{"report_id":"19ec950a-60c5-48cb-aaed-5a35a6dd34d2","version":6,"status":"done","tags":[],"date":"2025-10-09T13:03:06Z","url":{"schema":"http","addr":"gwch49x.top","fqdn":"gwch49x.top","domain":"gwch49x.top","tld":"top"},"ip":{"addr":"199.59.243.228","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"gwch49x.top/","fqdn":"gwch49x.top","domain":"gwch49x.top","tld":"top"},"title":"gwch49x.top"},"submit":{"url":{"schema":"http","addr":"gwch49x.top","fqdn":"gwch49x.top","domain":"gwch49x.top","tld":"top"},"ip":{"addr":"199.59.243.228","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-11-13T13:03:06Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-09","alert":"Sinkholed","trigger":"gwch49x.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-09","alert":"Sinkholed","trigger":"gwch49x.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"afs.googleusercontent.com","ip":{"addr":"142.250.74.33","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-11-17","domain_rank":65181,"first_seen":"2013-05-06T19:11:00Z","last_seen":"2025-10-05T22:16:57.741693Z","alert_count":0,"request_count":2,"received_data":2045,"sent_data":1006,"comment":"","tags":null,"fingerprints":null},{"fqdn":"syndicatedsearch.goog","ip":{"addr":"216.58.207.238","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2023-04-14","domain_rank":5365,"first_seen":"2023-09-25T09:30:59Z","last_seen":"2025-10-05T22:16:57.751046Z","alert_count":0,"request_count":4,"received_data":175534,"sent_data":3067,"comment":"","tags":null,"fingerprints":[{"name":"Google Web Server","description":"","website":"https://en.wikipedia.org/wiki/Google_Web_Server","common_platform_enumeration":"cpe:2.3:a:google:web_server:*:*:*:*:*:*:*:*","icon":"Google.svg","categories":["Web servers"]}]},{"fqdn":"gwch49x.top","ip":{"addr":"199.59.243.228","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":3710622,"first_seen":"No data","last_seen":"No data","alert_count":7,"request_count":4,"received_data":46294,"sent_data":2058,"comment":"","tags":null,"fingerprints":null},{"fqdn":"www.google.com","ip":{"addr":"216.58.207.196","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"1997-09-15","domain_rank":22,"first_seen":"2015-05-10T13:11:19Z","last_seen":"2025-10-05T22:12:06.955348Z","alert_count":0,"request_count":1,"received_data":159747,"sent_data":438,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"gwch49x.top/","fqdn":"gwch49x.top","domain":"gwch49x.top","tld":"top"},"ip":{"addr":"199.59.243.228","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"d3c1028bac5aa845caad5386662b76aa","sha1":"8c9f0e752ff08cd88e2f8198d68fe382ffa7d3f0","sha256":"303d98e4e963e0fb54f80afc4c1d2a665c862e639a32f850d406c16922d047b0","sha512":"6754c64a8e5a29f5e2afd409acb1fbf98507e39b19d16795637000d519f1a195ae39e4cd05196844f84cae53bc13fee35f5dc36d62e507b696da20a11514f7b8","ssdeep":"","tlshash":"83d027fd351e11ccf014065105faafd15be939d007d5ae45ec504c5710709eb75090df","size":289,"data":"","first_seen":"2025-10-09T13:03:11.548859Z","last_seen":"2025-10-09T13:03:11.548859Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gwch49x.top/bxPcpYQoh.js","fqdn":"gwch49x.top","domain":"gwch49x.top","tld":"top"},"ip":{"addr":"199.59.243.228","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"958df7937adfec9bc20b14b7fff891f8","sha1":"bd45611bceae0cdda0fb3c3b9445b6f0eed4995c","sha256":"40c39476fa8cec4a8d5eed23acc6c6a99d686b58eb16fff4ee199eac5f8f0619","sha512":"0586e20b3bdefe90612c16df0206fedcb048cb2bec475b01a32a3c94fabc13aaf90f44db2615bda3cf8f790ce6f063b6328b30c42f4ddc8d0f36c08ab5b1c256","ssdeep":"768:TP2y1o5VcJ7n85NdxBB5gPzGIPNMalnEE0xNE2X0Ddem+euROgvMzLXWI+6l8XOD:TualnEE0xNEGR+4M","tlshash":"98033ab23ab7e07046e2c5dae8779215f338214a3405c068f96cc8de3a5e947d73ab75","size":38577,"data":"","first_seen":"2025-08-25T22:40:35.311663Z","last_seen":"2025-10-15T16:11:44.232108Z","times_seen":35895,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.google.com/adsense/domains/caf.js?abp=1\u0026bodis=true","fqdn":"www.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"216.58.207.196","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"690c988468f7e3c66cbecef64ee1061c","sha1":"779e43e2d4b9170dd0f212e46a13870f8c7a4b15","sha256":"f85df972ec0c90713e5618dd5442a6795a769b98afd2c014ef413e7a876b32e8","sha512":"040d03752efb90e6436c0253579864fef96bfb4485ae3a6ae8b642cbe05098022097984de633cf0b9dfabdc0684f9e9c5a8b389437ab3f70d660cfed46096d06","ssdeep":"1536:wdzXuns5esCuVrLUNuEj8h7ZUwTC4zdEVKiSpxqec/V6XckzgGQNN3524a+PEuft:g4tjepDROwxdQWP6nXGrpz+PjPb","tlshash":"bef34acd73a1702243a394b4607f018fb13af865a84c88a4b199d8e47db4dad4277fbd","size":159031,"data":"","first_seen":"2025-10-06T20:55:56.693131Z","last_seen":"2025-10-10T14:49:25.333292Z","times_seen":2345,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"syndicatedsearch.goog/afs/ads?adtest=off\u0026psid=3113057640\u0026pcsa=false\u0026channel=pid-bodis-gcontrol47%2Cpid-bodis-gcontrol113%2Cpid-bodis-gcontrol452%2Cpid-bodis-gcontrol151%2Cpid-bodis-gcontrol162\u0026client=dp-bodis31_3ph\u0026r=m\u0026hl=en\u0026ivt=0\u0026rpbu=https%3A%2F%2Fgwch49x.top%2F%3Fcaf%3D1%26bpt%3D345\u0026type=3\u0026swp=as-drid-2495773305495993\u0026oe=UTF-8\u0026ie=UTF-8\u0026fexp=21404%2C17301431%2C17301433%2C17301436%2C17301548%2C17301266%2C72717108\u0026format=r3\u0026nocache=1411760014964533\u0026num=0\u0026output=afd_ads\u0026domain_name=gwch49x.top\u0026v=3\u0026bsl=8\u0026pac=0\u0026u_his=2\u0026u_tz=0\u0026dt=1760014964534\u0026u_w=1280\u0026u_h=1024\u0026biw=1280\u0026bih=1024\u0026psw=1280\u0026psh=922\u0026frm=0\u0026uio=-\u0026cont=rs\u0026drt=0\u0026jsid=caf\u0026jsv=813237002\u0026rurl=https%3A%2F%2Fgwch49x.top%2F","fqdn":"syndicatedsearch.goog","domain":"syndicatedsearch.goog","tld":"goog"},"ip":{"addr":"216.58.207.238","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"e31c6bd23c0325d7bc30cdba95f3a155","sha1":"ceb494aa0d6f0a7a020a8fa60273c404e18bbede","sha256":"b77e1575df1bf74e1828413dfbf237d1202dfa486d6d3143fb5c6e6380609efa","sha512":"e082588fb2f6234868bbc4eee015e1439a5ebd0e713ede763665412392a95fe8fe91139a1e7f84820088181accc3ad8ada59461b74654c2a26e720ed2c733558","ssdeep":"","tlshash":"e4f0c0e99c754132c56300254d0f3fe0245a1db032873545ac1efc8e207cb9ea1280ef","size":532,"data":"","first_seen":"2025-10-09T13:03:11.553004Z","last_seen":"2025-10-09T13:03:11.553004Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"syndicatedsearch.goog/adsense/domains/caf.js","fqdn":"syndicatedsearch.goog","domain":"syndicatedsearch.goog","tld":"goog"},"ip":{"addr":"216.58.207.238","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"75804794f0d6f78904b36c89a0d99df5","sha1":"4f0c83d407d2f7c5f1df6d660ad746c8e77c2027","sha256":"2b7f3e68ae809902a695123155dcadccb1d5966249fe4733b7db47ee1bfe7c1a","sha512":"cb46113966a2b90f96065481825010186d66f7f9ff09c440dd49b49a0cb76249aa94fc97b59313b0f9bac7e8f9b3c1727a1e7a80d4a7a900a9aa1ba6bc694013","ssdeep":"1536:0dzXuns5esCuVrLUNuEj8h7ZUwTC4zdEVKiSpxqec/V6XckzgGQNN3524a+PEuft:M4tjepDROwxdQWP6nXGrpz+PjPb","tlshash":"ccf34acd73a1702243a394b4607f018fb13af865a84c88a4b199d9e47db4dad4277fbd","size":159038,"data":"","first_seen":"2025-10-06T21:02:06.338355Z","last_seen":"2025-10-10T14:47:38.201668Z","times_seen":1816,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"syndicatedsearch.goog/afs/gen_204?client=dp-bodis31_3ph\u0026output=uds_ads_only\u0026zx=k00sosxpw9sv\u0026cd_fexp=72717108\u0026aqid=dLLnaO3kKPaexdwPs5m_sQs\u0026psid=3113057640\u0026pbt=bv\u0026adbx=290\u0026adby=145\u0026adbh=364\u0026adbw=700\u0026adbah=114%2C114%2C114\u0026adbn=master-1\u0026eawp=partner-dp-bodis31_3ph\u0026errv=813237002\u0026csala=5%7C0%7C278%7C59%7C7\u0026lle=0\u0026ifv=1\u0026hpt=0","fqdn":"syndicatedsearch.goog","domain":"syndicatedsearch.goog","tld":"goog"},"ip":{"addr":"216.58.207.238","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gwch49x.top/","date":"2025-10-09T13:02:46.388Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"syndicatedsearch.goog","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 15 Sep 2025 08:39:16 GMT","end":"Mon, 08 Dec 2025 08:39:15 GMT"},"fingerprint":{"sha1":"06:38:C9:AB:6C:EF:48:88:4B:DC:BA:6F:95:B8:B5:19:D9:DC:3B:43","sha256":"94:6D:D6:D8:65:56:22:30:39:89:18:F0:C9:C7:8D:72:6C:B6:67:2F:82:DC:3B:34:B5:D4:00:60:C5:36:E8:C3"}}},"request":{"raw":"GET /afs/gen_204?client=dp-bodis31_3ph\u0026output=uds_ads_only\u0026zx=k00sosxpw9sv\u0026cd_fexp=72717108\u0026aqid=dLLnaO3kKPaexdwPs5m_sQs\u0026psid=3113057640\u0026pbt=bv\u0026adbx=290\u0026adby=145\u0026adbh=364\u0026adbw=700\u0026adbah=114%2C114%2C114\u0026adbn=master-1\u0026eawp=partner-dp-bodis31_3ph\u0026errv=813237002\u0026csala=5%7C0%7C278%7C59%7C7\u0026lle=0\u0026ifv=1\u0026hpt=0 HTTP/1.1\r\nHost: syndicatedsearch.goog\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gwch49x.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 204 No Content\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-qi_4hWdwe_D5qYL9mMR2cg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other\r\ncross-origin-opener-policy: same-origin-allow-popups; report-to=\"gws\"\r\nreport-to: {\"group\":\"gws\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/gws/other\"}]}\r\ndate: Thu, 09 Oct 2025 13:02:46 GMT\r\nserver: gws\r\ncontent-length: 0\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Google Web Server","description":"","website":"https://en.wikipedia.org/wiki/Google_Web_Server","common_platform_enumeration":"cpe:2.3:a:google:web_server:*:*:*:*:*:*:*:*","icon":"Google.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-14T06:51:58.728112Z","times_seen":17882292,"resource_available":true,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gwch49x.top/","fqdn":"gwch49x.top","domain":"gwch49x.top","tld":"top"},"ip":{"addr":"199.59.243.228","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-09T13:02:43.463Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwch49x.top","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Sep 2025 05:52:45 GMT","end":"Sun, 21 Dec 2025 05:52:44 GMT"},"fingerprint":{"sha1":"ED:9A:7C:3A:2B:1A:A6:AE:FD:DC:78:39:14:37:50:D3:FA:9A:A5:68","sha256":"57:D6:11:BA:1C:B5:D7:5E:3D:22:46:3B:E3:4F:02:5C:F2:B5:69:82:2C:9D:D9:17:24:49:D5:C4:FB:B7:7A:A3"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: gwch49x.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Thu, 09 Oct 2025 13:02:43 GMT\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 1038\r\nX-Request-Id: 5f75c7a0-019d-4999-a63a-7be4b42fbf69\r\nCache-Control: no-store, max-age=0\r\nAccept-Ch: sec-ch-prefers-color-scheme\r\nCritical-Ch: sec-ch-prefers-color-scheme\r\nVary: sec-ch-prefers-color-scheme\r\nX-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Eib2phPhNyLGTQ79+eDlxwn42i7ZKeT+MFRo3u3oEfzSm+U5j8fZawYclSc2upvfozF4cbDkm2wx9Hm0jYgP/A==\r\nSet-Cookie: parking_session=5f75c7a0-019d-4999-a63a-7be4b42fbf69; expires=Thu, 09 Oct 2025 13:17:44 GMT; path=/\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1038,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (306)","md5":"8dd81c3888e27c7aa3b6a4b7fd4f3c99","sha1":"d39c5da43bdefb7f8c1a82505908cbe4136e2ab5","sha256":"077f10fcd8f13aa2ede86c9fc6abc3765c85196592f31cd572d306c500a9171a","sha512":"7b738c48e0231c05b52b76eb54afe3e02e6119f5530785991c120e64fe19088a559af286128e606e630fb0ec0b2f71e03061bb66867b94ff9e356828ebfadc50","ssdeep":"","tlshash":"4611a8751416544a70b041900df0fb084c5a378c4341ad42fdddd03758c4ed2f82e2df","first_seen":"2025-10-09T13:03:11.533086Z","last_seen":"2025-10-09T13:03:11.533086Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1134,"timings":{"blocked":547,"dns":454,"connect":1,"send":0,"wait":40,"receive":0,"ssl":90},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-09","alert":"Sinkholed","trigger":"gwch49x.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-09","alert":"Sinkholed","trigger":"gwch49x.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.google.com/adsense/domains/caf.js?abp=1\u0026bodis=true","fqdn":"www.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"216.58.207.196","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gwch49x.top/","date":"2025-10-09T13:02:44.367Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 15 Sep 2025 08:37:19 GMT","end":"Mon, 08 Dec 2025 08:37:18 GMT"},"fingerprint":{"sha1":"71:09:AD:C8:6A:D2:25:DB:C9:D9:5E:5B:C1:06:E1:0D:D6:39:D6:F0","sha256":"A9:72:F7:39:49:86:27:92:AA:EE:65:04:99:A9:0E:A8:02:70:01:E6:72:46:C2:FB:DC:5E:5E:6B:DC:B8:27:A0"}}},"request":{"raw":"GET /adsense/domains/caf.js?abp=1\u0026bodis=true HTTP/1.1\r\nHost: www.google.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gwch49x.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-type: text/javascript; charset=UTF-8\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"ads-afs-ui\"\r\nreport-to: {\"group\":\"ads-afs-ui\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/ads-afs-ui\"}]}\r\ndate: Thu, 09 Oct 2025 13:02:44 GMT\r\nexpires: Thu, 09 Oct 2025 13:02:44 GMT\r\ncache-control: private, max-age=3600\r\netag: \"9927223757342665619\"\r\nx-content-type-options: nosniff\r\nlink: \u003chttps://syndicatedsearch.goog\u003e; rel=\"preconnect\"\r\ncontent-encoding: gzip\r\nserver: sffe\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":159031,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (2840)","md5":"690c988468f7e3c66cbecef64ee1061c","sha1":"779e43e2d4b9170dd0f212e46a13870f8c7a4b15","sha256":"f85df972ec0c90713e5618dd5442a6795a769b98afd2c014ef413e7a876b32e8","sha512":"040d03752efb90e6436c0253579864fef96bfb4485ae3a6ae8b642cbe05098022097984de633cf0b9dfabdc0684f9e9c5a8b389437ab3f70d660cfed46096d06","ssdeep":"1536:wdzXuns5esCuVrLUNuEj8h7ZUwTC4zdEVKiSpxqec/V6XckzgGQNN3524a+PEuft:g4tjepDROwxdQWP6nXGrpz+PjPb","tlshash":"bef34acd73a1702243a394b4607f018fb13af865a84c88a4b199d8e47db4dad4277fbd","first_seen":"2025-10-06T20:55:56.693131Z","last_seen":"2025-10-10T14:49:25.333292Z","times_seen":2345,"resource_available":true,"data":null}},"time_used":149,"timings":{"blocked":65,"dns":1,"connect":8,"send":0,"wait":19,"receive":0,"ssl":51},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gwch49x.top/_tr","fqdn":"gwch49x.top","domain":"gwch49x.top","tld":"top"},"ip":{"addr":"199.59.243.228","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://gwch49x.top/","date":"2025-10-09T13:02:44.890Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwch49x.top","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Sep 2025 05:52:45 GMT","end":"Sun, 21 Dec 2025 05:52:44 GMT"},"fingerprint":{"sha1":"ED:9A:7C:3A:2B:1A:A6:AE:FD:DC:78:39:14:37:50:D3:FA:9A:A5:68","sha256":"57:D6:11:BA:1C:B5:D7:5E:3D:22:46:3B:E3:4F:02:5C:F2:B5:69:82:2C:9D:D9:17:24:49:D5:C4:FB:B7:7A:A3"}}},"request":{"raw":"POST /_tr HTTP/1.1\r\nHost: gwch49x.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://gwch49x.top/\r\nContent-Type: application/json\r\nContent-Length: 1877\r\nOrigin: https://gwch49x.top\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: parking_session=5f75c7a0-019d-4999-a63a-7be4b42fbf69\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Thu, 09 Oct 2025 13:02:44 GMT\r\nContent-Type: application/json; charset=utf-8\r\nContent-Length: 2\r\nX-Request-Id: dfc03f74-a6f9-419a-8ca2-ab5ed36e91c4\r\nSet-Cookie: parking_session=5f75c7a0-019d-4999-a63a-7be4b42fbf69; expires=Thu, 09 Oct 2025 13:17:44 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"444bcb3a3fcf8389296c49467f27e1d6","sha1":"7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb","sha256":"2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df","sha512":"9fbbbb5a0f329f9782e2356fa41d89cf9b3694327c1a934d6af2a9df2d7f936ce83717fb513196a4ce5548471708cd7134c2ae99b3c357bcabb2eafc7b9b7570","ssdeep":"","tlshash":"c710000000000000300000000000000000000000000000000000000000000c0000c000","first_seen":"2023-03-08T02:32:37Z","last_seen":"2026-08-14T06:53:50.621486Z","times_seen":448516,"resource_available":true,"data":null}},"time_used":39,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-09","alert":"Sinkholed","trigger":"gwch49x.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-09","alert":"Sinkholed","trigger":"gwch49x.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff","fqdn":"afs.googleusercontent.com","domain":"googleusercontent.com","tld":"com"},"ip":{"addr":"142.250.74.33","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://syndicatedsearch.goog/afs/ads?adtest=off\u0026psid=3113057640\u0026pcsa=false\u0026channel=pid-bodis-gcontrol47%2Cpid-bodis-gcontrol113%2Cpid-bodis-gcontrol452%2Cpid-bodis-gcontrol151%2Cpid-bodis-gcontrol162\u0026client=dp-bodis31_3ph\u0026r=m\u0026hl=en\u0026ivt=0\u0026rpbu=https%3A%2F%2Fgwch49x.top%2F%3Fcaf%3D1%26bpt%3D345\u0026type=3\u0026swp=as-drid-2495773305495993\u0026oe=UTF-8\u0026ie=UTF-8\u0026fexp=21404%2C17301431%2C17301433%2C17301436%2C17301548%2C17301266%2C72717108\u0026format=r3\u0026nocache=1411760014964533\u0026num=0\u0026output=afd_ads\u0026domain_name=gwch49x.top\u0026v=3\u0026bsl=8\u0026pac=0\u0026u_his=2\u0026u_tz=0\u0026dt=1760014964534\u0026u_w=1280\u0026u_h=1024\u0026biw=1280\u0026bih=1024\u0026psw=1280\u0026psh=922\u0026frm=0\u0026uio=-\u0026cont=rs\u0026drt=0\u0026jsid=caf\u0026jsv=813237002\u0026rurl=https%3A%2F%2Fgwch49x.top%2F","date":"2025-10-09T13:02:44.912Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.googleusercontent.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 15 Sep 2025 08:36:07 GMT","end":"Mon, 08 Dec 2025 08:36:06 GMT"},"fingerprint":{"sha1":"CB:ED:08:40:60:28:21:1C:F0:5E:4E:70:F4:A7:21:B3:2D:D3:A2:41","sha256":"38:2A:CC:C1:33:BE:46:EF:3F:1F:4C:37:EF:65:6F:51:FD:55:86:1E:B3:ED:83:0A:3F:26:E1:6D:19:97:C6:9B"}}},"request":{"raw":"GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff HTTP/1.1\r\nHost: afs.googleusercontent.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://syndicatedsearch.goog/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\ncontent-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers\r\ncross-origin-opener-policy: same-origin; report-to=\"afs-native-asset-managers\"\r\nreport-to: {\"group\":\"afs-native-asset-managers\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers\"}]}\r\ncontent-length: 174\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 09 Oct 2025 07:30:21 GMT\r\nexpires: Fri, 10 Oct 2025 06:30:21 GMT\r\ncache-control: public, max-age=82800\r\nage: 19943\r\nlast-modified: Thu, 02 Nov 2023 22:48:00 GMT\r\ncontent-type: image/svg+xml\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":200,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"11b3089d616633ca6b73b57aa877eeb4","sha1":"07632f63e06b30d9b63c97177d3a8122629bda9b","sha256":"809fb4619d2a2f1a85dbda8cc69a7f1659215212d708a098d62150eee57070c1","sha512":"079b0e35b479dfdbe64a987661000f4a034b10688e26f2a5fe6aaa807e81ccc5593d40609b731ab3340e687d83dd08de4b8b1e01cdac9d4523a9f6bb3acfcba0","ssdeep":"","tlshash":"d9d02291c2182d28441e82e0c37c312600fab0a2634c00dcfa80e300b20c9abb861669","first_seen":"2023-04-06T23:53:06Z","last_seen":"2026-08-07T15:03:49.92926Z","times_seen":412213,"resource_available":false,"data":null}},"time_used":118,"timings":{"blocked":55,"dns":0,"connect":7,"send":0,"wait":8,"receive":0,"ssl":45},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b","fqdn":"afs.googleusercontent.com","domain":"googleusercontent.com","tld":"com"},"ip":{"addr":"142.250.74.33","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://syndicatedsearch.goog/afs/ads?adtest=off\u0026psid=3113057640\u0026pcsa=false\u0026channel=pid-bodis-gcontrol47%2Cpid-bodis-gcontrol113%2Cpid-bodis-gcontrol452%2Cpid-bodis-gcontrol151%2Cpid-bodis-gcontrol162\u0026client=dp-bodis31_3ph\u0026r=m\u0026hl=en\u0026ivt=0\u0026rpbu=https%3A%2F%2Fgwch49x.top%2F%3Fcaf%3D1%26bpt%3D345\u0026type=3\u0026swp=as-drid-2495773305495993\u0026oe=UTF-8\u0026ie=UTF-8\u0026fexp=21404%2C17301431%2C17301433%2C17301436%2C17301548%2C17301266%2C72717108\u0026format=r3\u0026nocache=1411760014964533\u0026num=0\u0026output=afd_ads\u0026domain_name=gwch49x.top\u0026v=3\u0026bsl=8\u0026pac=0\u0026u_his=2\u0026u_tz=0\u0026dt=1760014964534\u0026u_w=1280\u0026u_h=1024\u0026biw=1280\u0026bih=1024\u0026psw=1280\u0026psh=922\u0026frm=0\u0026uio=-\u0026cont=rs\u0026drt=0\u0026jsid=caf\u0026jsv=813237002\u0026rurl=https%3A%2F%2Fgwch49x.top%2F","date":"2025-10-09T13:02:44.913Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.googleusercontent.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 15 Sep 2025 08:36:07 GMT","end":"Mon, 08 Dec 2025 08:36:06 GMT"},"fingerprint":{"sha1":"CB:ED:08:40:60:28:21:1C:F0:5E:4E:70:F4:A7:21:B3:2D:D3:A2:41","sha256":"38:2A:CC:C1:33:BE:46:EF:3F:1F:4C:37:EF:65:6F:51:FD:55:86:1E:B3:ED:83:0A:3F:26:E1:6D:19:97:C6:9B"}}},"request":{"raw":"GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%2302198b HTTP/1.1\r\nHost: afs.googleusercontent.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://syndicatedsearch.goog/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\ncontent-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers\r\ncross-origin-opener-policy: same-origin; report-to=\"afs-native-asset-managers\"\r\nreport-to: {\"group\":\"afs-native-asset-managers\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers\"}]}\r\ncontent-length: 174\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 09 Oct 2025 12:01:32 GMT\r\nexpires: Fri, 10 Oct 2025 11:01:32 GMT\r\ncache-control: public, max-age=82800\r\nlast-modified: Thu, 02 Nov 2023 22:48:00 GMT\r\ncontent-type: image/svg+xml\r\nvary: Accept-Encoding\r\nage: 3672\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":200,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d47125b2ba92be53dcff07ba322ce1de","sha1":"e4a70c8a133bacf1699fdfa4c10e24ed5b3e0c28","sha256":"5a0687ea8c9aa404a7724490f046e30023ec6b5aa81d01ae4f225889a64174f6","sha512":"78a1bf7547b1c28f600163689161955bc56a621ace3228c9169143be933ccf789fc6106bbf729f2e9483bcaa03271529d3913088094c7fb906b44673e13f1f92","ssdeep":"","tlshash":"72d02291d2286d38441e82e0c37c712200ee70a2230c10ccfa81a700720c8abb8a1668","first_seen":"2023-04-07T07:55:51Z","last_seen":"2026-02-01T02:48:24.72202Z","times_seen":175105,"resource_available":false,"data":null}},"time_used":125,"timings":{"blocked":56,"dns":3,"connect":20,"send":0,"wait":9,"receive":0,"ssl":34},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gwch49x.top/bxPcpYQoh.js","fqdn":"gwch49x.top","domain":"gwch49x.top","tld":"top"},"ip":{"addr":"199.59.243.228","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gwch49x.top/","date":"2025-10-09T13:02:44.232Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwch49x.top","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Sep 2025 05:52:45 GMT","end":"Sun, 21 Dec 2025 05:52:44 GMT"},"fingerprint":{"sha1":"ED:9A:7C:3A:2B:1A:A6:AE:FD:DC:78:39:14:37:50:D3:FA:9A:A5:68","sha256":"57:D6:11:BA:1C:B5:D7:5E:3D:22:46:3B:E3:4F:02:5C:F2:B5:69:82:2C:9D:D9:17:24:49:D5:C4:FB:B7:7A:A3"}}},"request":{"raw":"GET /bxPcpYQoh.js HTTP/1.1\r\nHost: gwch49x.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gwch49x.top/\r\nCookie: parking_session=5f75c7a0-019d-4999-a63a-7be4b42fbf69\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Thu, 09 Oct 2025 13:02:44 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nContent-Length: 38577\r\nX-Request-Id: 4bda9528-c3ef-4e81-afa7-16a47b186805\r\nSet-Cookie: parking_session=5f75c7a0-019d-4999-a63a-7be4b42fbf69; expires=Thu, 09 Oct 2025 13:17:44 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":38577,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (38574)","md5":"958df7937adfec9bc20b14b7fff891f8","sha1":"bd45611bceae0cdda0fb3c3b9445b6f0eed4995c","sha256":"40c39476fa8cec4a8d5eed23acc6c6a99d686b58eb16fff4ee199eac5f8f0619","sha512":"0586e20b3bdefe90612c16df0206fedcb048cb2bec475b01a32a3c94fabc13aaf90f44db2615bda3cf8f790ce6f063b6328b30c42f4ddc8d0f36c08ab5b1c256","ssdeep":"768:TP2y1o5VcJ7n85NdxBB5gPzGIPNMalnEE0xNE2X0Ddem+euROgvMzLXWI+6l8XOD:TualnEE0xNEGR+4M","tlshash":"98033ab23ab7e07046e2c5dae8779215f338214a3405c068f96cc8de3a5e947d73ab75","first_seen":"2025-08-25T22:40:35.311663Z","last_seen":"2025-10-15T16:11:44.232108Z","times_seen":35895,"resource_available":true,"data":null}},"time_used":41,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-09","alert":"Sinkholed","trigger":"gwch49x.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gwch49x.top/_fd","fqdn":"gwch49x.top","domain":"gwch49x.top","tld":"top"},"ip":{"addr":"199.59.243.228","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://gwch49x.top/","date":"2025-10-09T13:02:44.284Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gwch49x.top","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Sep 2025 05:52:45 GMT","end":"Sun, 21 Dec 2025 05:52:44 GMT"},"fingerprint":{"sha1":"ED:9A:7C:3A:2B:1A:A6:AE:FD:DC:78:39:14:37:50:D3:FA:9A:A5:68","sha256":"57:D6:11:BA:1C:B5:D7:5E:3D:22:46:3B:E3:4F:02:5C:F2:B5:69:82:2C:9D:D9:17:24:49:D5:C4:FB:B7:7A:A3"}}},"request":{"raw":"POST /_fd HTTP/1.1\r\nHost: gwch49x.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://gwch49x.top/\r\nContent-Type: application/json\r\nOrigin: https://gwch49x.top\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: parking_session=5f75c7a0-019d-4999-a63a-7be4b42fbf69\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Thu, 09 Oct 2025 13:02:44 GMT\r\nContent-Type: application/json; charset=utf-8\r\nContent-Length: 5157\r\nX-Request-Id: 1012d659-647f-4ff7-b7c0-466119c558c9\r\nSet-Cookie: parking_session=5f75c7a0-019d-4999-a63a-7be4b42fbf69; expires=Thu, 09 Oct 2025 13:17:44 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":5157,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"ASCII text, with very long lines (5157), with no line terminators","md5":"71bfc9d72229f557fc3155e6c7079c83","sha1":"b61689fdffbe33420d54fd1045c8785a2b980dba","sha256":"f0484df6691b2ffb985372d0dfd71f2a476c3ba491cadd6ac10ff6ab134592d3","sha512":"8576daf31469b7d67677e07abd1e7bb915a895cec6138b07a4a4dc326094c44822cb0460bb8979d741af4a5ac4fca7b5de767f25731733a9bd64d3ec1778de39","ssdeep":"96:N9K/JbzMmY1DTSSzPULGQQGJ2ITTAwSY7Oz3tvnChMhMRn:axbg91XzS/vNnqR3tvK2+n","tlshash":"a2b1a5fa5d9d389bdb43460260ce03ea175f97be22b6616d548fc6484a0d60f74d022f","first_seen":"2025-10-09T13:03:11.541455Z","last_seen":"2025-10-09T13:03:11.541455Z","times_seen":1,"resource_available":false,"data":null}},"time_used":46,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-10-09","alert":"Sinkholed","trigger":"gwch49x.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-09","alert":"Sinkholed","trigger":"gwch49x.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"syndicatedsearch.goog/afs/ads?adtest=off\u0026psid=3113057640\u0026pcsa=false\u0026channel=pid-bodis-gcontrol47%2Cpid-bodis-gcontrol113%2Cpid-bodis-gcontrol452%2Cpid-bodis-gcontrol151%2Cpid-bodis-gcontrol162\u0026client=dp-bodis31_3ph\u0026r=m\u0026hl=en\u0026ivt=0\u0026rpbu=https%3A%2F%2Fgwch49x.top%2F%3Fcaf%3D1%26bpt%3D345\u0026type=3\u0026swp=as-drid-2495773305495993\u0026oe=UTF-8\u0026ie=UTF-8\u0026fexp=21404%2C17301431%2C17301433%2C17301436%2C17301548%2C17301266%2C72717108\u0026format=r3\u0026nocache=1411760014964533\u0026num=0\u0026output=afd_ads\u0026domain_name=gwch49x.top\u0026v=3\u0026bsl=8\u0026pac=0\u0026u_his=2\u0026u_tz=0\u0026dt=1760014964534\u0026u_w=1280\u0026u_h=1024\u0026biw=1280\u0026bih=1024\u0026psw=1280\u0026psh=922\u0026frm=0\u0026uio=-\u0026cont=rs\u0026drt=0\u0026jsid=caf\u0026jsv=813237002\u0026rurl=https%3A%2F%2Fgwch49x.top%2F","fqdn":"syndicatedsearch.goog","domain":"syndicatedsearch.goog","tld":"goog"},"ip":{"addr":"216.58.207.238","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://gwch49x.top/","date":"2025-10-09T13:02:44.554Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"syndicatedsearch.goog","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 15 Sep 2025 08:39:16 GMT","end":"Mon, 08 Dec 2025 08:39:15 GMT"},"fingerprint":{"sha1":"06:38:C9:AB:6C:EF:48:88:4B:DC:BA:6F:95:B8:B5:19:D9:DC:3B:43","sha256":"94:6D:D6:D8:65:56:22:30:39:89:18:F0:C9:C7:8D:72:6C:B6:67:2F:82:DC:3B:34:B5:D4:00:60:C5:36:E8:C3"}}},"request":{"raw":"GET /afs/ads?adtest=off\u0026psid=3113057640\u0026pcsa=false\u0026channel=pid-bodis-gcontrol47%2Cpid-bodis-gcontrol113%2Cpid-bodis-gcontrol452%2Cpid-bodis-gcontrol151%2Cpid-bodis-gcontrol162\u0026client=dp-bodis31_3ph\u0026r=m\u0026hl=en\u0026ivt=0\u0026rpbu=https%3A%2F%2Fgwch49x.top%2F%3Fcaf%3D1%26bpt%3D345\u0026type=3\u0026swp=as-drid-2495773305495993\u0026oe=UTF-8\u0026ie=UTF-8\u0026fexp=21404%2C17301431%2C17301433%2C17301436%2C17301548%2C17301266%2C72717108\u0026format=r3\u0026nocache=1411760014964533\u0026num=0\u0026output=afd_ads\u0026domain_name=gwch49x.top\u0026v=3\u0026bsl=8\u0026pac=0\u0026u_his=2\u0026u_tz=0\u0026dt=1760014964534\u0026u_w=1280\u0026u_h=1024\u0026biw=1280\u0026bih=1024\u0026psw=1280\u0026psh=922\u0026frm=0\u0026uio=-\u0026cont=rs\u0026drt=0\u0026jsid=caf\u0026jsv=813237002\u0026rurl=https%3A%2F%2Fgwch49x.top%2F HTTP/1.1\r\nHost: syndicatedsearch.goog\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gwch49x.top/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-disposition: inline\r\ndate: Thu, 09 Oct 2025 13:02:44 GMT\r\nexpires: Thu, 09 Oct 2025 13:02:44 GMT\r\ncache-control: private, max-age=3600\r\ncontent-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-5irSFP98PrRRuHjQ9xRjfw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other\r\ncross-origin-opener-policy: same-origin-allow-popups; report-to=\"gws\"\r\nreport-to: {\"group\":\"gws\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/gws/other\"}]}\r\ncontent-encoding: br\r\nserver: gws\r\ncontent-length: 2821\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Web Server","description":"","website":"https://en.wikipedia.org/wiki/Google_Web_Server","common_platform_enumeration":"cpe:2.3:a:google:web_server:*:*:*:*:*:*:*:*","icon":"Google.svg","categories":["Web servers"]}],"data":{"size":13695,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (13218)","md5":"a8b674585bbec101c8c9d498788bb372","sha1":"f77da14c65af05310f1efb39c3ef6fb0d6143399","sha256":"e513cc2dc10cebd1bc2009d5843680da3f29699cc4151f122469f8f55ab081c6","sha512":"313c1d28cb964b7e8045c5a00c907c7ba806f56db40ccdebf819c346177a01db64218b004488a02285000aabbc698666329a460ee5fc665fb9aff4231420c0e6","ssdeep":"96:GE/yk2iIlb5lphMzwronbo4tm0yEM6vfNYrWJMwDbw96DNcyFMwD8w96DThHMwDa:GE12iMpgbogm0yEMcfWrSkhE8m2kZL","tlshash":"10524337706227291503ec541b296f6dd181d43ac46f36e948b35f25c7ebf828be628e","first_seen":"2025-10-09T13:03:11.543378Z","last_seen":"2025-10-09T13:03:11.543378Z","times_seen":1,"resource_available":false,"data":null}},"time_used":246,"timings":{"blocked":65,"dns":1,"connect":9,"send":0,"wait":115,"receive":0,"ssl":53},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"syndicatedsearch.goog/adsense/domains/caf.js","fqdn":"syndicatedsearch.goog","domain":"syndicatedsearch.goog","tld":"goog"},"ip":{"addr":"216.58.207.238","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://syndicatedsearch.goog/afs/ads?adtest=off\u0026psid=3113057640\u0026pcsa=false\u0026channel=pid-bodis-gcontrol47%2Cpid-bodis-gcontrol113%2Cpid-bodis-gcontrol452%2Cpid-bodis-gcontrol151%2Cpid-bodis-gcontrol162\u0026client=dp-bodis31_3ph\u0026r=m\u0026hl=en\u0026ivt=0\u0026rpbu=https%3A%2F%2Fgwch49x.top%2F%3Fcaf%3D1%26bpt%3D345\u0026type=3\u0026swp=as-drid-2495773305495993\u0026oe=UTF-8\u0026ie=UTF-8\u0026fexp=21404%2C17301431%2C17301433%2C17301436%2C17301548%2C17301266%2C72717108\u0026format=r3\u0026nocache=1411760014964533\u0026num=0\u0026output=afd_ads\u0026domain_name=gwch49x.top\u0026v=3\u0026bsl=8\u0026pac=0\u0026u_his=2\u0026u_tz=0\u0026dt=1760014964534\u0026u_w=1280\u0026u_h=1024\u0026biw=1280\u0026bih=1024\u0026psw=1280\u0026psh=922\u0026frm=0\u0026uio=-\u0026cont=rs\u0026drt=0\u0026jsid=caf\u0026jsv=813237002\u0026rurl=https%3A%2F%2Fgwch49x.top%2F","date":"2025-10-09T13:02:44.805Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"syndicatedsearch.goog","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 15 Sep 2025 08:39:16 GMT","end":"Mon, 08 Dec 2025 08:39:15 GMT"},"fingerprint":{"sha1":"06:38:C9:AB:6C:EF:48:88:4B:DC:BA:6F:95:B8:B5:19:D9:DC:3B:43","sha256":"94:6D:D6:D8:65:56:22:30:39:89:18:F0:C9:C7:8D:72:6C:B6:67:2F:82:DC:3B:34:B5:D4:00:60:C5:36:E8:C3"}}},"request":{"raw":"GET /adsense/domains/caf.js HTTP/1.1\r\nHost: syndicatedsearch.goog\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://syndicatedsearch.goog/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-type: text/javascript; charset=UTF-8\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"ads-afs-ui\"\r\nreport-to: {\"group\":\"ads-afs-ui\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/ads-afs-ui\"}]}\r\ndate: Thu, 09 Oct 2025 13:02:44 GMT\r\nexpires: Thu, 09 Oct 2025 13:02:44 GMT\r\ncache-control: private, max-age=3600\r\netag: \"17043669188516178500\"\r\nx-content-type-options: nosniff\r\nlink: \u003chttps://syndicatedsearch.goog\u003e; rel=\"preconnect\"\r\ncontent-encoding: gzip\r\nserver: sffe\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":159038,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (2840)","md5":"75804794f0d6f78904b36c89a0d99df5","sha1":"4f0c83d407d2f7c5f1df6d660ad746c8e77c2027","sha256":"2b7f3e68ae809902a695123155dcadccb1d5966249fe4733b7db47ee1bfe7c1a","sha512":"cb46113966a2b90f96065481825010186d66f7f9ff09c440dd49b49a0cb76249aa94fc97b59313b0f9bac7e8f9b3c1727a1e7a80d4a7a900a9aa1ba6bc694013","ssdeep":"1536:0dzXuns5esCuVrLUNuEj8h7ZUwTC4zdEVKiSpxqec/V6XckzgGQNN3524a+PEuft:M4tjepDROwxdQWP6nXGrpz+PjPb","tlshash":"ccf34acd73a1702243a394b4607f018fb13af865a84c88a4b199d9e47db4dad4277fbd","first_seen":"2025-10-06T21:02:06.338355Z","last_seen":"2025-10-10T14:47:38.201668Z","times_seen":1816,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":19,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"syndicatedsearch.goog/afs/gen_204?client=dp-bodis31_3ph\u0026output=uds_ads_only\u0026zx=9vj9qoj6pncq\u0026cd_fexp=72717108\u0026aqid=dLLnaO3kKPaexdwPs5m_sQs\u0026psid=3113057640\u0026pbt=bs\u0026adbx=290\u0026adby=145\u0026adbh=364\u0026adbw=700\u0026adbah=114%2C114%2C114\u0026adbn=master-1\u0026eawp=partner-dp-bodis31_3ph\u0026errv=813237002\u0026csala=5%7C0%7C278%7C59%7C7\u0026lle=0\u0026ifv=1\u0026hpt=0","fqdn":"syndicatedsearch.goog","domain":"syndicatedsearch.goog","tld":"goog"},"ip":{"addr":"216.58.207.238","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gwch49x.top/","date":"2025-10-09T13:02:46.385Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"syndicatedsearch.goog","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 15 Sep 2025 08:39:16 GMT","end":"Mon, 08 Dec 2025 08:39:15 GMT"},"fingerprint":{"sha1":"06:38:C9:AB:6C:EF:48:88:4B:DC:BA:6F:95:B8:B5:19:D9:DC:3B:43","sha256":"94:6D:D6:D8:65:56:22:30:39:89:18:F0:C9:C7:8D:72:6C:B6:67:2F:82:DC:3B:34:B5:D4:00:60:C5:36:E8:C3"}}},"request":{"raw":"GET /afs/gen_204?client=dp-bodis31_3ph\u0026output=uds_ads_only\u0026zx=9vj9qoj6pncq\u0026cd_fexp=72717108\u0026aqid=dLLnaO3kKPaexdwPs5m_sQs\u0026psid=3113057640\u0026pbt=bs\u0026adbx=290\u0026adby=145\u0026adbh=364\u0026adbw=700\u0026adbah=114%2C114%2C114\u0026adbn=master-1\u0026eawp=partner-dp-bodis31_3ph\u0026errv=813237002\u0026csala=5%7C0%7C278%7C59%7C7\u0026lle=0\u0026ifv=1\u0026hpt=0 HTTP/1.1\r\nHost: syndicatedsearch.goog\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gwch49x.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 204 No Content\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-gsfah4xe0rgAetgEY6UElg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other\r\ncross-origin-opener-policy: same-origin-allow-popups; report-to=\"gws\"\r\nreport-to: {\"group\":\"gws\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/gws/other\"}]}\r\ndate: Thu, 09 Oct 2025 13:02:46 GMT\r\nserver: gws\r\ncontent-length: 0\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Google Web Server","description":"","website":"https://en.wikipedia.org/wiki/Google_Web_Server","common_platform_enumeration":"cpe:2.3:a:google:web_server:*:*:*:*:*:*:*:*","icon":"Google.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-14T06:51:58.728112Z","times_seen":17882292,"resource_available":true,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}