398d6e957987c01e7","sha1":"f1eb32c75b8d8e4b0555ebc2a5f5d1d60296f41e","sha256":"b164aafa0bb83dfe511912ca2ca475880bfffac8d8f098c947fd3d4af440d3a4","sha512":"fab84d067e724d45f35821d8f37c0cd4f608af2975de48a61b905dba89189ca8778b04b4d507e6417a4187193a3da2d0a8939c02bf2d39adb9733cffd2358401","ssdeep":"768:Xzz9qAO+a/y1jaKUiQU5enEU9GMXB0XXQVEXB3CNSPf:Xzz9qnT/c+KUc5enEU9GMXB/EXB3LPf","tlshash":"55f22d9577c0717cc3c782e9361b401ae1a69e810099a8acf345f594bd74e66a33ffa8","first_seen":"2023-04-05T07:31:50Z","last_seen":"2026-09-27T21:33:56.003963Z","times_seen":10862,"resource_available":true,"data":null}},"time_used":74,"timings":{"blocked":-1,"dns":3,"connect":19,"send":0,"wait":24,"receive":0,"ssl":27},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"sdk.51.la","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hcdream.com/berlin/customer-service/kefu67.js","fqdn":"hcdream.com","domain":"hcdream.com","tld":"com"},"ip":{"addr":"172.67.202.65","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.319Z","timestamp":1790521417319,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hcdream.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 12 Aug 2026 22:13:42 GMT","end":"Tue, 10 Nov 2026 23:11:28 GMT"},"fingerprint":{"sha1":"2E:A8:C5:85:B3:79:60:C6:81:3F:58:4C:BF:62:F4:6C:90:9E:F6:1D","sha256":"C2:BE:4A:A2:75:C7:4F:A3:98:F9:00:DD:ED:6A:30:C0:0A:C0:4D:6D:61:6B:B8:2E:F9:F4:0E:6D:E8:1F:EF:02"}}},"request":{"raw":"GET /berlin/customer-service/kefu67.js HTTP/1.1\r\nHost: hcdream.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sun, 27 Sep 2026 15:03:38 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 02 Sep 2026 07:28:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a97d01d-d71\"\r\nset-cookie: server_name_session=8e624e04789d081470b9d084caffdac1; Max-Age=86400; httponly; path=/\r\nexpires: Mon, 28 Sep 2026 03:03:38 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\ncf-cache-status: BYPASS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Y3jWriieet5Hv%2BCIQfODfOZy3xpP1NrA2j9M14psOotSkSZok8DhmKlP%2Br6B%2BJsliyDSTn0GDzpPtO%2FwS2y6zAJgKsRgmd6mvdM6wWaV5towV7p6eUfjkvv8Dg9Icw%3D%3D\"}]}\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a41b656a68eb1ae6-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"server_name_session","value":"8e624e04789d081470b9d084caffdac1","quoted":false,"path":"/","max_age":86400,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"server_name_session=8e624e04789d081470b9d084caffdac1; Max-Age=86400; httponly; path=/"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3441,"size_decoded":2055,"mime_type":"application/javascript","magic":"HTML document, ASCII text","md5":"6bfc5acdb84d90756937655f38ddb767","sha1":"3e0b8a539df54ae4196c3a61e59e1647216f42a7","sha256":"7fc9ad8c99de300c4d36d772f9540669524146fb51fbcf2ee9620591164dd9c3","sha512":"52d3a36309d27e81ffd759ff0d832741c6bc41eb4c1558895ee62a1e31acdf57893ccfa26c0be5e5c6a9b8544f500aa80f20e08892ad5498b0d73cca1584ec69","ssdeep":"","tlshash":"0e61438e67b70527111330e0a6db96247736b0473e0e9c86b64c9e4c4f49def5c1eab5","first_seen":"2026-09-16T18:38:53.946148Z","last_seen":"2026-09-27T15:04:32.857748Z","times_seen":6,"resource_available":true,"data":null}},"time_used":844,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":844,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/img04.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:38.072Z","timestamp":1790521418072,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/img04.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/css/style.css?1\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:38 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 11 Jun 2021 13:29:08 GMT\r\nvary: Accept-Encoding\r\netag: W/\"60c36524-c1c\"\r\nexpires: Tue, 27 Oct 2026 15:03:38 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3100,"size_decoded":3882,"mime_type":"image/png","magic":"PNG image data, 38 x 42, 8-bit/color RGBA, non-interlaced","md5":"d32fced4c910e72fb5143a725f549b89","sha1":"82aaa20e655dd8d739af048121489603b53648d4","sha256":"a59542deca59354eb581291242145268e275b5b8f0098918181135a261d63f15","sha512":"77d785aca72375cbc47a372bf493ee6c569d5d01104f332e231fc18e3f37797ca3fdc096312887d1f367a57f22211136928cb18b9e07a5255e38485c8cd9b764","ssdeep":"","tlshash":"b3517c47da0229526228da8e09fb85b38a36018afbb1f4f03c4b0c271b288fa474c5c1","first_seen":"2026-05-18T02:20:43.017866Z","last_seen":"2026-09-27T15:04:32.85865Z","times_seen":6,"resource_available":false,"data":null}},"time_used":628,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":628,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/yh01.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.351Z","timestamp":1790521417351,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/yh01.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 12 Sep 2024 21:49:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66e361f6-995e\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":39262,"size_decoded":40342,"mime_type":"image/png","magic":"PNG image data, 186 x 186, 8-bit/color RGBA, non-interlaced","md5":"7ec32e1e6457c9ea6409012788aa24bc","sha1":"2defc2f77e613cdbf663848b8dda146ff6221f3e","sha256":"2baa36290b9a077d94af7f4030d98946d5665b4221e787f6b16e22791f845011","sha512":"020820004f0680e3d536301478b5ef425a3880194d035c25ec54417b9dd2f09239dab999f64ec5af2a9e8ccf13d55635a9e4127a145d1786e1dd52df6901a4ac","ssdeep":"768:6Q7yQadIi56FmhVF7G5kFGB0ReX4VA/joL0SIgh8hvdJ3IuFDVTc:6CadxJl7eWIIeX4CK0SIthlJDm","tlshash":"1303015f388f16c980f70eee54666e3362651dc5c21a6c01007de2298fd9929e40eb6f","first_seen":"2026-05-18T02:20:43.49201Z","last_seen":"2026-09-27T15:04:32.859744Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1194,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1194,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/undefined/0.6500325215378188","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:38.051Z","timestamp":1790521418051,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /undefined/0.6500325215378188 HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:38 GMT\r\ncontent-type: text/html\r\nvary: Accept-Encoding\r\netag: W/\"69a690eb-e3b8\"\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12022,"size_decoded":9831,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (10925)","md5":"171baf6fc24560eced74a755d70da2e9","sha1":"03211738665fd02dfbf84832ab131eea8e17ab0f","sha256":"8891ea29c4d93d12a38478edede211c0dcab997f692805ea6ebc7789b7c5ae0e","sha512":"d978156cb2fece933331c57e980561c0f445deee7ab4d9704eeba640d82614d67983bab396faf4146f282b6a2cd7111edd26cacb8ba664f780e3a3b9c1872bb0","ssdeep":"192:vSavmhMeICO8z/d5ocLj13JUDRSo1bTeVBLTIi7+W8BQZf4OND9uPkcid9WmMsz:Qye7HzNL56DwmbkPPVZf4OR9uvs9Wmf","tlshash":"9f42bfd1534d6ad2221bd0750a297bea402e81f7c649ac6fbf067fe4c50e4a14a893f2","first_seen":"2026-09-27T15:04:32.860587Z","last_seen":"2026-09-27T15:04:32.860587Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1084,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":646,"receive":438,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/btn.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:38.073Z","timestamp":1790521418073,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/btn.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/css/style.css?1\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:38 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 11 Jun 2021 13:28:10 GMT\r\nvary: Accept-Encoding\r\netag: W/\"60c364ea-5f5\"\r\nexpires: Tue, 27 Oct 2026 15:03:38 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1525,"size_decoded":2271,"mime_type":"image/png","magic":"PNG image data, 186 x 60, 8-bit/color RGBA, non-interlaced","md5":"3e0a2b72999826b293a35646f0b3982b","sha1":"acb81e4ee492e9cada620beed708b0796a02fbc2","sha256":"4f871541d0dd761def4d72d93d1a50f02b1a95123b781f7e25e0fb2564c0121f","sha512":"d8723b59b7fdb232d97da1beb67a1ef7d44783ca5e17307691d222d9f09a9a0eb29f6e0f7621503f16cbd998948f83ade4c908e4dc57c796d8735879979076ff","ssdeep":"","tlshash":"b031c98dff007811d84cb64654fb50528f278580ada8d9896cccdc6a57b01f71aee6cb","first_seen":"2026-05-18T02:20:43.657187Z","last_seen":"2026-09-27T15:04:32.86192Z","times_seen":6,"resource_available":false,"data":null}},"time_used":626,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":626,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/img01_over.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:38.067Z","timestamp":1790521418067,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/img01_over.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/css/style.css?1\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:38 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 11 Jun 2021 13:29:00 GMT\r\nvary: Accept-Encoding\r\netag: W/\"60c3651c-a46\"\r\nexpires: Tue, 27 Oct 2026 15:03:38 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2630,"size_decoded":3404,"mime_type":"image/png","magic":"PNG image data, 55 x 42, 8-bit/color RGBA, non-interlaced","md5":"398882a2d14c3fa50c65ab7e26bf7458","sha1":"e07d6fbc115da635798763544ebf7e42bbfcdf77","sha256":"e579adc35c1c9cf9b34c963a8add0fec4bf272b51de4b0b9c9c3892fe9611a58","sha512":"65b59749a95d8923f425f602e990b0e5e138712a1cbe6c38de89ccba116876d8278498d352954d5de5b5a8c5703dde1a29e0f26a9c4974a45481f4a208b31aa3","ssdeep":"","tlshash":"d0511a0eeec3ad0160ecde8824f2d426886addd0aea1e471e8ccac3656350fd07819c3","first_seen":"2026-05-18T02:20:43.432815Z","last_seen":"2026-09-27T15:04:32.862827Z","times_seen":6,"resource_available":false,"data":null}},"time_used":631,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":631,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/icon02.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.331Z","timestamp":1790521417331,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/icon02.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 11 Jun 2021 13:28:52 GMT\r\nvary: Accept-Encoding\r\netag: W/\"60c36514-633\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1587,"size_decoded":2340,"mime_type":"image/png","magic":"PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced","md5":"d207199149138ddf2f2ec9e22092c07a","sha1":"e9996ef1ab9c955ea2200714855ea72b55ac9d1d","sha256":"1e0c8649c78519cfb090b6ea32b1eb9e11ccad5eb8d7dc0a52c5661b7c968de6","sha512":"cac49dc6b4d05f7cf313ecac93c75219e6a93502f277c445734bb8a9ff49c52235b5346a9373b3a466944e173b954617d0d1f32fd6d235b4a06aa8abed66eada","ssdeep":"","tlshash":"0431a10ef6803c01a98cf58610f761a3dd27c2c094e0f1582cdac9062bb01f847e8acf","first_seen":"2026-05-18T02:20:43.930665Z","last_seen":"2026-09-27T15:04:32.863441Z","times_seen":6,"resource_available":false,"data":null}},"time_used":826,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":826,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/imgtext01.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.333Z","timestamp":1790521417333,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/imgtext01.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 11 Jun 2021 13:29:24 GMT\r\nvary: Accept-Encoding\r\netag: W/\"60c36534-c5bc\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":50620,"size_decoded":51244,"mime_type":"image/png","magic":"PNG image data, 399 x 192, 8-bit/color RGBA, non-interlaced","md5":"10c5571454d993ee1e3844e3de35b081","sha1":"4cbca13722ab9834dc5cac1165247958d9e90203","sha256":"7c9e14a62a9e757a2ba86e49aaa248e55e58d1d033f911bf56c4d7ac08605eb4","sha512":"4c3b2032e6beebb4979fffb075756e99e94dbad1f7a3f0c7754fe679c279cd09b0f55f5ece42725f277f35e057f9fffb654fdd5228e8ed3d926a7d6bd94da25a","ssdeep":"1536:YXaKKsdneRYKvvhy9GF64Xaafu8EzDVu/FxrsPW:YqKKs6rnXFHaF8EzDU/YPW","tlshash":"0533f259f5836028b7d1af427238dd94c216d6304c827df483cea81c94b777952b5cea","first_seen":"2026-05-18T02:20:43.804143Z","last_seen":"2026-09-27T15:04:32.864268Z","times_seen":6,"resource_available":false,"data":null}},"time_used":905,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":905,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/g07.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.345Z","timestamp":1790521417345,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/g07.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 13 Sep 2024 12:46:22 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66e4341e-10b08\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":68360,"size_decoded":69453,"mime_type":"image/png","magic":"PNG image data, 178 x 170, 8-bit/color RGBA, non-interlaced","md5":"20c8a47d408a833b601eb3727017d0bb","sha1":"fd71cd9f46a67816575ec67bb93e9f6d93879122","sha256":"5b1098ef698151b58e5ebe13f87b98c5fedbb8e22167d65081e94b2fd6cb0063","sha512":"a35d4060300f201d163ceb2be831b467ae2ace0296c4626ac19194f1c05d346f37376807fff8c3214ca57c4fe4cc1a9cdfa840564091ce2b621d19ac6b597992","ssdeep":"1536:+2SRj8SiYGm053lmAvW5soZzNk5dv1c4YLReyOfs/dwgEtR8E+yLgNx:+2q8Sivm05EJsoZJknv68yR5Et4yLgNx","tlshash":"1c6302ef216662bfcc83f41181f6e95d3af060276691b7a732a16da152e34fc38504f5","first_seen":"2026-05-18T02:20:43.488404Z","last_seen":"2026-09-27T15:04:32.865559Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1199,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1199,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/img08.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.362Z","timestamp":1790521417362,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/img08.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\ncontent-length: 963\r\nlast-modified: Fri, 13 Sep 2024 14:38:20 GMT\r\netag: \"66e44e5c-3c3\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":963,"size_decoded":2005,"mime_type":"image/png","magic":"PNG image data, 32 x 29, 8-bit/color RGBA, non-interlaced","md5":"f36976fdba05262fbbf08a629a448c51","sha1":"bd010f8455dc11eaa40260989be61fb27a457586","sha256":"fbfd26681627df75432dbd02385269b2ad83ba20d05a1f74426d0bc4cca93351","sha512":"66a4cd3c7caa947ae3bc107e286e07926c0c4787103fccfede9a4cfb1f560d771766a6dde73639601660bfcb3315013ea4cc915c74fdb8363e1b1e00d14f08ed","ssdeep":"","tlshash":"0b11ccfb24b06d74ad323f2b6316555d1d41bf64d9e5241f35b7be914f182501d90100","first_seen":"2025-11-01T14:35:41.749525Z","last_seen":"2026-09-27T15:04:32.866323Z","times_seen":7,"resource_available":false,"data":null}},"time_used":1740,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1199,"receive":541,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/g10.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.348Z","timestamp":1790521417348,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/g10.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 13 Sep 2024 12:46:22 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66e4341e-14117\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":82199,"size_decoded":83297,"mime_type":"image/png","magic":"PNG image data, 186 x 178, 8-bit/color RGBA, non-interlaced","md5":"dceaffccb09cbac992ad872aa86b6cf8","sha1":"376fe804ee4387056d8f28fb6d009f0c033df3cd","sha256":"3173f1f6c579c632232b20cb1e58e0d5975624892ec9354c952be80f4e7454be","sha512":"ed48abea998ca0cefd3faa6e335edc45114146eb12de7dad40439a7a3cf4b765741238a9520d35bf460c6f90bd656240e4342d7c00711f62a4597093e646820a","ssdeep":"1536:r8ZK0XBJ1K64tPoq1LK/gG+cFChnEJ0D4ncKIZDAdjfNNkgkShZ:8K0eoqhE9sExncjgQzShZ","tlshash":"0283028b573ed6f296405d34ab7187e1a00144547e163d48f7af7c9eea0dc3cb6a9134","first_seen":"2026-05-18T02:20:43.928214Z","last_seen":"2026-09-27T15:04:32.866963Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1197,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1197,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/g11.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.349Z","timestamp":1790521417349,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/g11.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 13 Sep 2024 12:46:22 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66e4341e-1359e\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":79262,"size_decoded":80355,"mime_type":"image/png","magic":"PNG image data, 186 x 178, 8-bit/color RGBA, non-interlaced","md5":"119cf031d7e96439b3197403a1c65ff8","sha1":"1c533c6bb4bab73d210f478fc889a199e839d9d4","sha256":"445f67e70fc6f987fe175472aa94487d657859150fe987fa9882e235ac3bb8af","sha512":"4e758e7ac1c5fdea7a06f7ff613282250e9e59928047416f625eac1bf46b26af8c141e54d8d9f63c135b5e2ddb1aa9c7fd9e416f4d046445b61d1457bd5bf342","ssdeep":"1536:9lN1x4UCTtD4R/xxjvzzHHu2UnJ2K/OU6aJcrDMEiaYCD0G:5wUCTtDuJtuzJNOU6aJcrDAPW0G","tlshash":"e37312fd58270a78f7f04bf4e0f00508ebae4bb2f844836b51255642da167692636bd6","first_seen":"2026-05-18T02:20:43.653302Z","last_seen":"2026-09-27T15:04:32.867762Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1196,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1196,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/yh04.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.354Z","timestamp":1790521417354,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/yh04.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 12 Sep 2024 21:58:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66e363f4-730f\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":29455,"size_decoded":30532,"mime_type":"image/png","magic":"PNG image data, 186 x 186, 8-bit/color RGBA, non-interlaced","md5":"736d2a33ef4d31cb92401b5e13df432f","sha1":"8024093cff544b08aac9fa9a6db968447f850ea3","sha256":"536a862d84fe0c76d3a168e9e285dbe604c4bc4beb4dcb10879d70a3f61b484e","sha512":"1457a2935ae08feafe20749928bb7050a45bb7fe7c80f13784f1e23803ddfec77629f71e90719071b506804d5e284031c7b979aa0b1176d14b231f7a5fa98c6b","ssdeep":"768:0A9qKLYca3M9Sy/TcGAV2Ji0A1te+Kd5Im4J:0oq4Pa3Qx7VinJKbN4J","tlshash":"94d2e1a7ccd6927a577b10ce6cfc87fb71d8427bb6950c4a649d0ea1f1252c236410be","first_seen":"2026-05-18T02:20:43.321642Z","last_seen":"2026-09-27T15:04:32.868416Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1191,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1191,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/yh07.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.357Z","timestamp":1790521417357,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/yh07.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 12 Sep 2024 21:58:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66e363f4-97f6\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":38902,"size_decoded":39984,"mime_type":"image/png","magic":"PNG image data, 186 x 186, 8-bit/color RGBA, non-interlaced","md5":"91d6a0007f16f6e5a2c6506de2c0850f","sha1":"4d350e0627649e5d209a9af9b30697875918f3c3","sha256":"fb10c8def05a6275f0f5cded9b14638f29d591e46fffc62d385f7b745b465113","sha512":"577cc187d1a4df6273784fe803ed3a79f17a21be35cb06a83fb58dea930dbae9492ff0c362544e2452c2a0484a9e121c0431c7f42e7f51c96316f87a53a3b7bf","ssdeep":"768:gZ6bmyEeJ7F28H8Q1LukcbrzwTOZE68+NNSeg1sCWAh0aKu5+vEJUL:g0bhP5FN8WLrTOZlNNSh1sCWAhn4vEJE","tlshash":"e40302b00869a653ca63a1e9560b5a83dbab5396c530fddfce35208f014e597e3d18b0","first_seen":"2026-05-18T02:20:43.327288Z","last_seen":"2026-09-27T15:04:32.869016Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1189,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1189,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/ttl01.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.326Z","timestamp":1790521417326,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/ttl01.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 11 Jun 2021 13:29:34 GMT\r\nvary: Accept-Encoding\r\netag: W/\"60c3653e-17aa\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6058,"size_decoded":6863,"mime_type":"image/png","magic":"PNG image data, 248 x 24, 8-bit/color RGBA, non-interlaced","md5":"a1b192db50e6f69a766461819834b915","sha1":"c6cb5e2dce318cba14547dd596d350d2b4c72682","sha256":"6faee414775096c1de55748753a6640699d47b1a2474caafe21f17b859bb10c5","sha512":"aebacd839ebbfa3c849eb82f1fa1acd23e5cb7e5e35fc3fb21ec19c4f92214e962d1963730bca97bff4faa02550c9b9868f4fc58f79795cd5a0bc84c5439ee2e","ssdeep":"96:SWmcjU+RKXbrdQU4ByfgxdBNXRNKUnJEx7WjiwuVZZuDCyt7W6:XKrBuByfUdvPKUCuiLZ0CSS6","tlshash":"08c18e1ec915470502c6fdf5a0e8f62a8a22bd40fcc0e9984265dc7a47da4f80ae4edb","first_seen":"2026-05-18T02:20:43.554538Z","last_seen":"2026-09-27T15:04:32.86958Z","times_seen":6,"resource_available":false,"data":null}},"time_used":823,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":823,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/anz.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.336Z","timestamp":1790521417336,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/anz.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 12 Sep 2024 22:24:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66e36a2e-2dd9\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11737,"size_decoded":12814,"mime_type":"image/png","magic":"PNG image data, 313 x 96, 8-bit/color RGBA, non-interlaced","md5":"64ea4088121b3816eec86f66ad07e955","sha1":"631e15d769050bcdde81af848d4bd80ab4cde271","sha256":"902c5b7dbb719795f0c4558b558737417ea3c2f3748b175cc5c1247034beb70c","sha512":"b3a8699b0a1e78e68c0f6c9046d9666b44bb3b7dfa435fd2ef6cae0d69a4fc5abcf5e9cfb344b96ff5c83f35900df27c19d4a435701e0344318e883f36ee157b","ssdeep":"192:g2SGl0n6L0GtKQB3Z3sVgw0oiPHAVTs8BKfHSqsqFp6R9Ko+jGKQKf1d5Q9DrSeq:yW0mjBBJc/biPHUTxKfrn6aLtNqvSVz3","tlshash":"a332ae4fc683aea1c7b391eb321729395e1d1c1a964f728dc4834610330a4ad628efb7","first_seen":"2026-05-18T02:20:43.850294Z","last_seen":"2026-09-27T15:04:32.870347Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/g02.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.339Z","timestamp":1790521417339,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/g02.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 13 Sep 2024 12:41:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66e432ec-13803\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":79875,"size_decoded":80968,"mime_type":"image/png","magic":"PNG image data, 178 x 170, 8-bit/color RGBA, non-interlaced","md5":"4823751c5aa22c3b2442ca4a41ca5fb1","sha1":"97c3fc433228fb439039476227a7b6e0e35f2364","sha256":"5aa13f917161c0543537242752701b7ffd4758939b4942ad6f967aec70afaed1","sha512":"9140a52c37209891556d3e76b10f95e89ff2756afba82db9820997780f1fdf7d22e743519cb623df8e75a0ddaa6fb9e495243a9c7460f697ab628b84af7128d6","ssdeep":"1536:tNDajiX4Q740LkoaUJPYmr/g25CsRVKC1NHR2Yd4ZKotpk8SucU9ZyXZIejGTbal:tNdlDPvrbaCH8C4xmgcPpO6l","tlshash":"2273122fdb91532b0e7f5d82b788448484b192344ca75bdcc90aeca0a3f97f579149fa","first_seen":"2026-05-18T02:20:43.733065Z","last_seen":"2026-09-27T15:04:32.870938Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1203,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1203,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/g08.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.346Z","timestamp":1790521417346,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/g08.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 13 Sep 2024 12:49:32 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66e434dc-edd4\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":60884,"size_decoded":61971,"mime_type":"image/png","magic":"PNG image data, 161 x 161, 8-bit/color RGBA, non-interlaced","md5":"840e46d66c5f9c6d29975cb20322bedd","sha1":"597a6826fffe38d13400df0744181803bb2fcf0a","sha256":"94204d86da09ba4f7e550ad0a5954fb99f45139ef00f8cf01da1f7d9149026fd","sha512":"25d536054da5793dd7ce7abb3298ad600a2c6f0327d0003252a59fdb75186f2fdb023750bf6bd0e04351f9c54618d7b2d6680469666411d6817ce6ff55c53d27","ssdeep":"1536:MZwLnudVNBaJoWc03KJbIJfrp3N+ZexIjPD:MZwDgWY0xDpd+TjPD","tlshash":"0a5301d33a8de5199b8c8df32248e58a23e67894820c9cbc7fb7f92759891330557173","first_seen":"2026-05-18T02:20:43.736276Z","last_seen":"2026-09-27T15:04:32.872607Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1199,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1199,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/yh03.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.353Z","timestamp":1790521417353,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/yh03.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 12 Sep 2024 21:58:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66e363f4-6459\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":25689,"size_decoded":26766,"mime_type":"image/png","magic":"PNG image data, 186 x 186, 8-bit/color RGBA, non-interlaced","md5":"79d6f5857c6fa7189d3745936c77786b","sha1":"caec9f889af64ca90c997adb47a7e60259a75e9a","sha256":"602068010b22efa230ed9592fd36e45edc038aeda16d918357c73fde1077aecf","sha512":"f889bb7152d2e71db8f9e785fe07523fdcd13de60cc3f9368e8fe2415f8b13a64ab09f75c4efea9d7ff7e135521fd64a895a54aa1d1f948f46096cdcdad504b4","ssdeep":"768:NXNHi5AwRLSK/alM8f2RUjZl8Sk/aKNAH:NIu22K/wMSKUjZ+T/aKe","tlshash":"f4b2e06183af16cbf1d714d4f0905a250ef64ce824579fb33a0568d927d88b38aef092","first_seen":"2026-05-18T02:20:43.164959Z","last_seen":"2026-09-27T15:04:32.875317Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1192,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1192,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/img02.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:38.069Z","timestamp":1790521418069,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/img02.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/css/style.css?1\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:38 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 11 Jun 2021 13:29:02 GMT\r\nvary: Accept-Encoding\r\netag: W/\"60c3651e-f35\"\r\nexpires: Tue, 27 Oct 2026 15:03:38 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3893,"size_decoded":4689,"mime_type":"image/png","magic":"PNG image data, 42 x 42, 8-bit/color RGBA, non-interlaced","md5":"f8fd7300df139424e514c3c390ef1842","sha1":"86d068e77ac11934bddeb73ff63b1f2dcef3c2d4","sha256":"c12c67d7d33109ae73399e6d2529dd7f3a3e3c7ac4d19e3c0d86d855d1ae5602","sha512":"2cc00df096e1c3829f967a95279d8408491a9aaff0efb545acb0f1d77ed5d7a94b27726466a77aa930e31ff7254be6b227164495f147c52b2db51e329f61fe84","ssdeep":"","tlshash":"28817dcf7d21bc669cede29724d6a7a7dab58c1142f0a0053d8de42919bc0f517394c3","first_seen":"2026-05-18T02:20:43.871889Z","last_seen":"2026-09-27T15:04:32.876466Z","times_seen":6,"resource_available":false,"data":null}},"time_used":630,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":630,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/h_img.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.325Z","timestamp":1790521417325,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/h_img.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 11 Jun 2021 13:28:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"60c36512-3b63\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15203,"size_decoded":16019,"mime_type":"image/png","magic":"PNG image data, 190 x 50, 8-bit/color RGBA, non-interlaced","md5":"d1d64d1390de82b60926f2b4c04a0ed1","sha1":"f818e86d9af6c3603628546b8fd46b53824ee614","sha256":"385622fe651ffe53c5617e9a24ba01a264e961a94b6ced0d7a6399a9e017c936","sha512":"f693ec8a04740c1082b8527e82c29f4ea90ee67940213901cae177d14338f6e08ebdb1f8d8d52c9a22e96c4eebb8ac42b689ca13ed05d82413187d74423e3a68","ssdeep":"384:iRCZatSgQ5aHTpjy50EA6XyvE9xVUWTD+nkYjMeaYA:mC0SgQ5atD4yuVFT8O2A","tlshash":"1d62c0466cd15f87888df01617f2407e1f176464ed7eb3ae8bd8e075a6e422fe648047","first_seen":"2026-05-18T02:20:43.550995Z","last_seen":"2026-09-27T15:04:32.877611Z","times_seen":6,"resource_available":false,"data":null}},"time_used":807,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":807,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/logo.png?1","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.324Z","timestamp":1790521417324,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/logo.png?1 HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 28 Feb 2026 13:16:56 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69a2eac8-415c\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16732,"size_decoded":17541,"mime_type":"image/png","magic":"PNG image data, 202 x 65, 8-bit/color RGBA, non-interlaced","md5":"1257916e9032c4a7f8541ba32e8add57","sha1":"34704fa609ce4c12ed444b4d3ad9e60bd8ebe247","sha256":"c99c4c21efe93a2f863ec1dcafde0f9fb2a533178bbf82444434cef62158fd60","sha512":"60ecbee895592a13e01099b00ef123e49e3ff9ba1439079a1a1f63878772918a66e56010afa7bb11607d0743d4404020e39cc27b22d8ffab8c70aa2c2a282f18","ssdeep":"192:KEKu5v/f0Lb5h12TiM/apermcWvVtOBKLHQBceli9A8aKUKsk/uJ37QLXG/8o2N:Kpk/O12TiWgecAB4HjCqSkckLi4","tlshash":"d572d09df6e477ba9ca325e15c86f68814ebfa0a309b2c14c210ec7a099f6c457e09c1","first_seen":"2026-05-18T02:20:43.729858Z","last_seen":"2026-09-27T15:04:32.878657Z","times_seen":6,"resource_available":false,"data":null}},"time_used":756,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":756,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/img03.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:38.070Z","timestamp":1790521418070,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/img03.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/css/style.css?1\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:38 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 11 Jun 2021 13:29:06 GMT\r\nvary: Accept-Encoding\r\netag: W/\"60c36522-121c\"\r\nexpires: Tue, 27 Oct 2026 15:03:38 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4636,"size_decoded":5437,"mime_type":"image/png","magic":"PNG image data, 60 x 42, 8-bit/color RGBA, non-interlaced","md5":"953238f91d8f7812f48fe22d32b5d36d","sha1":"006c39366bf8f1f1cc60a382cb6590c0b06b4cf9","sha256":"7180eb507a83beb0bc1e8ea17d4ccf4869e3719a0f3f9dfdc265a48eb69c83b8","sha512":"7f437b9774211ab95ee67fe2c371925c9ad7c1917118bc403a025d0c74eecbae6afeb129c232f5e9ca5a4e0f79aaade40eb9bb318e153f5c388a0845e2c4bd06","ssdeep":"96:tWecLOod2Kc3XyojRksWHH6MHJH+VZbxwR6/N:sOScHosIJyBN","tlshash":"81a16d08b604289539c4974b5ea315a3cc73e0e2db629840eed50d778f356ba2540fdb","first_seen":"2026-05-18T02:20:43.893783Z","last_seen":"2026-09-27T15:04:32.879976Z","times_seen":6,"resource_available":false,"data":null}},"time_used":629,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":629,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"lwjhnxkrk.kuixvydtrifgltby.top/widget/linkchat.1.1.0.js","fqdn":"lwjhnxkrk.kuixvydtrifgltby.top","domain":"kuixvydtrifgltby.top","tld":"top"},"ip":{"addr":"40.81.20.145","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:38.536Z","timestamp":1790521418536,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tbfhyhxbn.kuixvydtrifgltby.top","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 17 Aug 2026 03:40:05 GMT","end":"Sun, 15 Nov 2026 03:40:04 GMT"},"fingerprint":{"sha1":"D5:EA:3A:A7:28:BC:B7:29:87:8E:CF:C4:72:83:35:95:BA:57:7D:D3","sha256":"C5:D2:CD:4D:90:D7:2A:AE:75:07:2B:41:26:B7:9A:FC:A0:CC:E8:A1:71:C2:A0:FF:C0:8B:F0:EC:46:14:D2:12"}}},"request":{"raw":"GET /widget/linkchat.1.1.0.js HTTP/1.1\r\nHost: lwjhnxkrk.kuixvydtrifgltby.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-encoding: gzip\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Sun, 27 Sep 2026 13:14:55 GMT\r\netag: W/\"6422ee37-4de3\"\r\nlast-modified: Sun, 27 Sep 2026 13:14:55 GMT\r\nserver: nginx\r\nstrict-transport-security: max-age=31536000\r\nvary: Accept-Encoding\r\nx-cache: HIT, policy, disk\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19939,"size_decoded":14049,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (19912)","md5":"59b0c9f1c537544a364cc03e11815b34","sha1":"88c488181283b1ed9bf3e3c48ac056a312e47506","sha256":"afd9b6f3b5ea5286fe30818f301786af0f5c79890e873ccf2b8d0ce2c1e65fe6","sha512":"fa4961eca50806364cf62f8c817cde4dfaa9d44ac7e1a7cb7376b08a4047d9bf6f5660417872bf03b6cd0167f8987985806697c7bd5fc1f014c053ddbf2ab98e","ssdeep":"384:s/AmLO+73nnnnOGyME7k6yr3ExMdRQjFFk5o9WenZbFnIE2OeIy4jAZktY9xkSxM:s/hiannnnvTh6u3ExM3qFk69W8teh2Wa","tlshash":"dd92b034f748652ad02d407921be7a4c799a386f9b054aec30b2e5e39dfc95c3571a3c","first_seen":"2023-09-02T04:11:25Z","last_seen":"2026-09-27T15:04:32.881804Z","times_seen":42,"resource_available":true,"data":null}},"time_used":772,"timings":{"blocked":-1,"dns":119,"connect":217,"send":0,"wait":215,"receive":0,"ssl":221},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/g03.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.340Z","timestamp":1790521417340,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/g03.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 13 Sep 2024 12:41:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66e432ec-117ac\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":71596,"size_decoded":72689,"mime_type":"image/png","magic":"PNG image data, 178 x 178, 8-bit/color RGBA, non-interlaced","md5":"e2e0fd723204578b0393376bd6fe400c","sha1":"57882c0c2fd8096189bc2824d3a09e1d0b69cba5","sha256":"5b9578c308ad78423cb0cd9f78c81c839c1b289c8ebd3640f1df744005cce3a6","sha512":"e8efc8fc4e0f864d36d4135c263ed971c69148600e82bd4fb3abb78c57fc57115adb20b5cbecc37941dc4704c37e2e20d5510818491a5676009c3543413f9b0a","ssdeep":"1536:rP5NpjwrWPGGn9P0JD5mZa8veY/omBXa67l7lzKljkM5:rrpsrWZ0JD56GY/oePl7ViQE","tlshash":"95630264f79e1de7e3c01506c161b1aa1b11df48edba4d8ee7a31f13424d683615b3c9","first_seen":"2026-05-18T02:20:43.716806Z","last_seen":"2026-09-27T15:04:32.883532Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1202,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1202,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/g06.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.344Z","timestamp":1790521417344,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/g06.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 13 Sep 2024 12:46:22 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66e4341e-16223\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":90659,"size_decoded":91757,"mime_type":"image/png","magic":"PNG image data, 186 x 186, 8-bit/color RGBA, non-interlaced","md5":"1b5c15ce9279deb53a7936e40535f1b7","sha1":"66536c28df8497e074d37c2ea9876f6a494aa7ac","sha256":"d26d3615c13d1523ecb3af76c053957abd38d86c6c7edadbc9be836979bc0917","sha512":"c3d992f1c9b92b6c0584e39eb60e72eead0f2889770b0942262c9ef05f7a09516700cb1d1f4ed0bdd5d8f4cdef658dc896c065701f89c8d2331059b80d6cb500","ssdeep":"1536:28Ihy2r78yaGcfQU58jFFS+OanHTyQvzaLD+2ppor/2hpKNfEU7EJwLUJnvo:SoM78ecfByjFw+OiOFD+2p+Or8EU+w4i","tlshash":"2c9312611f93c26375dded473b2f801e8cddf7b06338a731aa43d015aaaeae49318460","first_seen":"2026-05-18T02:20:43.429177Z","last_seen":"2026-09-27T15:04:32.885176Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1200,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1200,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/undefined/0.5255518970402472","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:38.048Z","timestamp":1790521418048,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /undefined/0.5255518970402472 HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:38 GMT\r\ncontent-type: text/html\r\nvary: Accept-Encoding\r\netag: W/\"69a690eb-e3b8\"\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5193,"size_decoded":4674,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (4096)","md5":"08c3e20ee97937adcce8c335e34f6ab7","sha1":"b1fb9f46d63c6a57617d7512e126ab812200b9a9","sha256":"4d2d8d16edc9860e25d84e4a4a4c60c11463b61ec9f7c7cbcd6ae823b966a122","sha512":"8055efd1a7043e5bcbfbbcb622d5b3277750c24ba24094f181d9d008aedda737c77634a727545c3cd11ded3fc2e6856d1fd5c9da401486ef2e60a64aebd2b146","ssdeep":"96:wSOcSPZkCJ2mhSH8tICRI80e/xn5oH8EHFYAo+kRnb:vSavmhMeICO8z/d5ocLj1b","tlshash":"a4b17d62fb4e35f2631b50982d6863d9902ec47746875e7b3d013332e84e4e94ea93f9","first_seen":"2026-09-27T15:04:32.886847Z","last_seen":"2026-09-27T15:04:32.886847Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1070,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":650,"receive":420,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/banner.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:38.074Z","timestamp":1790521418074,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/banner.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/css/style.css?1\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:38 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 13 Sep 2024 14:28:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66e44c22-30ba5\"\r\nexpires: Tue, 27 Oct 2026 15:03:38 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":199589,"size_decoded":200602,"mime_type":"image/png","magic":"PNG image data, 750 x 338, 8-bit/color RGBA, non-interlaced","md5":"24bb22cbdd7639ce4248cdd1550e9a8f","sha1":"b968ee2f2bb0d4860949a1ddbe82bc69a281c752","sha256":"c0806297cd1e44a59c590083239f276f3085f0cfecd62e3bb06011fae2163303","sha512":"7e5e451d9c27335b57a9156a9e4fe18f1344e94135b20bbb97d21ca0cecd8381b2a954d0d18e9fc1a8e8b7a5b15e7b4007df142ae47875b5215f019380267d6e","ssdeep":"3072:4UNgh0ilGaFsyOXG1pp/cwn+Kpt5KQnMMUWnX0N7CCloZXV7AYSetpSqBxklAI:kJ7F/OXG1fMKn5KI5UzNPwl7AB4BWAI","tlshash":"0f1413522743b08a9e9fd100a66feb64dc7741602fb3e4066fd8d6bccac5cdc968d942","first_seen":"2026-05-18T02:20:43.244543Z","last_seen":"2026-09-27T15:04:32.889518Z","times_seen":6,"resource_available":false,"data":null}},"time_used":625,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":625,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-27T15:03:36.399Z","timestamp":1790521416399,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:36 GMT\r\ncontent-type: text/html\r\nlast-modified: Tue, 03 Mar 2026 07:52:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69a6932c-1daf\"\r\nset-cookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99; Max-Age=86400; httponly; path=/\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"server_name_session","value":"99cbab0ff1c3b1973a87337f135b5b99","quoted":false,"path":"/","max_age":86400,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"server_name_session=99cbab0ff1c3b1973a87337f135b5b99; Max-Age=86400; httponly; path=/"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery:1.8.3","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":7599,"size_decoded":3347,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"94177f46c456151c4c12784daed6103e","sha1":"7858b9b57d91ccf87145e2e2732cac55e3d0a046","sha256":"a650181ecda6de8a66e8480832cb5d02c87e764c7ae22f326e5c007a65ae08f3","sha512":"7bc77bd4c17f0a7dc33fd62cc2fb74eab020b54feefe2f179194f9e4e69afc4ef44b4a101d47cc1acd376d70b286fe3d27d0efb303bb900c876060dfcc20ccae","ssdeep":"96:uhApg8/xNKtdFNDF39FboFf7F75fVjw0uBmiKrTK8w/ZSpf+61sC5VfsT75FJA63:uhGgFT4RJ6Z/gyxO9O","tlshash":"4bf1e22359d7ab57233542c8a96a2f2c54c3020fca928f43f2ee057667dde567c1f84a","first_seen":"2026-09-27T13:09:55.952626Z","last_seen":"2026-09-27T15:04:32.890506Z","times_seen":5,"resource_available":true,"data":null}},"time_used":685,"timings":{"blocked":-1,"dns":11,"connect":213,"send":0,"wait":235,"receive":0,"ssl":226},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/yh05.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.355Z","timestamp":1790521417355,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/yh05.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 12 Sep 2024 21:58:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66e363f4-8a31\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":35377,"size_decoded":36459,"mime_type":"image/png","magic":"PNG image data, 186 x 186, 8-bit/color RGBA, non-interlaced","md5":"6194822c52a5613a1fd628deea41f73f","sha1":"57b1bca3058c80fdac74e29e3f4552be71ff961a","sha256":"f19f7cd68cc573af49f332db77093a7ff7637873fbadad793ef25d6f2e937999","sha512":"b3d660197ee794f578a1ce81ecdc488b82f3fd1d4eba92c89a1d24adce25b2e86f6ba6281272392d79645b8755c319af53fb8e6312cb5705b778272d4738bc7f","ssdeep":"768:sLOqCdxjhxPRD0Qsj3sskw/+nz004hsSAdXxMG:sLON/RLsj3sskG+nzyuXxMG","tlshash":"27f2f1edb0d1bab70184d2bcb7298509176225fdf38b3a95322613973a0f8c185b36f1","first_seen":"2026-05-18T02:20:43.890289Z","last_seen":"2026-09-27T15:04:32.891595Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1190,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1190,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gh11.top/images/yh06.png","fqdn":"gh11.top","domain":"gh11.top","tld":"top"},"ip":{"addr":"14.128.63.123","port":443,"asn":152194,"as":"CTG Server Limited","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gh11.top/","date":"2026-09-27T15:03:37.356Z","timestamp":1790521417356,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gh11.top","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 12 Sep 2026 11:09:27 GMT","end":"Fri, 11 Dec 2026 11:09:26 GMT"},"fingerprint":{"sha1":"5D:F3:7B:DA:C4:E4:D9:C8:70:20:C6:52:91:14:1A:D3:27:9D:E8:D6","sha256":"04:0B:89:3E:44:93:4D:45:26:AB:F3:74:45:73:38:D6:15:91:72:B4:0A:F9:1D:2D:3B:4F:43:5A:89:9C:89:FD"}}},"request":{"raw":"GET /images/yh06.png HTTP/1.1\r\nHost: gh11.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gh11.top/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: server_name_session=99cbab0ff1c3b1973a87337f135b5b99\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 27 Sep 2026 15:03:37 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 12 Sep 2024 21:58:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"66e363f4-81b6\"\r\nexpires: Tue, 27 Oct 2026 15:03:37 GMT\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()\r\ncontent-security-policy: default-src 'self' https: wss:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self' https:; upgrade-insecure-requests;\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncache-control: max-age=2592000, no-transform\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":33206,"size_decoded":34262,"mime_type":"image/png","magic":"PNG image data, 186 x 186, 8-bit/color RGBA, non-interlaced","md5":"65d06129df63f3617c8e719121d1d363","sha1":"f2060043a9801131e6f24f7f3390a55fb8ae96d6","sha256":"21d2b496e5e72dea99a38e4c6359503545a87039f9069e56813cae7d48f1408c","sha512":"0ca111747e7bdb2611af7ec383066d4866578527a8fe26ecf2d5c78cffced922a7bc8c6a1ca21c5b398d57346f48079c7fd1d8d0c7ce889d377885722484e8df","ssdeep":"768:kJyAsse1N2vfHDkrAVFc8LigBpGzAKrUzfAv:kJqbofjyJ820c7ILAv","tlshash":"7ee2e1dd43534e56a1b24923e2a0db4263172d2e96eb76084d7d2c40d9efedaec70b0c","first_seen":"2026-05-18T02:20:43.783771Z","last_seen":"2026-09-27T15:04:32.892319Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1190,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1190,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-27","alert":"Phishing Block","trigger":"gh11.top","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-27","alert":"Sinkholed","trigger":"gh11.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}}]}