{"report_id":"1def0717-4889-4fed-a00d-d74aa9ae5ccf","version":0,"status":"done","tags":[],"date":"2026-07-28T18:32:17Z","url":{"schema":"http","addr":"gxecghz.com","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":0,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"gxecghz.com/","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"title":"GCEX","dom":{"size":101999,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1044)","md5":"83e1634007ca7576e9821c455cf8eea3","sha1":"70445947c8bbbabd173a530386e3a5cdcd021c50","sha256":"46924954ed153b02dc2233bff32dc9cfd9439d3ff6b79308d4a6fc3fd740d961","sha512":"c8f5b7f2014a0694f0cad8a0ae93ff2f1a2d603fdb10815bc444ee3855743d1db1b155b119e4dd325a728da7603938130e19916a875aaf040abfbed53b4369fa","ssdeep":"768:xzJSBFbbFGFJqtlr8Wj5sAdqBkqr4SRqDlZM/eO/cNBalv/dBYHAY5KYgrY6d5JG:7KdbM/TrdFp+wTnjgyLGjg4hD+zQF","tlshash":"c9a39724b7ef042924235081af76275630f6a633da07c411bbbc1d917fcda0d6977aae","dom_hash":"domhashdaf3c4825f727567b58904227ba77ee6","first_seen":"2026-07-28T18:32:22.791312Z","last_seen":"2026-07-28T18:32:22.791312Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"gxecghz.com","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":0,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-01T18:32:17Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"gxecghz.com","ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"domain_registered":"2026-01-03","domain_rank":0,"first_seen":"2026-07-28T18:11:54.735827Z","last_seen":"2026-07-28T18:11:54.735827Z","alert_count":258,"request_count":129,"received_data":2787599,"sent_data":75272,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"ThinkPHP","description":"ThinkPHP is an open-source PHP framework with MVC structure developed and maintained by Shanghai Topthink Company.","website":"https://www.thinkphp.cn","common_platform_enumeration":"cpe:2.3:a:thinkphp:thinkphp:*:*:*:*:*:*:*:*","icon":"ThinkPHP.png","categories":["Web frameworks"]},{"name":"FlexSlider","description":"FlexSlider is a free jQuery slider plugin.","website":"https://woocommerce.com/flexslider/","common_platform_enumeration":"","icon":"FlexSlider.png","categories":["Widgets"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Bootstrap:4.5.0","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"jQuery:2.0.0","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]},{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"151.101.1.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2026-07-26T23:00:42.445991Z","alert_count":0,"request_count":3,"received_data":330380,"sent_data":1662,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-07-26T22:23:14.439231Z","alert_count":0,"request_count":1,"received_data":6147,"sent_data":524,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"gxecghz.com/","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"domTimer","is_inline":false,"md5":"3ab2caca5538cb0d5bbbc1c62d13f7dd","sha1":"035734da28a2ad336d54dca871e206a704a957b1","sha256":"b262ff426787a7fcbf77764d42656757e819f249d147999f35426eb333342cc2","sha512":"a1d47f0318a1daf6db52b421115b0e63a7d70e98ddf5f9833699a4852718b298d4996526d8df0fc035663d45d44fc9a318af8e00b806cac7ff4e738dad19d946","ssdeep":"","tlshash":"66510080c8000c00808000b82c82003020202020c00080000800808022080028a0080a","size":2549,"data":"","first_seen":"2026-04-22T18:26:39.820524Z","last_seen":"2026-07-28T19:23:40.876043Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Home/static/js/jquery.SuperSlide.2.1.1.js","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"0b9bc63ab05e21e3830da5bbb4ccee67","sha1":"d162156bdaf14217d76d920e0e57b86d8feb1d97","sha256":"349e46b2c65028736d0bbff7b829c7fc6fbdebc1fb1e8b12365a0ca2e6e9e848","sha512":"bdfa220da1f08e29f05a9984c4999d7e742bea10ad86b7e497a0d112c7992cc52b7f1e9f5430b4286f14bb2336110f85cbdc3164a92121caaf5c91961f7e69c9","ssdeep":"192:j+K3bxH+nqfhD9VUVjIItpfg5uXG3+1tSCl+7flvSXwaHxImISLTNSfYXH7Le2HE:jNcnqflKFgEWulE8REcS3j/CkR1Xh3","tlshash":"9532c65fb66635ca4597b3f1107f940d222b5965fc8a8ca0b17082c0adb9a1c243bfed","size":11264,"data":"","first_seen":"2023-04-05T11:06:31Z","last_seen":"2026-08-08T10:36:20.076762Z","times_seen":14270,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Static/bootstrap5Slide/bootstrap.bundle.min.js","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"8831aa095cdec88f66c2e46c339cf352","sha1":"5db4c40dbc6bd3d9623ee98a2061dd265885cf2e","sha256":"79d443b15f542c8a8acca8e937f2a3c90ecba78bd49fdbac6c9b878c7f1293e9","sha512":"b07f093e128951e03d3d693778e70e97c53e95f65382d0570f8d6ae9c3bfb25c311870b129c5b8e4ae283c25211c6ecd301e266ca11d75598fb935eda5b09b14","ssdeep":"1536:GaPTJR2t4PqiiyuL5FehgTr1voCBZx6wVlLBkS:4OANBZVV5","tlshash":"0f73c5493254b87309ee15a68037460bf7256d94b14b802cb5bdacde2b3dc8672b7f78","size":78748,"data":"","first_seen":"2023-03-07T01:34:42Z","last_seen":"2026-08-07T17:45:14.160774Z","times_seen":7972,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"domTimer","is_inline":false,"md5":"ec6f0514e803d311042f2037513da586","sha1":"6db1786357d8692aa41d0334b7112c18ea9ff429","sha256":"4c17044adb8e1565a98c0d5b6a468bab624c492291d4dc3d222754eba1093171","sha512":"fb1c8a75f630fd9f9f9b4400a0ddb6c67042d3af2af7afd4c05530a2911953861522e1e93562c7424d1716373ea9b490a96bdc48370dc1ed50c2e613559e67c8","ssdeep":"","tlshash":"62510080c0000820808000b80c80003020200000c080c020088280c022080028828c08","size":2539,"data":"","first_seen":"2026-04-22T18:26:39.823818Z","last_seen":"2026-07-28T19:23:40.874896Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"domTimer","is_inline":false,"md5":"e6d9f4a7a822a53d192210623dbdee1e","sha1":"157aedb38b162723125de7a1140cd780ec3ba3a7","sha256":"d7632dc5dc884c000d20cf8801f2a066b59701847c74555c1f7ecaecfc66a1b3","sha512":"61b12d5865e1b07f40cc227e7994f706619d1c26132b8d197100e8dea35d6546ade17cc07df236dd8a0703abf502d123ca7b9184891ecf9d03a3cb5832d7d46c","ssdeep":"","tlshash":"655100c0c0003c00c0c000fc0cc00000f0300000c0c0c0300c03c0c0c00c003c03cc0c","size":2552,"data":"","first_seen":"2026-04-22T18:26:39.827081Z","last_seen":"2026-07-28T19:23:40.878274Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"domTimer","is_inline":false,"md5":"b6fe158d2b791f630e7021cb11fe814c","sha1":"0b8efae5ef40c4cb36f6ac0e20929f4ee7bdcd7e","sha256":"41bbae33b51e4efabb54ffa8d9c9c9f6c24adabd11a670ec9f778597a7098632","sha512":"d0b1b343c46e7f9a314411ef04b7886314289960cecf28ba2d6ccfe71a14772283986bb87961aed3b6d4b735857a4642b129468ae802f4d07645eb0314df7159","ssdeep":"","tlshash":"ac5100c0c0000c03f0cc003c0cc0c00030300000f0c0c0300c00f0c0000c0c3c03cc0c","size":2541,"data":"","first_seen":"2026-04-22T18:26:39.819208Z","last_seen":"2026-07-28T19:23:40.875478Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"domTimer","is_inline":false,"md5":"dd88769f66853521c4eb1386fb31f5af","sha1":"f2e5b632c5fa6c667cf33cfcd7353206383044ab","sha256":"f4d545af500f264647a269ee45c099feb11c3dbc962ddcbd623b001a043f227f","sha512":"00e45cf300ad73445c7b7e5211f3d73859abd2fafb0c9c7f3bc147b392c656dcc737c7cb2b243d1cbaf7d911dcd12c55f5bd4d4ecad24bf48675df106e4c8c5b","ssdeep":"","tlshash":"635100c0c0000c03c0c0003c0fc0c00030300000c3c0c0300c03f0c0000c003c03cc0c","size":2558,"data":"","first_seen":"2026-04-22T18:26:39.83618Z","last_seen":"2026-07-28T19:23:40.878889Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"domTimer","is_inline":false,"md5":"5b802191f5c15cd7512f28978db6cab1","sha1":"99652c1b4f3bffb8472a38f83e170579f3be52ea","sha256":"a989644e59b4fff37f3049585aacdab66815b6ca932d412c94a950d4998ba2e6","sha512":"e2207946de2afdf9a5c94214e01368f422308100a8c99133ceef41fb0912ec31cb4ed3aff1b68f17c34ace11931505c45e42e9d80fa6fdf7a0da9d45bc8e57c0","ssdeep":"","tlshash":"c15100f0c0000c00c0c0303c0cc0cc0030330c00c000c0300c00f0c0000c033c00cc0c","size":2584,"data":"","first_seen":"2026-04-22T18:26:39.825331Z","last_seen":"2026-07-28T19:23:40.879408Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"domTimer","is_inline":false,"md5":"565216956bacfaf2e46213ed6b38549c","sha1":"106df23b7992e68ce57e2a1668d62c7fcff79721","sha256":"c4926aea646e632ad2bdd3a4d5668163d5f6513755e71706b3566f23f8251c40","sha512":"9ac5e100fb0c1239d821d6c5c5b8658fa316918ce4df2fad3c2da7a4b7e1327c5d9d0d29c3b3520f9b45790784fecc8da4b477e256c8c981b8241adf05ee7baa","ssdeep":"","tlshash":"6a510080c020cc00808000382cc2000220300000c00288300c008080000c823c0a8808","size":2547,"data":"","first_seen":"2026-04-22T18:26:39.831806Z","last_seen":"2026-07-28T19:23:40.876601Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Home/static/js/jquery-2.0.0.min.js","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"e22f82a5194d1f03ecb712baad2df66c","sha1":"6a9afa00acf537cbdede4aea27f01f8ef6ab165d","sha256":"ac1b82725819fba761d03c03a208214a9157bb026cc5e843d43105970407603a","sha512":"141dcfb31585ad569e19e7769d32a5544219fc1a010611337777f093b1c7143cd8de374b1b50484709a7f42fa472561bbb8976510d06f62f2cf34e3426bde0d7","ssdeep":"1536:DPEkjP+iADIOr/NEe876nmBu3HvF38NdTuJO1z6/A4TqAub0R4ULvguEhjzXpa97:oNM2Jiz6oAFKP5a98Hrq","tlshash":"f583d6d9b2c27062977734b850bf410bb17a98dab80c8c60f0a4d5e47eb4a8d517bf2d","size":84284,"data":"","first_seen":"2023-03-07T12:26:50Z","last_seen":"2026-08-02T22:23:03.310055Z","times_seen":863,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Home/static/js/layer/layer.js","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"666f4437565d197e9459e19a29f58315","sha1":"afc5c0a1369137e52b37ad5fb63f48202ce31368","sha256":"4a49651ad86a83ecbd9c2ad34e7f5c906b46ae2c4c93c1c8585148f936b7e100","sha512":"1e659ff6c47458dbbaf7e7561402c12441286c255ddec048bf654388e8666a9ceca344e166657c29fce4a08b46470b44c47e8f1c6f577adc2a4e4f4f0e7e1e90","ssdeep":"384:DQ8cuj0z4VfS7ShA3BMJOoM6bs7hwI9b4Zrxy:DQtu8CfS793QODbcI","tlshash":"5f92c85ab5503593216390a9911fa90f30f24d22eb078958f16bf1fd1ebcda562b3f0b","size":19831,"data":"","first_seen":"2023-04-11T09:52:52Z","last_seen":"2026-08-07T18:58:29.354259Z","times_seen":14226,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Static/bootstrap5Slide/scripts.js","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"48477ea73f8709a6c29d7cde0cc83e55","sha1":"5dc30fab107725dd71ab343d70b9e6267ea68cf1","sha256":"fd67e1f083236a6c171d2275401174ea62a6f24fc81193d55653080a236a209a","sha512":"0932287b99d7c96929e7464b6684fe399dfcaaea787dcab28fa0879094b5eb4d92139260fecde4ffe430eca3986430f98a72fc523332c4e476bee9ea2226b1b3","ssdeep":"","tlshash":"1ee0cd91761d4f9d1ccc3257996092c576841524e401f06790374c6c0a9584225fb7fc","size":298,"data":"","first_seen":"2023-04-25T18:57:28Z","last_seen":"2026-08-03T02:44:22.652838Z","times_seen":6173,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"domTimer","is_inline":false,"md5":"bf95500273e223863fb94c92f109146c","sha1":"31394f13102ca1469f025cffb3530836c51f85b6","sha256":"e8117162c76e2778b4dcc5f3c66b44082fd5f85ec3160e411eab35a486351a25","sha512":"ea46e24dd1b246bed230b07cfec730bff714db0f5ea4b6f81daeb2d487d4b107f7fceaf22769c6c2060feb969206f1502bc6cb8b5f07e240f8a18c4079bee46a","ssdeep":"","tlshash":"7d5100e0c08e0c22808080380cb0000220208000c8c08000080080800008002800080c","size":2563,"data":"","first_seen":"2026-04-22T18:26:39.841376Z","last_seen":"2026-07-28T19:23:40.880993Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"domTimer","is_inline":false,"md5":"230dfa9d563e8cecff99cf1ecb6d11e2","sha1":"9d5a1ea4b2b2895dedaf0d8ab2927e641e153471","sha256":"36a54f99265f3c3b8f533538c4ae1dcc8847fca78322ea6bd85a7c64e1383564","sha512":"112917bbec71614d2890ef5258af7e61cb24a54f535d768c80bb671d0acb749111368a278f645ce6a0bd4736eadc99cfb9b8f423c8b7e1645727adb0665a3eb9","ssdeep":"","tlshash":"f65100a0c0000c00808000382cc8002030288800c20880000800808220080028200c28","size":2555,"data":"","first_seen":"2026-04-22T18:26:39.834774Z","last_seen":"2026-07-28T19:23:40.879903Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"domTimer","is_inline":false,"md5":"e30daf21d3525b5f4446b5ef19870ef7","sha1":"3ac6e037cd814f4e62fe83ed40211f047f7a611a","sha256":"7350467d8eb0a43e07855cd34327dafd5fa633e30fa8e4c8fad72dddffeec33a","sha512":"65d2d0f16cbff90b850ecf866602cfd3abb1f1d365a292be4f803b008fab82f0d7809cdea79032816e5f56a5f6823936098674a86159f8ddfb35670d3f5248c8","ssdeep":"","tlshash":"32510080c0000c02808008380cb0002228280020c0a08000080880802828022aa08808","size":2572,"data":"","first_seen":"2026-07-28T18:12:12.599622Z","last_seen":"2026-07-28T19:23:40.880488Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"domTimer","is_inline":false,"md5":"dfaba8c4c964f009ffbeb47b6b4c5317","sha1":"5a10365c58d29c76332309d0804e9e731944e314","sha256":"a83fde06a2f3b1c458e18334fb432859f8a85214d2f3f56bebbb78c0550767b9","sha512":"773a3fb10a898770f4dd03a601d3fda537dbe3451d533b09d02a8e803d0707c6a2b106a1c922ca5ecb72cf28c72993fa0c4eb8f5e4a71fb7078e22382a974825","ssdeep":"","tlshash":"4e5100c0c0c0cc00c0c0003c0cc03c3030300000c000c00c0c00c0c0c00c303c000c0c","size":2572,"data":"","first_seen":"2026-07-28T18:12:12.594874Z","last_seen":"2026-07-28T19:23:40.877155Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"domTimer","is_inline":false,"md5":"f94720b69af08ae3360bd531a0eb1fd1","sha1":"770b167b7f011c0537772652ac4c3f36c229774f","sha256":"5ccc7f1e813c91b52b200512acd2a75d8cd8e8f7c6fec97b005a4a995c02c771","sha512":"36c7572137f67f9a4b278c1ec97d4448c3d99ba2d580425192e353d8dcc311dc50268c1c6a611f8faa064be4dd18f2c57fa958a5b22b9c273aa950ed9a2d15f2","ssdeep":"","tlshash":"a35100c0c00008008080003c8ca0280020200020e0008000082882800208b028000808","size":2568,"data":"","first_seen":"2026-07-28T18:12:12.591647Z","last_seen":"2026-07-28T19:23:40.877746Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Static/js/jquery.flexslider.js","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"242034cacf5d08f9a4f4df40208f830b","sha1":"56cffde8b9ca0b7e3161714b786651ac2b87a953","sha256":"487639627bd943c11e40764b968904c921e505bb73f0ae5d7367c8c8ff84a526","sha512":"fcbb4ccb030b5d9dbd4c96c44de7387ba9dd4963f14034ddb2a0ae77ef10e08167290d56565afceebd03e68a3d40d3bdceea903490e6bd0c509afa9ef034582c","ssdeep":"768:oILMsh61e6anxUS1cdeAzMuwskDkg9iPFi2PU1SFzuLdu:kynN8P1PU1SFzuLdu","tlshash":"3043ff1a61b2166589a372ae2f5fdc14eaf78343901dc969fddd030cdf4442806b6bf9","size":57384,"data":"","first_seen":"2023-03-07T17:01:43Z","last_seen":"2026-08-05T02:35:19.338928Z","times_seen":830,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"error","filename":"https://gxecghz.com/","line_number":1704,"column_number":29},{"level":"log","text":"error","filename":"https://gxecghz.com/","line_number":1704,"column_number":29},{"level":"log","text":"error","filename":"https://gxecghz.com/","line_number":1704,"column_number":29},{"level":"log","text":"error","filename":"https://gxecghz.com/","line_number":1704,"column_number":29},{"level":"log","text":"error","filename":"https://gxecghz.com/","line_number":1704,"column_number":29},{"level":"log","text":"error","filename":"https://gxecghz.com/","line_number":1704,"column_number":29}]},"http":[{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_dash","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.966Z","timestamp":1785263508966,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_dash HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 9\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":9,"data":"coin=dash"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:49 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":237,"size_decoded":551,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"90d1181b907d954c4ccb165d448ab25c","sha1":"dddb1d820ad357f22b42fb70181ef235d466724c","sha256":"ee108cbafd315dc1f08275fdd7be669871fec6d2037bf983abecf5e0149fb505","sha512":"bd5eb81d90c2fc5e1a5e1acc13460be1d0a429c229c648803c49b2013613d65e6715a027946195af9e8630ac6f16d355150e0c67abea55d109a18ab051d51d32","ssdeep":"","tlshash":"b4d05ed07af9451908229bd1a8e9372e284e04c2808246092bff9e2845aca1eb326812","first_seen":"2026-07-28T18:32:22.798759Z","last_seen":"2026-07-28T18:32:54.977099Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1888,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1888,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/xm/LTC.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.026Z","timestamp":1785263508026,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /xm/LTC.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 03 Nov 2022 15:52:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6363e3ac-c3b\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3131,"size_decoded":3505,"mime_type":"image/png","magic":"PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced","md5":"84781027c925a2d375db76b3d8ca9f3a","sha1":"7c5ae250e9e462c030e465d931744015af21d357","sha256":"03b779d3a4dad6d2c4fdcc972695892cf8d308facc05ed8bcd194cab0fc5210b","sha512":"b2ba2c600ee1942df7ac64e5dbf161f0e209fd2f008236963756ed797c463d1a15045d5d5f722f7929cd3c7496cea60a99191039eb141da3bdd8e2b465a23699","ssdeep":"","tlshash":"e5515cdaf30c1aa93ef410be4686030e4ea35d5a99e8d05800c70d77f494989ac7fb0d","first_seen":"2023-05-28T01:03:43Z","last_seen":"2026-07-28T19:23:40.824024Z","times_seen":344,"resource_available":false,"data":null}},"time_used":885,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":885,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Static/img/04.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.049Z","timestamp":1785263508049,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Static/img/04.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 27 Apr 2023 15:28:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"644a94aa-1886\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6278,"size_decoded":6653,"mime_type":"image/png","magic":"PNG image data, 166 x 166, 8-bit/color RGBA, non-interlaced","md5":"129d347ccadd5ba894e065094c2d0d2e","sha1":"66c9c7aa0580f9df7120b4a4c329a51004952a3f","sha256":"f11e4ff7def251986be5a1448f152d66e015e9cfa33badc89e8c1b6b4b8ec7ee","sha512":"6838dd37a3be23682a2d1809f3d9bce9854450048df2dbe4b40f852363932810010c481abe770f1b651cc5c2950f626d8d96e31b3d972ab62dbd8b806d1f0011","ssdeep":"96:uHcuVkytbFJuTLKo5rtW2MnVR/khwCpvBVSPTfHdSvPVjU4zuX1E:uNa4ruXLFsvOXpZVSrfHdkVjrulE","tlshash":"abd1ae14cbc1f99bdbd2152e2abd00190af1429815c27244eab76e5fa8fc4883e0d2dd","first_seen":"2025-03-15T05:55:29.531991Z","last_seen":"2026-07-28T19:23:40.854428Z","times_seen":78,"resource_available":false,"data":null}},"time_used":862,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":862,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Static/img/margin_background.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.610Z","timestamp":1785263508610,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Static/img/margin_background.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 27 Apr 2023 15:29:02 GMT\r\nvary: Accept-Encoding\r\netag: W/\"644a94be-39398\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":234392,"size_decoded":229627,"mime_type":"image/png","magic":"PNG image data, 2790 x 1144, 8-bit/color RGBA, non-interlaced","md5":"a65fa4327bd43d084905328e9a3e248a","sha1":"8d77ae6fc8c5fe40072d022ee7d6f4bc071afd0b","sha256":"e48087bc91d8faaade1a708aadc0759e6df3d9eadfcf14f28a1e5d25707342d9","sha512":"b3f299aae231ae8603b98af79a68805b2c2f1689ef95bd2d29c6844cffccc1efc4bcbd4304fd4e2fe58d097df77a91574ed948f07140f2fd6e19c762ee670b41","ssdeep":"6144:FtYMt5Si3X3IN6pg45n8A8cJUzl2BOQ4Hg57968zCHBsFU5x:FB3Hjuw8VC8mOQ4HW68TEx","tlshash":"34341266b1cd8c56d4bd48f150e9874d3ca63a9e06ad8e213ab1c684577fe2c6cb83c1","first_seen":"2025-03-15T05:55:29.56516Z","last_seen":"2026-07-28T19:23:40.844988Z","times_seen":81,"resource_available":false,"data":null}},"time_used":918,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":918,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_1inch","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:32:10.941Z","timestamp":1785263530941,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_1inch HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 10\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":10,"data":"coin=1inch"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:32:11 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":256,"size_decoded":560,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"ce45778340b0a0f15fbb0b1e464b3ba9","sha1":"fdf6c89cddd9f58e03482081a053fd1f66786d2f","sha256":"90fd1d7a73b4bf0e77f171e16a03201d3eb7bc083e6332088e1276ad7c7bf63b","sha512":"32d4abb07926c9299c93f7e4c399bbb3c773777e57f38b048e382b03f338de6af7cb0ac768d792d0f52430fbc296f749c6e5f724205392cc4c32f1643789664a","ssdeep":"","tlshash":"f3d02ba03b7944101ce1b3c168d6039d448e0541c145c2086bfd4d2cc46c50d3312811","first_seen":"2026-07-28T18:32:22.808721Z","last_seen":"2026-07-28T18:32:54.923503Z","times_seen":2,"resource_available":false,"data":null}},"time_used":330,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":330,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/bootstrap@4.5.0/dist/css/bootstrap.min.css","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.1.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:47.973Z","timestamp":1785263507973,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2026 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 20 May 2026 15:48:47 GMT","end":"Sat, 05 Dec 2026 14:48:47 GMT"},"fingerprint":{"sha1":"D4:05:C2:EC:C7:EE:2B:D0:08:68:0D:3D:33:77:48:78:43:E7:D1:E1","sha256":"ED:84:90:EE:71:BC:6B:5E:B3:D2:50:B0:23:3A:06:0D:E0:50:C6:B6:A9:09:36:E6:CE:FE:E8:66:89:EB:4E:C5"}}},"request":{"raw":"GET /npm/bootstrap@4.5.0/dist/css/bootstrap.min.css HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=31536000, s-maxage=31536000, immutable\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: text/css; charset=utf-8\r\nx-jsd-version: 4.5.0\r\nx-jsd-version-type: version\r\netag: W/\"27293-TxSgmmBsmaEfj9oVVk72b3BAKCY\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\nage: 1930854\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\nx-served-by: cache-fra-etou8220066-FRA, cache-bma-essb1270025-BMA\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 24869\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":160403,"size_decoded":25650,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (65324)","md5":"3afe15e976734d9daac26310110c4594","sha1":"4f14a09a606c99a11f8fda15564ef66f70402826","sha256":"680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c","sha512":"aced925c428148809afc07f28442b966a58508ea24d6b7203d87c63aab57df93b28ab68183a5dae0d9c12705e0a484685de5a370099c42788c869db686d0dcea","ssdeep":"1536:2THqIJOT7SyEIA1pDEBi8yNcuSEeA1/uypq3SYiLENM6HN26H:YH9vGGq3SYiLENM6HN26H","tlshash":"03f353a6f5a0312de4a7c61964d0bafd152f8245d7224bfbf8273b6447892c70a73e4c","first_seen":"2023-04-05T04:00:44Z","last_seen":"2026-08-08T06:50:40.805793Z","times_seen":25902,"resource_available":false,"data":null}},"time_used":291,"timings":{"blocked":-1,"dns":3,"connect":10,"send":0,"wait":10,"receive":29,"ssl":238},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_btc","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:54.946Z","timestamp":1785263514946,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_btc HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=btc"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:55 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":246,"size_decoded":556,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"b93f2f5f910c9be6b93d57c3ce5d38fb","sha1":"e50b72a8387fa0913f437fb8ab034cb54db6951a","sha256":"261dd32033c6fe8ba859a57111616824463a72ca52816ece064d47e8614b17ab","sha512":"4d31a4dbf7fcbb69bfd43ab269aeca2be54efc66b41a07fe00e6996da31971d717fe73c46657b3038aa16740a1331a55ba76bf10a578a59f181486c76a7ce717","ssdeep":"","tlshash":"a5d05ed0be3888291c21e3d1f8ea176e684e848680c6460a1bedcaba256910c7737822","first_seen":"2026-07-28T18:32:22.814487Z","last_seen":"2026-07-28T18:32:22.814487Z","times_seen":1,"resource_available":false,"data":null}},"time_used":331,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":331,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/xm/ETC.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.028Z","timestamp":1785263508028,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /xm/ETC.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 03 Nov 2022 15:52:11 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6363e3ab-a5d\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2653,"size_decoded":2990,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit colormap, non-interlaced","md5":"15826e5fb164bf4513d121f8c6e7c5e3","sha1":"80f6393cc2db82bbf1b7fd6a941d2e4113815a02","sha256":"f8a590615ba750a27e905a047173734c8b0c58848566adfc54d4b4bfa2d431de","sha512":"7699c10a056fdca26c633f039462370271929b5ed33a414430c93b054935c30d0bef37ee244a445e5f5cccabd4c871f8f33fef2d4e6e0e3561e4a28a06bb419c","ssdeep":"","tlshash":"24514c7ec0d3d8708c54107e5bdd8d8e9128816c339f9d48b1d49b164b0319e687e149","first_seen":"2023-05-31T10:27:17Z","last_seen":"2026-07-28T19:23:40.827397Z","times_seen":500,"resource_available":false,"data":null}},"time_used":882,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":882,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/kf.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.602Z","timestamp":1785263508602,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/kf.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 01 Aug 2023 12:36:04 GMT\r\nvary: Accept-Encoding\r\netag: W/\"64c8fc34-390c\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14604,"size_decoded":14977,"mime_type":"image/png","magic":"PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced","md5":"17d11eb3ed0a873fb39a2ed6c2d1e8b4","sha1":"01fe18d7706386bd60e4e6355c6e91753761cbc3","sha256":"d925429d915f6ee24fc67c4e8a2b4cfaec127fdd72bacb2b0f06706b3499c9c9","sha512":"3337170a5dbef72a49e8844f73d37bf731672af5315c4241b649ffc8c1568bd2ea9a008317278845b3ae69e9068d61919b2bfc52754969d54ac9e9b6c69171bb","ssdeep":"384:xbhVPI1QVjKBMR8J3JfGEe84XJPGmna4WnN1iae7Zr:1hVPIWBKQ8n+QqEmnkNT0N","tlshash":"3a62e01cab00f62c490058aee1732722de2d1f5d804549a75e2b25f97f3b6be026b3f5","first_seen":"2025-03-05T02:11:03.931384Z","last_seen":"2026-07-28T19:23:40.874424Z","times_seen":377,"resource_available":false,"data":null}},"time_used":925,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":925,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_ada","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.959Z","timestamp":1785263508959,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_ada HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=ada"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:49 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":251,"size_decoded":556,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"aa064b06456371041a8c534af4984f6f","sha1":"bb57de5f46014378b0b45404f103d4f6c20a2d51","sha256":"ad6a631a4be1584432c5d7c448b3c0bb8e3e1879a584805e3a5450744971d472","sha512":"7563af7837656a5fa2bac0a5d20d392d21ba9bdc5b3f7d89b6a89bca014871a142709ff9d511f39498c0c79ce85e662ef8125fd9ac70f784556102d886b800df","ssdeep":"","tlshash":"61d02e843b7988e60c22f3e0e8c92b6ea84c804ec081120a96ef8f249c1922c3622813","first_seen":"2026-07-28T18:32:22.822827Z","last_seen":"2026-07-28T18:32:54.934394Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1894,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1894,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_bch","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:32:02.936Z","timestamp":1785263522936,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_bch HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=bch"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:32:03 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":234,"size_decoded":549,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"bdcc4fcbaaf057fc73a0e169326d35c5","sha1":"e06526ff9357383271f10c8d2c857f4cea3d591f","sha256":"ba234e130212f6452c695752d77ac645adac38ec83ed90c947df6c5cbba149e7","sha512":"c5d6685da3be2ec33fdb968857060f71a2831089c660374ad7a85ed75fa2b971fd973f05908b7a5e42f90064820f37ed15e977d642cb0865e7f897fbc6a80431","ssdeep":"","tlshash":"ced0a7d07e7948255c36abd1b4d6571e6c8e4456c584830a1ebdcf79082c61d3323c12","first_seen":"2026-07-28T18:32:22.825959Z","last_seen":"2026-07-28T18:32:22.825959Z","times_seen":1,"resource_available":false,"data":null}},"time_used":329,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_btc","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:32:14.996Z","timestamp":1785263534996,"http_version":"","security_state":"","security_info":null,"request":{"raw":"POST /Ajaxtradenew/obtain_btc HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=btc"}},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T11:24:25.423291Z","times_seen":17778095,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/new/banner4-1.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.009Z","timestamp":1785263508009,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/new/banner4-1.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\ncontent-length: 173\r\nlast-modified: Mon, 08 May 2023 15:51:41 GMT\r\netag: \"64591a8d-ad\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":173,"size_decoded":512,"mime_type":"image/png","magic":"PNG image data, 6 x 33, 8-bit/color RGBA, non-interlaced","md5":"2653e42945c988adf2aab6f7e3289324","sha1":"39608eaf1689a30b10b9a9001ed5c70e88c8c39a","sha256":"7335286ca733e4efee02592ac0c458e4adfd116cfe1002147872a3086bcda75c","sha512":"00ee308a13377e81e585563f05301176385199aedcccca22906e5a3453dcb7cc531512a608e2d0cbb0e838a1515257c1275c184279d4335d659df50834486138","ssdeep":"","tlshash":"a2c0c0c941f0647fe04c002b260202c45cb70b6c0412080c04962420e1039c06489087","first_seen":"2025-03-15T05:55:29.528948Z","last_seen":"2026-07-28T19:23:40.861504Z","times_seen":83,"resource_available":false,"data":null}},"time_used":913,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":901,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_ltc","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.935Z","timestamp":1785263508935,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_ltc HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=ltc"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:49 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":236,"size_decoded":551,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"e2c99b063393aa2d1afe40fbe30c8a28","sha1":"318e88d6d4914c75036626367dbe53fcdd8005e9","sha256":"274ca4c071595f8eda7384b6e308955799f95a09e66af7ba578b5f6e7dd9b278","sha512":"954c9acd73bafe97850a881c56ebdecbf7b50d9a2363cb7f19b7acb722f14f27ded17c16b4df844391f235fa39e5a1a9eb045cee4a50ca7560907a1041913cc2","ssdeep":"","tlshash":"12d0a7a07f3ec5350d62a7e1a4e96f5e286d544680c4024957fd8fa5306d20d3a17c52","first_seen":"2026-07-28T18:32:22.83218Z","last_seen":"2026-07-28T18:32:22.83218Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1210,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1210,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/xm/UMA.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.032Z","timestamp":1785263508032,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /xm/UMA.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 03 Nov 2022 15:52:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6363e3ad-64a\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1610,"size_decoded":1917,"mime_type":"image/png","magic":"PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced","md5":"86655dc1b940596005b726a83c1a777a","sha1":"8abcf0da5e278a567bc8abf65e34e41df4ec8505","sha256":"0954534406237d03692e20018a64b2e116795e70d2384f0d72d2df6617950768","sha512":"b60de2aa619eefe70375f04ecd2b912fb002118ca17119434e47f1272bd79c005325b17fa53c88b14bf1b28c2bef188620762b9756216ce1d6da66ba931c0caf","ssdeep":"","tlshash":"1931e7c3a908b05f14e24e1016dbd8c7f52be8530b166c60ac07b99f6edfd84a2bcb45","first_seen":"2023-06-03T12:58:34Z","last_seen":"2026-07-28T19:23:40.82801Z","times_seen":328,"resource_available":false,"data":null}},"time_used":879,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":879,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_doge","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.932Z","timestamp":1785263508932,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_doge HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 9\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":9,"data":"coin=doge"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:49 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":252,"size_decoded":557,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"735f30e0abbe5dc413a133d897e89e8d","sha1":"2b65f8e4c07f8450b965f1d0ea169ac0cb83fa95","sha256":"3380d5e42ca26042d6615e9ad6f0ce967aa300a4ec5b121009e3581b4d44a11a","sha512":"6722225630c4eb1dcac5bd2fa419a0eacacd8bf1c1efc6b2e4e7cf2d6f466f638f74028dd99e06d91a9e6817f1b22f8a592b66f9e51bad688a9653e3515829f1","ssdeep":"","tlshash":"4dd02be0bb3844210c91a3e158d4272d554e00438180422553ff8d24852820c3919413","first_seen":"2026-07-28T18:32:22.835971Z","last_seen":"2026-07-28T18:32:22.835971Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1214,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1214,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_usdc","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.960Z","timestamp":1785263508960,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_usdc HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 9\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":9,"data":"coin=usdc"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:49 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":239,"size_decoded":548,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"32ac0a84904ac847fb43749c8849393e","sha1":"c5f8277655a75e08a392cc56cb682ec9319ddd84","sha256":"7de51d3703472f4619ec17fb08b18000f2da163e61ebaebe6351fa856b56c9d0","sha512":"b7dee101bfef5c19824cd4c30c528e55d183dd62870b38f83d109153bd1bce300356fa1f40408e33f6fac78b4b65052af5261b6e396f713b41f50632a473364c","ssdeep":"","tlshash":"fdd05ed03a3984790932d7d178d6177e684e608dc78006095abe4e3854ae26d7216922","first_seen":"2026-07-28T18:32:22.837585Z","last_seen":"2026-07-28T18:32:54.914464Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1893,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1893,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_eos","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:32:03.989Z","timestamp":1785263523989,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_eos HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=eos"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:32:04 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":25,"size_decoded":408,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"68ac40a84898f40747d958e0c0941c75","sha1":"a033ad6d2dddc4dcbabdf38740c1a8cd192dcf0d","sha256":"232ef71afd2e2d3a4a886bd164ac9ae400955e7f71505d3570e31635b2ecc00e","sha512":"0707d815ab13b1d6804fdee766d93c98b78e2ceddafbecda34f34372d1d689ada7e8777adf7264eb03a393dafa59e80ce9810cb74592580f0be1ac8ef4f453c2","ssdeep":"","tlshash":"ec70000002afa8a3028200288c0f000000ac28882ca080008c2822288a200028a00020","first_seen":"2023-05-02T21:54:45Z","last_seen":"2026-08-03T02:44:22.624109Z","times_seen":351,"resource_available":false,"data":null}},"time_used":347,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":347,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Static/img/indexP.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.010Z","timestamp":1785263508010,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Static/img/indexP.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 26 Jul 2023 14:31:38 GMT\r\nvary: Accept-Encoding\r\netag: W/\"64c12e4a-27244\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":160324,"size_decoded":156739,"mime_type":"image/png","magic":"PNG image data, 990 x 1320, 8-bit/color RGBA, non-interlaced","md5":"69a92f1afe2ba588733b9f91a0870957","sha1":"7f80a5d786fab18fe038f728f822204038f1103e","sha256":"e19e126f75a2c3520bf7633ab9ab5fb49e071f82d83a9465f9da46caa73c51ec","sha512":"b8ff35ef5972d3aa65e6c01fb3910846ac1ab6af43c70c16dcda9cd47cd31f99dadf49b3ace9fa3b6f6e129ad0a9771fcb7d42db3d8d448db9a81ed2ef1a2492","ssdeep":"3072:sHonhhgzVEoTBlYy+0LE8f+bKXrdytx0VWi5I1InamfLIq8UqLTRQLE6auxFvdt:sIwjTBdHAjsZy4VWi57fUkqLNaOuxft","tlshash":"70f312aba4b2f8381da3603195373fcb700b70171ae46aadc554ef9d7d5ae0685cc18e","first_seen":"2025-03-15T05:55:29.569873Z","last_seen":"2026-07-28T19:23:40.863115Z","times_seen":73,"resource_available":false,"data":null}},"time_used":900,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":900,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_chz","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.951Z","timestamp":1785263508951,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_chz HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=chz"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:49 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":248,"size_decoded":552,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"161657eb258df70fa0acf12544db2fa5","sha1":"5c48809c7db646a459fa243540047daaff03d9fc","sha256":"b35a696c9c7c6cd738546060db97f3d9bf1195e48e007cb8d40fa4c5c3b2413f","sha512":"87169c6ec1ea7ca997634b2020d78d951379969a37b6aba8997f823c4b0935ceb7bebbe271f5f74e7f9e0e6fe4294d5dc27e9880864e8c1f6d721ddc92e35175","ssdeep":"","tlshash":"31d097d03b3c44d8cc71e3c2bce72b2d4c4d56958481860813fe4d38556c20c3323c21","first_seen":"2026-07-28T18:32:22.84507Z","last_seen":"2026-07-28T18:32:22.84507Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1902,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1902,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_btc","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:52.948Z","timestamp":1785263512948,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_btc HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=btc"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:53 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":246,"size_decoded":556,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"b93f2f5f910c9be6b93d57c3ce5d38fb","sha1":"e50b72a8387fa0913f437fb8ab034cb54db6951a","sha256":"261dd32033c6fe8ba859a57111616824463a72ca52816ece064d47e8614b17ab","sha512":"4d31a4dbf7fcbb69bfd43ab269aeca2be54efc66b41a07fe00e6996da31971d717fe73c46657b3038aa16740a1331a55ba76bf10a578a59f181486c76a7ce717","ssdeep":"","tlshash":"a5d05ed0be3888291c21e3d1f8ea176e684e848680c6460a1bedcaba256910c7737822","first_seen":"2026-07-28T18:32:22.814487Z","last_seen":"2026-07-28T18:32:22.814487Z","times_seen":1,"resource_available":false,"data":null}},"time_used":329,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_bch","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.933Z","timestamp":1785263508933,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_bch HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=bch"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:49 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":234,"size_decoded":549,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"bdcc4fcbaaf057fc73a0e169326d35c5","sha1":"e06526ff9357383271f10c8d2c857f4cea3d591f","sha256":"ba234e130212f6452c695752d77ac645adac38ec83ed90c947df6c5cbba149e7","sha512":"c5d6685da3be2ec33fdb968857060f71a2831089c660374ad7a85ed75fa2b971fd973f05908b7a5e42f90064820f37ed15e977d642cb0865e7f897fbc6a80431","ssdeep":"","tlshash":"ced0a7d07e7948255c36abd1b4d6571e6c8e4456c584830a1ebdcf79082c61d3323c12","first_seen":"2026-07-28T18:32:22.825959Z","last_seen":"2026-07-28T18:32:22.825959Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1212,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1212,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_btc","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:32:02.990Z","timestamp":1785263522990,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_btc HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=btc"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:32:03 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":246,"size_decoded":556,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"ff21a961cc1f4a883acccaad380d9923","sha1":"a1b772fb96281c04bf7e508ed143b1fcf61207e8","sha256":"113444ca12b36c1ec52ee6e4335fa3fbfef4f1715b381535ec1b3973702aaebf","sha512":"978fd86b8bb33f5e1b6710259c94016d1f23081049d38517316515a0766d64d3ea7e1abffc7a1a5cb20b23e51a49587e564fc48c2eb42b74a9cdf45025d8cd49","ssdeep":"","tlshash":"b6d05bd07e354d151c21d3d1f4d5175f148e544644c5534a5bed8e79647920c3727812","first_seen":"2026-07-28T18:32:22.857945Z","last_seen":"2026-07-28T18:32:54.829092Z","times_seen":2,"resource_available":false,"data":null}},"time_used":329,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_eth","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:32:12.993Z","timestamp":1785263532993,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_eth HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=eth"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:32:13 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":247,"size_decoded":557,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"d97f27a167b00c2987f90b5ce8bca9b1","sha1":"2b1a53f01e62c53a1921a6748c0b53f7b2c53614","sha256":"5fb44e69a9511442d6d4aec0fe0498334fbb79a718e21230be9cd6d1086e1391","sha512":"df24ef220bb4362979ba10045b7d9a26fa45f3cf26074acbd4991c73b82923ce0db56de0927ea81e8060c3e757b45cac097e5fb3cdad8a97a460e9069d30d1e4","ssdeep":"","tlshash":"dcd02ea4be3488640ca2a3d2b8ca3f291d4e0482c08582484afe4e6814d8a0c3222ca2","first_seen":"2026-07-28T18:32:22.869869Z","last_seen":"2026-07-28T18:32:54.774253Z","times_seen":2,"resource_available":false,"data":null}},"time_used":329,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/xm/UNI.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.023Z","timestamp":1785263508023,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /xm/UNI.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 03 Nov 2022 15:52:13 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6363e3ad-d98\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3480,"size_decoded":3854,"mime_type":"image/png","magic":"PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced","md5":"05022933cd2233fd9dff586e2ff3c836","sha1":"492755f70f4072ea7e31ee85d8a72ce31b3c0334","sha256":"39d66dcc92b0d7921d64b7ad8786a5633e9d590969fa36ec338b6cc2e42ff3d6","sha512":"f7ecf237309e5dea124de18e1178066226a3d768425e3cb425dde756c7d0899e42f4453c47a0652fad10e527867e035bec8c8abc3d4c700dfb1d8f5488fb3807","ssdeep":"","tlshash":"2c716af6a80330f2eee62923c0089102800fb59269c308604f04fe6bd41adebe7d5ac2","first_seen":"2023-06-03T12:58:34Z","last_seen":"2026-07-28T19:23:40.865686Z","times_seen":345,"resource_available":false,"data":null}},"time_used":887,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":887,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Home/static/js/layer/skin/layer.css","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.676Z","timestamp":1785263508676,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Home/static/js/layer/skin/layer.css HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 04 Jul 2022 17:20:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3214c-36e0\"\r\nexpires: Wed, 29 Jul 2026 06:31:48 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14048,"size_decoded":3223,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (13967), with CRLF line terminators","md5":"1673a003559ea1607dd77e6467a4baed","sha1":"954f4afa17e3d1c057101e62950f6c9506245550","sha256":"9748f440829e0b76d70f344e9c989f6d2302eba81aeea03211d40ef5f29fe62a","sha512":"5f9b8254fe18cdc329ca87a4852b7cb5520dcf3c406c5b3d755e99d0e7ddd618cd5ca2b455868ae14d896431cea2252b60d79d5fdd9e404a1fb8685a05ceb955","ssdeep":"192:9OcW0PmLeWVNrzztBm0T9zBKgwBnsY5Cb+RX:9PW0ijV1JbTyGY5CGX","tlshash":"1c5202e144811299b0278611d6dcbeba32f88d53e5630dbef2573c1f874c6dba2b6247","first_seen":"2025-04-07T11:37:37.344268Z","last_seen":"2026-08-03T02:44:22.615907Z","times_seen":3284,"resource_available":false,"data":null}},"time_used":1090,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1090,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Static/img/10.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.056Z","timestamp":1785263508056,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Static/img/10.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 27 Apr 2023 15:28:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"644a94b2-7cc\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1996,"size_decoded":2365,"mime_type":"image/png","magic":"PNG image data, 89 x 88, 8-bit/color RGBA, non-interlaced","md5":"cbeec0f8f7153d9ada12286cd320f9ff","sha1":"2f47344e6cd3507eb1910a92b9e6b79e0cf9c38b","sha256":"23bbb31ebd8c5d2dfc6d54e09e8b1ce67e08a632cc7fce4fd19d04721bc3da6a","sha512":"4aba7ea861f215d84de679e7898e93689a57a3a9919f15b73d2ffcf8414f7639a4d852cca74065964f59e88b4804033f8c98ab87cdc3fa5b4a7671430f481605","ssdeep":"","tlshash":"1c410a492b96646aa9a1425c42c15bf5fa3e34adacd87e80edd08658f08eb2805b8658","first_seen":"2025-03-15T05:55:29.544213Z","last_seen":"2026-07-28T19:23:40.862619Z","times_seen":77,"resource_available":false,"data":null}},"time_used":855,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":855,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_trx","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.958Z","timestamp":1785263508958,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_trx HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=trx"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:49 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":255,"size_decoded":558,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"8d96274cbac5a8f70a5ea564397f2c3f","sha1":"22f314dd8f072fd10e7bbd9860790ee4cd39c3bb","sha256":"d5412401b181d1aa2f98fdf7a70bab58cdf49728afbfc0a42d2dbb78fd9d14d0","sha512":"f76c450b21cdab3d91c815172e0343d8f4fa0fafdb922b19e538a73488bd7decb5d22d3cfd517d9772542e9436494fb3d4ced5bbfc8e03e61a6a7731c003b186","ssdeep":"","tlshash":"ecd05ef47e79880905a3f7c178fa2bbe549d8482c1815f0566becf313aad60cbb15c16","first_seen":"2026-07-28T18:32:22.879336Z","last_seen":"2026-07-28T18:32:22.879336Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1895,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1895,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_bch","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:55.935Z","timestamp":1785263515935,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_bch HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=bch"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:56 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":234,"size_decoded":549,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"bdcc4fcbaaf057fc73a0e169326d35c5","sha1":"e06526ff9357383271f10c8d2c857f4cea3d591f","sha256":"ba234e130212f6452c695752d77ac645adac38ec83ed90c947df6c5cbba149e7","sha512":"c5d6685da3be2ec33fdb968857060f71a2831089c660374ad7a85ed75fa2b971fd973f05908b7a5e42f90064820f37ed15e977d642cb0865e7f897fbc6a80431","ssdeep":"","tlshash":"ced0a7d07e7948255c36abd1b4d6571e6c8e4456c584830a1ebdcf79082c61d3323c12","first_seen":"2026-07-28T18:32:22.825959Z","last_seen":"2026-07-28T18:32:22.825959Z","times_seen":1,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_ltc","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:57.957Z","timestamp":1785263517957,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_ltc HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=ltc"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:58 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":236,"size_decoded":551,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"e2c99b063393aa2d1afe40fbe30c8a28","sha1":"318e88d6d4914c75036626367dbe53fcdd8005e9","sha256":"274ca4c071595f8eda7384b6e308955799f95a09e66af7ba578b5f6e7dd9b278","sha512":"954c9acd73bafe97850a881c56ebdecbf7b50d9a2363cb7f19b7acb722f14f27ded17c16b4df844391f235fa39e5a1a9eb045cee4a50ca7560907a1041913cc2","ssdeep":"","tlshash":"12d0a7a07f3ec5350d62a7e1a4e96f5e286d544680c4024957fd8fa5306d20d3a17c52","first_seen":"2026-07-28T18:32:22.83218Z","last_seen":"2026-07-28T18:32:22.83218Z","times_seen":1,"resource_available":false,"data":null}},"time_used":334,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":334,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_doge","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:58.988Z","timestamp":1785263518988,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_doge HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 9\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":9,"data":"coin=doge"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:59 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":252,"size_decoded":557,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"735f30e0abbe5dc413a133d897e89e8d","sha1":"2b65f8e4c07f8450b965f1d0ea169ac0cb83fa95","sha256":"3380d5e42ca26042d6615e9ad6f0ce967aa300a4ec5b121009e3581b4d44a11a","sha512":"6722225630c4eb1dcac5bd2fa419a0eacacd8bf1c1efc6b2e4e7cf2d6f466f638f74028dd99e06d91a9e6817f1b22f8a592b66f9e51bad688a9653e3515829f1","ssdeep":"","tlshash":"4dd02be0bb3844210c91a3e158d4272d554e00438180422553ff8d24852820c3919413","first_seen":"2026-07-28T18:32:22.835971Z","last_seen":"2026-07-28T18:32:22.835971Z","times_seen":1,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Static/bootstrap5Slide/bootstrap.min.css","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:47.979Z","timestamp":1785263507979,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Static/bootstrap5Slide/bootstrap.min.css HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 04 Jul 2022 17:20:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3214c-2f0fa\"\r\nexpires: Wed, 29 Jul 2026 06:31:48 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":192762,"size_decoded":27355,"mime_type":"text/css","magic":"ASCII text, with very long lines (65184)","md5":"cb46b85888b78de64c1f51bc7797aacb","sha1":"e57147e69810b9ee63af657969ddfd6c456957e3","sha256":"652650f2c09a63e822932e07d79583c64a996e44ff680e2a9183c2a7c5b2531e","sha512":"cdf48d3e0b60cd162995316ce921e3285248d481378251f13403c39302baba3efe6332a537cccf255e2261b8c39d719ab1a9efd83e97111ed321e11dd0eefdb1","ssdeep":"1536:rQGFA+QbGwz48MIEtQ12c2Jsj+aeHYAVmJz600I40Yw:rQGqAVmJz600I40Yw","tlshash":"311492a7f581201ee493c10995d2bffe057f9586d3021baaf42737b44b452eb8a63e4c","first_seen":"2023-04-25T18:57:28Z","last_seen":"2026-07-28T19:23:40.84948Z","times_seen":3304,"resource_available":false,"data":null}},"time_used":321,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":321,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_btc","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:56.949Z","timestamp":1785263516949,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_btc HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=btc"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:57 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":246,"size_decoded":556,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"b93f2f5f910c9be6b93d57c3ce5d38fb","sha1":"e50b72a8387fa0913f437fb8ab034cb54db6951a","sha256":"261dd32033c6fe8ba859a57111616824463a72ca52816ece064d47e8614b17ab","sha512":"4d31a4dbf7fcbb69bfd43ab269aeca2be54efc66b41a07fe00e6996da31971d717fe73c46657b3038aa16740a1331a55ba76bf10a578a59f181486c76a7ce717","ssdeep":"","tlshash":"a5d05ed0be3888291c21e3d1f8ea176e684e848680c6460a1bedcaba256910c7737822","first_seen":"2026-07-28T18:32:22.814487Z","last_seen":"2026-07-28T18:32:22.814487Z","times_seen":1,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/new/1.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.012Z","timestamp":1785263508012,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/new/1.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 19 Aug 2025 07:15:33 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68a42495-2c9e6\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":182758,"size_decoded":182724,"mime_type":"image/png","magic":"PNG image data, 856 x 400, 8-bit/color RGBA, non-interlaced","md5":"d6edaabf7cc4eaee8b42ffb6096d45e4","sha1":"7c05196cc41fa42552dd635ec828e253742bc4a9","sha256":"d50fa7953c5ad30e42a9e9fd44b9ddf1222ea52646ab6251ea0de841f57c1122","sha512":"4e1f5b9012d8c3d98579158677e054610e3ca1123f7ba937325b85bc7fd03f820cb2f1fb84ab9b4b0ad54a4081bae7a496112efdf15b3bdeb830db421f809d49","ssdeep":"3072:oF608QzKuOSgaNYOlyJCJa+Yf2K3rjRcDiYtldI5tmAEkBUwCxe2i8Zv:o41QeuCROleCJahjutldI5tmwpCxaO","tlshash":"ba042351f5ce24a28642c050cf0979bfb72cbb131fe62618ec4999918bffc5e314ab58","first_seen":"2025-08-19T12:54:30.835112Z","last_seen":"2026-07-28T19:23:40.82126Z","times_seen":16,"resource_available":false,"data":null}},"time_used":897,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":897,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Static/img/07.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.053Z","timestamp":1785263508053,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Static/img/07.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 27 Apr 2023 15:28:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"644a94ae-746\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1862,"size_decoded":2231,"mime_type":"image/png","magic":"PNG image data, 88 x 88, 8-bit/color RGBA, non-interlaced","md5":"68d2998f48a4c12d128c3d1ad70b9a90","sha1":"381d95fe09181d30538ff1c9c5c0e7afd8a095bd","sha256":"ff62b0065cd9d07202222399a26977e59452771a0ec9e6abc21f2abb7ee558ba","sha512":"1533ed2c1f21ce53861cf40afdb54bfed134eeca2bd32262ed99194418898c797827425ba8563c4e81b36d1a242357788e2afd1cc2f6531c77945ee53a017054","ssdeep":"","tlshash":"b331f9c27bc09faeccd18707d9f8c95d5e3269ba884627405d73b106de0d4560fb8a51","first_seen":"2025-03-15T05:55:29.536588Z","last_seen":"2026-07-28T19:23:40.860397Z","times_seen":77,"resource_available":false,"data":null}},"time_used":859,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":859,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_doge","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:32:03.988Z","timestamp":1785263523988,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_doge HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 9\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":9,"data":"coin=doge"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:32:04 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":252,"size_decoded":557,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"4080c9a926588a18f9de15b8488b1fc1","sha1":"20b2bccf001dc5ae65a3863ecb1f26b3df71b8a7","sha256":"0fae26ce7d87e04420b95b1f50ed39745e569810e80be7fff8ed8af36247dd9c","sha512":"9be386950aac7fc69201007225208d3523c95c9c168b8b8967f6cefba3d39ee099313679c50d91d11508b201d01d65b517cc4803a15bf959fa0cdb3421be3063","ssdeep":"","tlshash":"84d095e0ff7c40110c51a7e168e4372d548d00c3c0c0073967fe8d24851830c3e16823","first_seen":"2026-07-28T18:32:22.884115Z","last_seen":"2026-07-28T18:32:54.791749Z","times_seen":2,"resource_available":false,"data":null}},"time_used":335,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":335,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_btc","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:32:08.998Z","timestamp":1785263528998,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_btc HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=btc"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:32:09 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":246,"size_decoded":556,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"ff21a961cc1f4a883acccaad380d9923","sha1":"a1b772fb96281c04bf7e508ed143b1fcf61207e8","sha256":"113444ca12b36c1ec52ee6e4335fa3fbfef4f1715b381535ec1b3973702aaebf","sha512":"978fd86b8bb33f5e1b6710259c94016d1f23081049d38517316515a0766d64d3ea7e1abffc7a1a5cb20b23e51a49587e564fc48c2eb42b74a9cdf45025d8cd49","ssdeep":"","tlshash":"b6d05bd07e354d151c21d3d1f4d5175f148e544644c5534a5bed8e79647920c3727812","first_seen":"2026-07-28T18:32:22.857945Z","last_seen":"2026-07-28T18:32:54.829092Z","times_seen":2,"resource_available":false,"data":null}},"time_used":332,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":332,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-28T18:31:45.513Z","timestamp":1785263505513,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:47 GMT\r\ncontent-type: text/html; charset=utf8mb4\r\nvary: Accept-Encoding\r\nset-cookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7; path=/\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\npragma: no-cache\r\ncache-control: private\r\nx-powered-by: ThinkPHP\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"ThinkPHP","description":"ThinkPHP is an open-source PHP framework with MVC structure developed and maintained by Shanghai Topthink Company.","website":"https://www.thinkphp.cn","common_platform_enumeration":"cpe:2.3:a:thinkphp:thinkphp:*:*:*:*:*:*:*:*","icon":"ThinkPHP.png","categories":["Web frameworks"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"FlexSlider","description":"FlexSlider is a free jQuery slider plugin.","website":"https://woocommerce.com/flexslider/","common_platform_enumeration":"","icon":"FlexSlider.png","categories":["Widgets"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Bootstrap:4.5.0","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"jQuery:2.0.0","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}],"data":{"size":98142,"size_decoded":15979,"mime_type":"text/html; charset=utf8mb4","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1018)","md5":"35d2d08877e64646b940635a832e06a4","sha1":"c600a5071fb282dfe6e770be94d25e375b1e88d0","sha256":"3a81e18e62a6db448e0db6d9dd4f250450e3b53a3898dd09cd2dc0a870e57421","sha512":"50451ce9072d5103bc9a9214c85f9646c0d78f7742726cc905dd669917d70d25b4b62dc0eaf689d54f986f42478db2c3aa50503291ae9805acc184760c274384","ssdeep":"768:Nz5SBFbbFGFAtlr8We5sAdqBkiwESRqDlZA/zO/jRAalv/dBYHAY5KYgrY6d5JUa:vKdbM8wwFjAKj+yLGjg4hD+zQ0","tlshash":"d4a39524b7ef0429341360409f79265630faa633ca06c425bebc2d517fcd94da977aee","first_seen":"2026-07-08T15:20:42.090445Z","last_seen":"2026-07-28T19:23:40.838027Z","times_seen":9,"resource_available":true,"data":null}},"time_used":2064,"timings":{"blocked":0,"dns":541,"connect":305,"send":0,"wait":614,"receive":0,"ssl":604},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_fil","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.941Z","timestamp":1785263508941,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_fil HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=fil"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:49 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":237,"size_decoded":550,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"6da9801568182c6a5fe634f076bfe48a","sha1":"0b466cd476982c17fe568704ef3b9602b4a61804","sha256":"7bb0398b30ccff9705f8d28ef3e38d895a432821392991c4d8069ca9515092de","sha512":"8432f4d1dedb5c9ca84a574a70e56dc96586dd94168d7f0775217e88704982748edc1ea72b364eb73cc75592f2fabada5e5fe051aa1495b232507585c448d9a7","ssdeep":"","tlshash":"93d0a7d03f3984297c32f3d268e9175d5dde4c468480420996ff8fb854ac62e3272866","first_seen":"2026-07-28T18:32:22.887019Z","last_seen":"2026-07-28T18:32:54.813717Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1912,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1912,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_bal","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.950Z","timestamp":1785263508950,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_bal HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=bal"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:49 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":226,"size_decoded":531,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"6e5fd991b7c2fbe5303a5e7f8ef10978","sha1":"a86f97ebc10ce4d9b966330cd38411441c74622c","sha256":"04e989b2f6b77a355d854d829af6c1df5869d53fe6660fdd1071132c242ea113","sha512":"4dd9422feebcdff43bfa837761fec3f2f1ee1abddc680a3e3dcc095a34b63adfd6d56d92a46b001336764b2307f2b295dc6dfa51265ffc96b0bb49d009c36b6b","ssdeep":"","tlshash":"0ad0a7f03d3804115da167c16ce727bb548c84448080d30697bdce65156c5097337c11","first_seen":"2026-07-28T18:12:12.551844Z","last_seen":"2026-07-28T19:23:40.867944Z","times_seen":8,"resource_available":false,"data":null}},"time_used":1903,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1903,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Home/static/js/layer/layer.js","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:47.992Z","timestamp":1785263507992,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Home/static/js/layer/layer.js HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 04 Jul 2022 17:20:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3214c-4d83\"\r\nexpires: Wed, 29 Jul 2026 06:31:48 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19843,"size_decoded":7326,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (19752)","md5":"666f4437565d197e9459e19a29f58315","sha1":"afc5c0a1369137e52b37ad5fb63f48202ce31368","sha256":"4a49651ad86a83ecbd9c2ad34e7f5c906b46ae2c4c93c1c8585148f936b7e100","sha512":"1e659ff6c47458dbbaf7e7561402c12441286c255ddec048bf654388e8666a9ceca344e166657c29fce4a08b46470b44c47e8f1c6f577adc2a4e4f4f0e7e1e90","ssdeep":"384:DQ8cuj0z4VfS7ShA3BMJOoM6bs7hwI9b4Zrxy:DQtu8CfS793QODbcI","tlshash":"5f92c85ab5503593216390a9911fa90f30f24d22eb078958f16bf1fd1ebcda562b3f0b","first_seen":"2023-04-11T09:52:52Z","last_seen":"2026-08-07T18:58:29.354259Z","times_seen":14226,"resource_available":true,"data":null}},"time_used":627,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":627,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Home/static/js/jquery.SuperSlide.2.1.1.js","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:47.993Z","timestamp":1785263507993,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Home/static/js/jquery.SuperSlide.2.1.1.js HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 04 Jul 2022 17:20:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3214c-2c9e\"\r\nexpires: Wed, 29 Jul 2026 06:31:48 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11422,"size_decoded":4062,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (10855), with CRLF line terminators","md5":"0b9bc63ab05e21e3830da5bbb4ccee67","sha1":"d162156bdaf14217d76d920e0e57b86d8feb1d97","sha256":"349e46b2c65028736d0bbff7b829c7fc6fbdebc1fb1e8b12365a0ca2e6e9e848","sha512":"bdfa220da1f08e29f05a9984c4999d7e742bea10ad86b7e497a0d112c7992cc52b7f1e9f5430b4286f14bb2336110f85cbdc3164a92121caaf5c91961f7e69c9","ssdeep":"192:j+K3bxH+nqfhD9VUVjIItpfg5uXG3+1tSCl+7flvSXwaHxImISLTNSfYXH7Le2HE:jNcnqflKFgEWulE8REcS3j/CkR1Xh3","tlshash":"9532c65fb66635ca4597b3f1107f940d222b5965fc8a8ca0b17082c0adb9a1c243bfed","first_seen":"2023-04-05T11:06:31Z","last_seen":"2026-08-08T10:36:20.076762Z","times_seen":14270,"resource_available":true,"data":null}},"time_used":631,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":631,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_bsv","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.964Z","timestamp":1785263508964,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_bsv HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=bsv"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:49 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":245,"size_decoded":552,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"b5c205abe48be6bad878e9c9c3bbebb4","sha1":"5ced55591256fcf6bdfa33f21022b02d673e55a5","sha256":"9d3333d67167cc2062b1c4d44ceafafa5c9413c6ebd28b6cbd0141a7caa22a04","sha512":"2db63bee4ebfe2e13ee3546304e5de1cb796a363d9bd0604cb779b3aa725fb300444c9dbe261550736d2a1f22f2c222a2eb18c575f95913cf4ca376733693fc1","ssdeep":"","tlshash":"56d0a7f83e74081904a39bc27cf61b7a15dc9841d18143046befceb1379c929f217c1a","first_seen":"2026-07-28T18:32:22.891739Z","last_seen":"2026-07-28T18:32:22.891739Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1889,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1889,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Static/bootstrap5Slide/fonts/flexslider-icon.ttf","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:51.340Z","timestamp":1785263511340,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Static/bootstrap5Slide/fonts/flexslider-icon.ttf HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/Public/Static/bootstrap5Slide/flexslider.css\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:51 GMT\r\ncontent-type: text/html\r\ncontent-length: 504\r\netag: \"66541f8f-1f8\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":504,"size_decoded":659,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"b7f6c24fcd751e5a437f9a3700aa7074","sha1":"7462bb1e33a7a761363945ff31ff3e2b3a58c04e","sha256":"d7ee9daf35876b1fd867a1bff334dd0a2bf441f47b2cb3b8c4b7e33723d58678","sha512":"0af608e297389b14ff920bdc9335b777dd8314abe14da03627c62cf672b4218c47f7a91de98bd4e59e0b978c1f9ec1cb6ba2758542e51b0044b7972a486b8cfb","ssdeep":"","tlshash":"54f09e8340e14429111041302e9060054f4b7d8bdb5b4d0138afb1bbefc6a84c5635cc","first_seen":"2024-12-24T17:17:56.68958Z","last_seen":"2026-07-28T19:23:40.836319Z","times_seen":84,"resource_available":false,"data":null}},"time_used":320,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":320,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_eos","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:58.992Z","timestamp":1785263518992,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_eos HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=eos"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:59 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":25,"size_decoded":408,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"68ac40a84898f40747d958e0c0941c75","sha1":"a033ad6d2dddc4dcbabdf38740c1a8cd192dcf0d","sha256":"232ef71afd2e2d3a4a886bd164ac9ae400955e7f71505d3570e31635b2ecc00e","sha512":"0707d815ab13b1d6804fdee766d93c98b78e2ceddafbecda34f34372d1d689ada7e8777adf7264eb03a393dafa59e80ce9810cb74592580f0be1ac8ef4f453c2","ssdeep":"","tlshash":"ec70000002afa8a3028200288c0f000000ac28882ca080008c2822288a200028a00020","first_seen":"2023-05-02T21:54:45Z","last_seen":"2026-08-03T02:44:22.624109Z","times_seen":351,"resource_available":false,"data":null}},"time_used":333,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":333,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_eth","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:32:06.993Z","timestamp":1785263526993,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_eth HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=eth"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:32:07 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":247,"size_decoded":557,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"d97f27a167b00c2987f90b5ce8bca9b1","sha1":"2b1a53f01e62c53a1921a6748c0b53f7b2c53614","sha256":"5fb44e69a9511442d6d4aec0fe0498334fbb79a718e21230be9cd6d1086e1391","sha512":"df24ef220bb4362979ba10045b7d9a26fa45f3cf26074acbd4991c73b82923ce0db56de0927ea81e8060c3e757b45cac097e5fb3cdad8a97a460e9069d30d1e4","ssdeep":"","tlshash":"dcd02ea4be3488640ca2a3d2b8ca3f291d4e0482c08582484afe4e6814d8a0c3222ca2","first_seen":"2026-07-28T18:32:22.869869Z","last_seen":"2026-07-28T18:32:54.774253Z","times_seen":2,"resource_available":false,"data":null}},"time_used":330,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":330,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_eos","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:32:08.997Z","timestamp":1785263528997,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_eos HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=eos"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:32:09 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":25,"size_decoded":408,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"68ac40a84898f40747d958e0c0941c75","sha1":"a033ad6d2dddc4dcbabdf38740c1a8cd192dcf0d","sha256":"232ef71afd2e2d3a4a886bd164ac9ae400955e7f71505d3570e31635b2ecc00e","sha512":"0707d815ab13b1d6804fdee766d93c98b78e2ceddafbecda34f34372d1d689ada7e8777adf7264eb03a393dafa59e80ce9810cb74592580f0be1ac8ef4f453c2","ssdeep":"","tlshash":"ec70000002afa8a3028200288c0f000000ac28882ca080008c2822288a200028a00020","first_seen":"2023-05-02T21:54:45Z","last_seen":"2026-08-03T02:44:22.624109Z","times_seen":351,"resource_available":false,"data":null}},"time_used":342,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":342,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/xm/dash.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.044Z","timestamp":1785263508044,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /xm/dash.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 04 May 2023 07:53:06 GMT\r\nvary: Accept-Encoding\r\netag: W/\"64536462-e44\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3652,"size_decoded":4026,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit colormap, non-interlaced","md5":"d9ae624ec75f54e7a472e706c50f6171","sha1":"8f1595d2790ab5212dad31ae8e825929abf4b90c","sha256":"b064ad396c5b7bc48b0a1c14743d779d468486fddfd41fee9a740f7a416f89b9","sha512":"9d887e629e815f75cea198674023d507e52245932594bff5be082e1b535fae19f4dcdf6c54cb72bef6bdcbac605df7deb0662b365213c498033693c62f798902","ssdeep":"","tlshash":"35716d29ad337c98fca805e1d283a01ac97b653ac04d9dd353ed753b404a058a7c768f","first_seen":"2024-10-23T13:33:33.371625Z","last_seen":"2026-07-28T19:23:40.856852Z","times_seen":233,"resource_available":false,"data":null}},"time_used":867,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":867,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Static/img/indexbg.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.607Z","timestamp":1785263508607,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Static/img/indexbg.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 26 Jul 2023 14:31:35 GMT\r\nvary: Accept-Encoding\r\netag: W/\"64c12e47-136a8\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":79528,"size_decoded":69432,"mime_type":"image/png","magic":"PNG image data, 3840 x 1200, 8-bit/color RGBA, non-interlaced","md5":"904e6661e9d634a8dfc9912271119428","sha1":"61935df66dfb1bd6dea41ac7e8aec64f28994a17","sha256":"666f335115a73061107ae4ae905e05a80401c6eb453d75bdc1b1adef925c0047","sha512":"cba2515d59a8b2cc91621deea0e1967ddb4b754caee9be1f0f2e9b00e81932a37861208b0d6af168457167993c7583c9aa5b225fa3956caa3548ca66c5a8f5d0","ssdeep":"1536:pkWb2/hO6MJ7TzqrNeDHvs7LW/X05tdmL/ZU/KQ:pko6szqrNeDHvs7LlLH/KQ","tlshash":"1673d0bd9e774ac8f87841be3a3f0f7576240d960840031653bafd71edaade98a424d4","first_seen":"2025-03-15T05:55:29.537323Z","last_seen":"2026-07-28T19:23:40.857573Z","times_seen":81,"resource_available":false,"data":null}},"time_used":921,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":921,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_dot","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.962Z","timestamp":1785263508962,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_dot HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=dot"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:49 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":237,"size_decoded":546,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"d654e8ff0f225a9690859f3ea51523b0","sha1":"905b6a4f3f29d90a94e763b66d1eb60730f45e67","sha256":"a187caba4e46379b34d314c7b90b0b4f1772e7e4f6cb6c31764e98e7e078119b","sha512":"67329c2cb118a87193c998afe9ef7b71ff69c741c5baa383b8d83e03402b8047182a9b23bd8af89f752d709af96c70d2c4455f9c2abc4edd4c739fd8b7f8e013","ssdeep":"","tlshash":"0fd0a7e47f7844260ca6e7e1b8fa2b7d148d4445c5c8430916fe8e2c1628a1d3221817","first_seen":"2026-07-28T18:32:22.897269Z","last_seen":"2026-07-28T18:32:55.001146Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1891,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1891,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_xrp","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:32:11.005Z","timestamp":1785263531005,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_xrp HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=xrp"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:32:11 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":246,"size_decoded":556,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"5ab098bfc59655fe97db9e6f1a8df19a","sha1":"0e7e499d41f7b2120de088e35a9bc3a904fe4b94","sha256":"c32d260fce7f43427059dfa79f7cdc5fa87281d03162fdea808f5ceca74f2321","sha512":"45f0b80caa8cb2132a85ed86d73225c84b29c7bdb355c7c7531cc10bf16476b48356eb23c60d568b3a3e0da9e68edbfc63999c2ab785429f9b18cd62c52a9b3a","ssdeep":"","tlshash":"c9d05ea07b7944290863e7d5bcdb6bbeac6d40468480060916ee4f3854eea3d3326c22","first_seen":"2026-07-28T18:32:22.900739Z","last_seen":"2026-07-28T18:32:54.820346Z","times_seen":2,"resource_available":false,"data":null}},"time_used":334,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":334,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_doge","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:32:13.994Z","timestamp":1785263533994,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_doge HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 9\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":9,"data":"coin=doge"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:32:14 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":252,"size_decoded":557,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"4080c9a926588a18f9de15b8488b1fc1","sha1":"20b2bccf001dc5ae65a3863ecb1f26b3df71b8a7","sha256":"0fae26ce7d87e04420b95b1f50ed39745e569810e80be7fff8ed8af36247dd9c","sha512":"9be386950aac7fc69201007225208d3523c95c9c168b8b8967f6cefba3d39ee099313679c50d91d11508b201d01d65b517cc4803a15bf959fa0cdb3421be3063","ssdeep":"","tlshash":"84d095e0ff7c40110c51a7e168e4372d548d00c3c0c0073967fe8d24851830c3e16823","first_seen":"2026-07-28T18:32:22.884115Z","last_seen":"2026-07-28T18:32:54.791749Z","times_seen":2,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Home/static/js/jquery-2.0.0.min.js","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:47.991Z","timestamp":1785263507991,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Home/static/js/jquery-2.0.0.min.js HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sun, 06 Nov 2022 06:04:49 GMT\r\nvary: Accept-Encoding\r\netag: W/\"63674e81-1493c\"\r\nexpires: Wed, 29 Jul 2026 06:31:48 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":84284,"size_decoded":30137,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (32061), with CRLF line terminators","md5":"e22f82a5194d1f03ecb712baad2df66c","sha1":"6a9afa00acf537cbdede4aea27f01f8ef6ab165d","sha256":"ac1b82725819fba761d03c03a208214a9157bb026cc5e843d43105970407603a","sha512":"141dcfb31585ad569e19e7769d32a5544219fc1a010611337777f093b1c7143cd8de374b1b50484709a7f42fa472561bbb8976510d06f62f2cf34e3426bde0d7","ssdeep":"1536:DPEkjP+iADIOr/NEe876nmBu3HvF38NdTuJO1z6/A4TqAub0R4ULvguEhjzXpa97:oNM2Jiz6oAFKP5a98Hrq","tlshash":"f583d6d9b2c27062977734b850bf410bb17a98dab80c8c60f0a4d5e47eb4a8d517bf2d","first_seen":"2023-03-07T12:26:50Z","last_seen":"2026-08-02T22:23:03.310055Z","times_seen":863,"resource_available":true,"data":null}},"time_used":611,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":611,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/new/3.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.015Z","timestamp":1785263508015,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/new/3.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 19 Aug 2025 07:15:34 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68a42496-2dfb8\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":188344,"size_decoded":188735,"mime_type":"image/png","magic":"PNG image data, 856 x 400, 8-bit/color RGBA, non-interlaced","md5":"c12f13b61c3edfb632087956e12dd0c2","sha1":"dcb8553bc0b998f9b52d9bda68f7ac64f86c8fa6","sha256":"3b8f0c9dcbfcd1aec87b77a6447fb9175b84231b75f8e6e0393120e0187be13e","sha512":"55971e6fe584c23ba19783017e04403c3f861741dd00556b853a5572af6e44931ff9a310606b32bdb57b581c01408632cebedc745ae0a025de401bca9e8c72e2","ssdeep":"3072:/0hKygulsxe7wEQABIXUOCUWmLEbeZmeBLvsVNe/brFqRDZM6yYfJrKHwW5pbF8p:/0hN+e7wEQABIlWmLEbec2bb/brKK6rH","tlshash":"bc0412fd9221572ba244377c7a7cdd36e90561bdf89c28a10337b7944aa347278baf40","first_seen":"2025-08-19T12:54:30.85607Z","last_seen":"2026-07-28T19:23:40.832257Z","times_seen":16,"resource_available":false,"data":null}},"time_used":895,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":895,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Static/coinimgs/.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.057Z","timestamp":1785263508057,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Static/coinimgs/.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: text/html\r\ncontent-length: 504\r\netag: \"66541f8f-1f8\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":504,"size_decoded":659,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"b7f6c24fcd751e5a437f9a3700aa7074","sha1":"7462bb1e33a7a761363945ff31ff3e2b3a58c04e","sha256":"d7ee9daf35876b1fd867a1bff334dd0a2bf441f47b2cb3b8c4b7e33723d58678","sha512":"0af608e297389b14ff920bdc9335b777dd8314abe14da03627c62cf672b4218c47f7a91de98bd4e59e0b978c1f9ec1cb6ba2758542e51b0044b7972a486b8cfb","ssdeep":"","tlshash":"54f09e8340e14429111041302e9060054f4b7d8bdb5b4d0138afb1bbefc6a84c5635cc","first_seen":"2024-12-24T17:17:56.68958Z","last_seen":"2026-07-28T19:23:40.836319Z","times_seen":84,"resource_available":false,"data":null}},"time_used":2001,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":854,"receive":1147,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/xm/dot.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.040Z","timestamp":1785263508040,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /xm/dot.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 04 May 2023 07:53:07 GMT\r\nvary: Accept-Encoding\r\netag: W/\"64536463-11a0\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4512,"size_decoded":4783,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 200x200, components 3","md5":"9b80e332192b4501a7b2ea68cf81877d","sha1":"bd8c43b0e1efb07078383c223e36b044a84b9d68","sha256":"94c64a23926f16b8764163bb4bf4298ba5c81adbce05805874771b4935d7dda0","sha512":"618fd24497594ef2e20d482f9db8611bf4b5b7d79f48d9a4ac234a9f6b74a93bc284f45a4461fd6b403317d04f04361b6a3dcbc9cb729f5f0003d08f433eb9bc","ssdeep":"96:jeqJYPZyhFnZLOSpJ1ccOm358VK3Fs8SMBKWTvI+FYHEuRB:jUsZlpJ2lA5HBlvI+CLB","tlshash":"69915c2fa5084527feabcf354e30b1086710ac52d9446e1db93aea7fb05e46b2cd3004","first_seen":"2024-10-23T13:33:33.425393Z","last_seen":"2026-07-28T19:23:40.866316Z","times_seen":259,"resource_available":false,"data":null}},"time_used":870,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":870,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/xm/bsv.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.043Z","timestamp":1785263508043,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /xm/bsv.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 04 May 2023 07:53:06 GMT\r\nvary: Accept-Encoding\r\netag: W/\"64536462-ed9\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3801,"size_decoded":4175,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit colormap, non-interlaced","md5":"bc6293370eceaba626a50801c27fc3ba","sha1":"671be576385defa1b197fcdb40059172894a2f11","sha256":"b5681eb2f2e568333b59fce2ea981991cef95d07fc1efe6f3f51c883456f9139","sha512":"e9e824c8682cf5dec4dc4a60f7781ae67c382dfbdccc5fe684ad26f6dad123141b59f4d97becfc9f904dd0d3ec03113cc4b469246c26b59b63fd4eef3a7c44c9","ssdeep":"","tlshash":"e5716d3fa38192166b9cc8985f2ff9da5cc39289f384592a6e93114a1221255141ff9d","first_seen":"2024-10-23T13:33:33.473747Z","last_seen":"2026-07-28T19:23:40.832869Z","times_seen":271,"resource_available":false,"data":null}},"time_used":868,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":868,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_ltc","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:32:06.997Z","timestamp":1785263526997,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_ltc HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=ltc"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:32:07 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":235,"size_decoded":549,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"dd0c2ec12c345b0c4b974c9ec3735adb","sha1":"6a2f0ecfc18af4687e4aa7d015ac99c2b5a1f24c","sha256":"1354bbae90f1b322ba7c145353945c4d507287bc2f0b52f6f32a3446e3377343","sha512":"c26731729d2b514987d67daa57bfb0e3b28b3e2db322157869a0939b53888379d7dca6ffe158f7ca128238aeb743ba866a32a2d73291d9bb9170954e875a793f","ssdeep":"","tlshash":"82d097a07f3c84200c22a3d0a8da2f1e681e404580c80288a7fd8ee4009d60d3627c13","first_seen":"2026-07-28T18:32:22.912549Z","last_seen":"2026-07-28T18:32:54.769833Z","times_seen":2,"resource_available":false,"data":null}},"time_used":335,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":335,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/xm/BTC.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.019Z","timestamp":1785263508019,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /xm/BTC.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 03 Nov 2022 15:52:10 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6363e3aa-a83\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2691,"size_decoded":2999,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit colormap, non-interlaced","md5":"2edf1ef8b333c40979976d1a49bc234c","sha1":"d75ac12795b4a9575c874e1b190712cd62a87afc","sha256":"50a1901684f223bf26594dd3415b1e50f184820a16daa810cc5452911e9117a9","sha512":"f697a1fa0786316fc01003f72621920932e2657e4acf5a471e35d02717c42c9db5a12df311895a776a563dcae9b8fc0b6721833529a054b9dbfff4c52fc564d3","ssdeep":"","tlshash":"2b515ee60252267980d32438616db1e178beabb2c3021ded6c1444954acc4b62555cfa","first_seen":"2023-05-01T18:49:36Z","last_seen":"2026-08-08T10:03:11.4803Z","times_seen":25762,"resource_available":false,"data":null}},"time_used":891,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":891,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Static/img/01.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.045Z","timestamp":1785263508045,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Static/img/01.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 27 Apr 2023 15:29:03 GMT\r\nvary: Accept-Encoding\r\netag: W/\"644a94bf-1a42\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6722,"size_decoded":7097,"mime_type":"image/png","magic":"PNG image data, 166 x 166, 8-bit/color RGBA, non-interlaced","md5":"11d9836d37472e8a23062fb4228d1802","sha1":"9ce4083635466ffc6913a39f28c54d27613be700","sha256":"9d74621b1ec2fdc911ae973cdafb756b385c7cff75f93b568cc3ac6f73e30e63","sha512":"ff94ad35cae4a83a518acf4e97241ccee8e9494801051e7e2d0d814f79dce52c34791bb7044d390b589f8207560b3a972c81397284bb11b09ebe876a761b0733","ssdeep":"192:9YJ+hpu52rEFt1XZ3TIbo78Xwp9mt9bXL:9cYpu52rKhj8Xd","tlshash":"bbd19ef7eb7490f1c58841e96c78b82828cacbaa7d5a80604f385d556c019f2c0af46a","first_seen":"2025-03-15T05:55:29.562133Z","last_seen":"2026-07-28T19:23:40.862133Z","times_seen":78,"resource_available":false,"data":null}},"time_used":866,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":866,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_xrp","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.938Z","timestamp":1785263508938,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_xrp HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=xrp"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:49 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":246,"size_decoded":555,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"3cf259b71d9ac9d312c2761be6d70e0b","sha1":"17523943d830a3da965ec7b57fcddcdd4ae91ba4","sha256":"21ac4018f50d342a774e28d740978e418084875b1f517d72f8f7e53956fffa5c","sha512":"26c76e741d26b4a1b37d64e3221e8847cccead3363e91382f163bf76a37b9688535e76525b39beb39490998ca760400f820495c21f086679c671b98c9ed03ef9","ssdeep":"","tlshash":"f1d05ea07b7944290863a7d9fcdb5baea86d40868480460816ee4f3854eea3c372ac25","first_seen":"2026-07-28T18:32:22.919938Z","last_seen":"2026-07-28T18:32:22.919938Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1915,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1915,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_uma","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.946Z","timestamp":1785263508946,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_uma HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=uma"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:49 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":236,"size_decoded":548,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"5a2f1711af1877e3aa8dc1b077a543d1","sha1":"917b4c8cde06349f02c8bdfb944a230a61a77f1c","sha256":"bfc9bb21007b15cf837d5b2f6ca15a9bf3abdf8b5805eaf72a3a4a3f29f4e7d5","sha512":"174921a13a12136de0f107b65bc7c4c164d99907e9886a34269fa9197dfa402396126f8b140566de1517e511464c1a4e88457033c53229ab882723b5b47c1ad1","ssdeep":"","tlshash":"8ad0a794be3d04190c63e3d1bcd82f9e244f8c4290481f086bbecdb8266870d3712d5a","first_seen":"2026-07-28T18:32:22.921466Z","last_seen":"2026-07-28T18:32:22.921466Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1907,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1907,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_aave","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.947Z","timestamp":1785263508947,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_aave HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 9\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":9,"data":"coin=aave"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:49 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":254,"size_decoded":562,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"01c6b4c2bdd0ab9b7ed3f830838590a4","sha1":"852d5662b6e19d24f6459579f3b5898d79e36014","sha256":"87bb784608235cf6d40a443e203cd99283ec4df43ed699d7eb4452840f6ec70d","sha512":"dd184b9038d073e8a4a370f1ee5d907cace95c8affc133d16bf69d03fadaa395c8b01d5417565727876a3c63d18438735b0c791bc2cdca5258fc18e2a9a07a85","ssdeep":"","tlshash":"f3d0a5e47f390617167157c1b8f61b7b255dc046c441160457adcf661ae850cf155c27","first_seen":"2026-07-28T18:32:22.922566Z","last_seen":"2026-07-28T18:32:54.929898Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1905,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1905,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/bootstrap-icons@1.3.0/font/bootstrap-icons.css","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.1.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:47.976Z","timestamp":1785263507976,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2026 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 20 May 2026 15:48:47 GMT","end":"Sat, 05 Dec 2026 14:48:47 GMT"},"fingerprint":{"sha1":"D4:05:C2:EC:C7:EE:2B:D0:08:68:0D:3D:33:77:48:78:43:E7:D1:E1","sha256":"ED:84:90:EE:71:BC:6B:5E:B3:D2:50:B0:23:3A:06:0D:E0:50:C6:B6:A9:09:36:E6:CE:FE:E8:66:89:EB:4E:C5"}}},"request":{"raw":"GET /npm/bootstrap-icons@1.3.0/font/bootstrap-icons.css HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=31536000, s-maxage=31536000, immutable\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: text/css; charset=utf-8\r\nx-jsd-version: 1.3.0\r\nx-jsd-version-type: version\r\netag: W/\"edbb-Du3MPQ7GnRobCfGvnAP4Uqb5QVI\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\nage: 2354975\r\nx-served-by: cache-fra-etou8220197-FRA, cache-bma-essb1270079-BMA\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 8018\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":60859,"size_decoded":8797,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"dbf1248779dc682a91ba529b5efe0ffc","sha1":"0eedcc3d0ec69d1a1b09f1af9c03f852a6f94152","sha256":"32cc4a47b370e278072a6440249872e681efa1d992600420c03a9631da885d70","sha512":"2e96320bb785273c91c136a4aba02268e2c9ebcc92998c24160331ec14f0f902132d21f4ac4cb130771dd20758bef407d589b1f8e3175796622edb162a517098","ssdeep":"384:vaqJVm8OAL1M+hQokEYm47U7yH2CYEjOnm4zH7fZ6aXoso1v/:Sqnm8OAL1Mzocm4KyH2CYEjOnm874soh","tlshash":"2c53cebad18f05f59341e4d92743674293a9ba7ce1817c7ad342399ee3c06188ad73ec","first_seen":"2023-04-05T06:29:21Z","last_seen":"2026-08-08T09:27:00.373854Z","times_seen":15178,"resource_available":false,"data":null}},"time_used":37,"timings":{"blocked":-1,"dns":1,"connect":9,"send":0,"wait":9,"receive":0,"ssl":18},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/xm/trx.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.037Z","timestamp":1785263508037,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /xm/trx.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 04 May 2023 07:53:07 GMT\r\nvary: Accept-Encoding\r\netag: W/\"64536463-1735\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5941,"size_decoded":6316,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit colormap, non-interlaced","md5":"273ef6386ba9fa5f898cb287fc158b2a","sha1":"ca3836d219eec81150b468190f6464294f577acc","sha256":"7f169dcdd6e34e9107624b12b34d930f3c9e6dac99af40e5658d917070d23add","sha512":"199f641aef0c7476c655acfc42d23357898219c844424c611f92bc6591de05a74f8810955d0290440d18d729d4b8fc91e851fdcfb62e03dd09cf5e8fdced53ce","ssdeep":"96:evTBOSuvec7k5dzzcNMMDHrQ02VMpyD/qSjiq15njHDKOfALKHRqzH0DzgG8qzu5:0TB8odMTrzpybVjiq11jHW3QRqwDzpbC","tlshash":"ecc1bf3aa1d11b7b0acee31b430c8804d20ef253d225cd59c8af9065bed17e7406f813","first_seen":"2024-10-23T13:33:33.42136Z","last_seen":"2026-07-28T19:23:40.842778Z","times_seen":289,"resource_available":false,"data":null}},"time_used":874,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":874,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_eth","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:51.932Z","timestamp":1785263511932,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_eth HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=eth"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:52 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":247,"size_decoded":557,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"80a062b8c8f573b1d758b274c3a6eef3","sha1":"ce40def67f98f24b23f44af8fa911a38bca00864","sha256":"9f63e878be16e243c43ea908d29984323ac8d11b9176dc124432990c78c6af71","sha512":"d1ec170f59974ae8b47d19c52677f0636b8d9b023327603b63d57e57c593be48f17e0e0fbfa58091c841730c367c37f8fbf1e6275f6ba5546145f29ec177cc39","ssdeep":"","tlshash":"61d05ea4be7848250c22a3d1b8da2b6e2e5d4842c089c6595afe8e6918e850c7262c75","first_seen":"2026-07-28T18:32:22.924739Z","last_seen":"2026-07-28T18:32:22.924739Z","times_seen":1,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":327,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Static/bootstrap5Slide/scripts.js","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:47.997Z","timestamp":1785263507997,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Static/bootstrap5Slide/scripts.js HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 298\r\nlast-modified: Mon, 04 Jul 2022 17:20:12 GMT\r\netag: \"62c3214c-12a\"\r\nexpires: Wed, 29 Jul 2026 06:31:48 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":298,"size_decoded":649,"mime_type":"application/javascript","magic":"ASCII text","md5":"48477ea73f8709a6c29d7cde0cc83e55","sha1":"5dc30fab107725dd71ab343d70b9e6267ea68cf1","sha256":"fd67e1f083236a6c171d2275401174ea62a6f24fc81193d55653080a236a209a","sha512":"0932287b99d7c96929e7464b6684fe399dfcaaea787dcab28fa0879094b5eb4d92139260fecde4ffe430eca3986430f98a72fc523332c4e476bee9ea2226b1b3","ssdeep":"","tlshash":"1ee0cd91761d4f9d1ccc3257996092c576841524e401f06790374c6c0a9584225fb7fc","first_seen":"2023-04-25T18:57:28Z","last_seen":"2026-08-03T02:44:22.652838Z","times_seen":6173,"resource_available":true,"data":null}},"time_used":914,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":912,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/xm/DOGE.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.029Z","timestamp":1785263508029,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /xm/DOGE.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 03 Nov 2022 15:52:11 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6363e3ab-838\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2104,"size_decoded":2476,"mime_type":"image/png","magic":"PNG image data, 61 x 60, 8-bit/color RGBA, non-interlaced","md5":"ff0c62c872d877837881793431cf064c","sha1":"8ee9cdfe43cfba24078529fa23984ab9e9d99a76","sha256":"c146f8822178b5581dd5eb80071e9824e1634252a4cd0d25b9675b0cb3da570e","sha512":"2416ae2389993012befe574c4ee91c47b6101f3e89b7582d25ce214e248e5305f327183c2a7222259b9aeae09ff7315edeae1ff11c8be3304ca11d5cefeb09ff","ssdeep":"","tlshash":"b0416e07f3ddbe79ccd66bb71348e024d01ff7e1b8010b98a42a4c565258c6f215c44b","first_seen":"2023-05-02T21:54:45Z","last_seen":"2026-08-03T02:44:22.664211Z","times_seen":5406,"resource_available":false,"data":null}},"time_used":881,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":881,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_eth","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:32:00.955Z","timestamp":1785263520955,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_eth HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=eth"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:32:01 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":247,"size_decoded":557,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"80a062b8c8f573b1d758b274c3a6eef3","sha1":"ce40def67f98f24b23f44af8fa911a38bca00864","sha256":"9f63e878be16e243c43ea908d29984323ac8d11b9176dc124432990c78c6af71","sha512":"d1ec170f59974ae8b47d19c52677f0636b8d9b023327603b63d57e57c593be48f17e0e0fbfa58091c841730c367c37f8fbf1e6275f6ba5546145f29ec177cc39","ssdeep":"","tlshash":"61d05ea4be7848250c22a3d1b8da2b6e2e5d4842c089c6595afe8e6918e850c7262c75","first_seen":"2026-07-28T18:32:22.924739Z","last_seen":"2026-07-28T18:32:22.924739Z","times_seen":1,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_etc","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:32:01.937Z","timestamp":1785263521937,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_etc HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=etc"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:32:02 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":234,"size_decoded":546,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"c571ab61096a01825ec0103854a13f2a","sha1":"8f981aa8c96b50bf8dfe099115023147e56d4d35","sha256":"0ccd5e1065bfec6733650a93c4dd3421254e4f3e6f7f3ecf55c5d10fdeb677c4","sha512":"b58d8cf9659ad0a271af6c42ab61087bd9fd9a95b9a5ce66d52d0b79437e60d6d34ccfc684017a1f366462a6a23fc360a2b36db204528a766fa6fe66ae1f1037","ssdeep":"","tlshash":"68d0a7907f3c45150d22e7d1ecd63b5e558e508a80c7934d5abe8ea965e861e3522c22","first_seen":"2026-07-28T18:32:22.926708Z","last_seen":"2026-07-28T18:32:22.926708Z","times_seen":1,"resource_available":false,"data":null}},"time_used":329,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_etc","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:32:14.940Z","timestamp":1785263534940,"http_version":"","security_state":"","security_info":null,"request":{"raw":"POST /Ajaxtradenew/obtain_etc HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=etc"}},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T11:24:25.423291Z","times_seen":17778095,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/xm/usdc.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.039Z","timestamp":1785263508039,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /xm/usdc.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 04 May 2023 07:53:06 GMT\r\nvary: Accept-Encoding\r\netag: W/\"64536462-8c6\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2246,"size_decoded":2620,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit colormap, non-interlaced","md5":"34a0a93a76960505d00647f82a235bbd","sha1":"b8889c12217678bb8de7b60ba732bb00ef7eaf33","sha256":"98c9a5f555cda2c13172162655b6d2f9903fa6ba00a86b694dd628d45c5a5780","sha512":"5187eea1e6a1265fef0d70c4c1f03f63f3adcfcab98640be5d6d94ff9d83856049ecb0426d6c313126d9d9e7c9a35eac8c8f1347412e75d0af896ea6bcbd49a6","ssdeep":"","tlshash":"b5412c03b1f04d9ad29b1f3db919085ff02e09ea1949c87f45e7790ebd6aae1c345711","first_seen":"2024-10-23T13:33:33.452912Z","last_seen":"2026-07-28T19:23:40.828509Z","times_seen":297,"resource_available":false,"data":null}},"time_used":872,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":872,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Nunito:wght@400;600;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.314Z","timestamp":1785263508314,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:27 GMT","end":"Mon, 21 Sep 2026 08:39:26 GMT"},"fingerprint":{"sha1":"50:37:CF:61:33:A1:EE:47:D9:3D:A6:5E:07:BA:4C:FF:F7:25:9F:76","sha256":"7D:4D:21:06:63:E2:5E:F0:8C:59:8E:EB:B7:94:2B:81:70:11:D3:F4:C0:A0:81:A6:1B:E7:27:FD:56:10:1A:11"}}},"request":{"raw":"GET /css2?family=Nunito:wght@400;600;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Tue, 28 Jul 2026 18:31:48 GMT\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5463,"size_decoded":1291,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"721a040ea564a6f1097d3c9fc78e4478","sha1":"969b3a763c65bbea8dd653387efe6482fd53f614","sha256":"1eab5e802b5f0457aaad88e630b825da8ed3ba340a35a34b5f6901d9d84bdad1","sha512":"44cce6feb92211ced4be081e6a2c9c0c63b0fc22a7243396544d0d88b4736d6e6d62ee3cad5136dda1b21e3f4eac55d6b465a0b28922df3565bc5bef366db625","ssdeep":"96:BOEabTxOEa7FZOOOEaKOEaQJc+uaOEaENqOxMabTxOxMa7FZOOOxMaKOxMaQJc+m:OH+yptkUkH0yXLkeLHbywkkdH","tlshash":"5eb17891045bd400aa432cc667cf7f37ed4e62113464c57aebfd9898ecabd272264b1e","first_seen":"2025-09-17T11:57:27.939025Z","last_seen":"2026-08-07T16:51:08.900182Z","times_seen":1680,"resource_available":false,"data":null}},"time_used":85,"timings":{"blocked":-1,"dns":2,"connect":16,"send":0,"wait":35,"receive":0,"ssl":32},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_crv","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.955Z","timestamp":1785263508955,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_crv HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=crv"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:49 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":242,"size_decoded":552,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"ce5a10fad430237d4d2fd955b5b24143","sha1":"1b8b490696d4e8e7e7b7d4e94af0599d40936736","sha256":"68e5a92babd8778abc6cf746d7223f834161be808e8784afbedda9276b59916c","sha512":"0b59219b2750dbaac091305603f974212da32139b7cc6b21f0e504cdaf242f991993d1b34b225c8ab6cddbfd66a59ec25ca7c95b24126521db1e7766a898c5bc","ssdeep":"","tlshash":"64d05e90ba3909910c21ebd5a8f71bae748d66458181160c27ae8e2816d821c3232822","first_seen":"2026-07-28T18:32:22.928903Z","last_seen":"2026-07-28T18:32:22.928903Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1898,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1898,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_xrp","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:32:00.006Z","timestamp":1785263520006,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_xrp HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=xrp"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:32:00 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":246,"size_decoded":555,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"3cf259b71d9ac9d312c2761be6d70e0b","sha1":"17523943d830a3da965ec7b57fcddcdd4ae91ba4","sha256":"21ac4018f50d342a774e28d740978e418084875b1f517d72f8f7e53956fffa5c","sha512":"26c76e741d26b4a1b37d64e3221e8847cccead3363e91382f163bf76a37b9688535e76525b39beb39490998ca760400f820495c21f086679c671b98c9ed03ef9","ssdeep":"","tlshash":"f1d05ea07b7944290863a7d9fcdb5baea86d40868480460816ee4f3854eea3c372ac25","first_seen":"2026-07-28T18:32:22.919938Z","last_seen":"2026-07-28T18:32:22.919938Z","times_seen":1,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_doge","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:32:08.996Z","timestamp":1785263528996,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_doge HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 9\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":9,"data":"coin=doge"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:32:09 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":252,"size_decoded":557,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"4080c9a926588a18f9de15b8488b1fc1","sha1":"20b2bccf001dc5ae65a3863ecb1f26b3df71b8a7","sha256":"0fae26ce7d87e04420b95b1f50ed39745e569810e80be7fff8ed8af36247dd9c","sha512":"9be386950aac7fc69201007225208d3523c95c9c168b8b8967f6cefba3d39ee099313679c50d91d11508b201d01d65b517cc4803a15bf959fa0cdb3421be3063","ssdeep":"","tlshash":"84d095e0ff7c40110c51a7e168e4372d548d00c3c0c0073967fe8d24851830c3e16823","first_seen":"2026-07-28T18:32:22.884115Z","last_seen":"2026-07-28T18:32:54.791749Z","times_seen":2,"resource_available":false,"data":null}},"time_used":353,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":353,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_btc","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:32:12.996Z","timestamp":1785263532996,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_btc HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=btc"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:32:13 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":246,"size_decoded":556,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"ff21a961cc1f4a883acccaad380d9923","sha1":"a1b772fb96281c04bf7e508ed143b1fcf61207e8","sha256":"113444ca12b36c1ec52ee6e4335fa3fbfef4f1715b381535ec1b3973702aaebf","sha512":"978fd86b8bb33f5e1b6710259c94016d1f23081049d38517316515a0766d64d3ea7e1abffc7a1a5cb20b23e51a49587e564fc48c2eb42b74a9cdf45025d8cd49","ssdeep":"","tlshash":"b6d05bd07e354d151c21d3d1f4d5175f148e544644c5534a5bed8e79647920c3727812","first_seen":"2026-07-28T18:32:22.857945Z","last_seen":"2026-07-28T18:32:54.829092Z","times_seen":2,"resource_available":false,"data":null}},"time_used":337,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":337,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Static/bootstrap5Slide/style.css","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:47.981Z","timestamp":1785263507981,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Static/bootstrap5Slide/style.css HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: text/css\r\ncontent-length: 589\r\nlast-modified: Mon, 04 Jul 2022 17:20:12 GMT\r\netag: \"62c3214c-24d\"\r\nexpires: Wed, 29 Jul 2026 06:31:48 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":589,"size_decoded":926,"mime_type":"text/css","magic":"ASCII text, with very long lines (589), with no line terminators","md5":"df62cb99d119a66bcd5f06547d96ecb7","sha1":"a6d0e097db0919f47977c33510359bc08ec88a9c","sha256":"afca52e1c0203f27bf8165e8fcf92b2674f084f6372f12cc1e7bb3edaee35f03","sha512":"59d599c3a25a64cfae94e1b2f1328abffb199a503c0e8904a3e4a574c101cb6b72d09e94a7b2afaa3f8cbd1a55b92cb2b2bdc33b528ee6c953d30fa3b622cf0f","ssdeep":"","tlshash":"a2f07f42b71a596e5d872300a9d213abf10c7f319709097992f3211d8f29a85237df4e","first_seen":"2023-04-25T18:57:28Z","last_seen":"2026-08-03T02:44:22.698262Z","times_seen":6161,"resource_available":false,"data":null}},"time_used":330,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":330,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Static/bootstrap5Slide/flexslider.css","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:47.982Z","timestamp":1785263507982,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Static/bootstrap5Slide/flexslider.css HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 27 Apr 2023 15:17:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"644a9222-1b1c\"\r\nexpires: Wed, 29 Jul 2026 06:31:48 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6940,"size_decoded":1958,"mime_type":"text/css","magic":"ASCII text","md5":"df757c10d61db76d72f3a1aa5ba02880","sha1":"1101f3bdad4263e0bc51fc7ed5b2644e01c038f8","sha256":"77f76910108b7062309dd6bfa310123a867fca01b12eef62c37e5d2d0d0cc794","sha512":"1d663c8bbee93cb2f6dec538a478fee62b991269a6bb661a89351c5ab057a81453a67eb251d0ef94518d986d2aca30e0fefa6df9858d3004a383d33478e53d0c","ssdeep":"96:KnSjtVxOrS1MWfviQzOCpfkcFQ2YOdJS5r:PjvJ3NJFQxYJYr","tlshash":"d5e1d17c16f40704a827c16cae42db1ea7acc002961ed85de5e11638ceea389c973bdd","first_seen":"2023-04-08T00:25:48Z","last_seen":"2026-08-01T08:54:30.079128Z","times_seen":876,"resource_available":false,"data":null}},"time_used":607,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":607,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/new/5.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.017Z","timestamp":1785263508017,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/new/5.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 19 Aug 2025 07:15:33 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68a42495-15c11\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":89105,"size_decoded":88264,"mime_type":"image/png","magic":"PNG image data, 856 x 400, 8-bit/color RGBA, non-interlaced","md5":"ca97cdbe6830a8b6faa6356525070edd","sha1":"81ef9103cf75b4f521ce353e23fd038e76e1e375","sha256":"0f2c40d8f0961e778fb76d0d573e41e5807bcf525be9a983ab6d27db9df8c33e","sha512":"11c3d7be0df39fa37d722cb9065bcb436d9028aec7d3ec96d01a20111e3dfe15d7641d6d89bd94dd290354867b5765e53b43a04db63be1808ce3ac2dc4c577c0","ssdeep":"1536:WUt9qGQoTeitkXjyxbdKY063z4evhLagpq6+OASj0na47h22Swqb:V9rdtEgxKY0FmhJZ4tQPb","tlshash":"f593010578a0d527da56333e6e1cd1806b80d4e2562fce1d6a3bfbd08ecd1bd5e90687","first_seen":"2025-08-19T12:54:30.895691Z","last_seen":"2026-07-28T19:23:40.855626Z","times_seen":17,"resource_available":false,"data":null}},"time_used":893,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":893,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/xm/ada.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.038Z","timestamp":1785263508038,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /xm/ada.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 04 May 2023 07:53:06 GMT\r\nvary: Accept-Encoding\r\netag: W/\"64536462-13dc\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5084,"size_decoded":5459,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit colormap, non-interlaced","md5":"3c630d48e25b4f76cb67e3f9b29a1840","sha1":"21ff7adeae4705a1b0ecb571f5fa98b5aa9da916","sha256":"ac43f42d0252a1d32196142ede6fd9a0b18f009f6bebd2255a2e493737d92058","sha512":"d7dd64616a88e4f53e4bea6b6a7e2fbbb3e6d2cc6a8f312244146f72e017c7465e0133c8ef73b14f714237cbb322b50f172d588ed7f617d16a35ab73ead6dcbf","ssdeep":"96:S4dRPCKnXlROlMKTVr34gY1vVutJSXc5he38/lBrc7Wx1U+uBCrba1:xn6aXDOlb2vVums5Ys/LruJCre1","tlshash":"a9a18e826c61b4d9b6428479134df5ac8d92c218ccd046dd7f87cd38ab101e8ca1e9ab","first_seen":"2023-05-27T03:32:48Z","last_seen":"2026-07-28T19:23:40.856273Z","times_seen":287,"resource_available":false,"data":null}},"time_used":873,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":873,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/favicon.ico","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:51.212Z","timestamp":1785263511212,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:51 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 16958\r\nlast-modified: Tue, 19 Aug 2025 07:16:29 GMT\r\netag: \"68a424cd-423e\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16958,"size_decoded":17232,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 64x64, 32 bits/pixel","md5":"89d8e39eda078521f04fdde4aaf1aaac","sha1":"1bce02b1a72840af48c42971bc67a61c8a88ce32","sha256":"74fca3da26e603855649dad4214c8f51da250e0f295194348ddfadae54f918b0","sha512":"40aa29c8a2e2325a8d5f553ad9df1d073dc8fd6376ebe9cd1c71244bfaa79a943b4a79281043deaf27b74201ad53ea6d868d7e2009f32f71119b26ed07a72b5c","ssdeep":"48:Gs5LJ6BrdfQw6YdqkIc70Y1SAVdn2LXwJqEPa2kdts:GsBJ6BFQwvse51iLXwJqEPa2kdts","tlshash":"eb7268c3bac070bbc72d0735e1d2df369e2d0ea86d5c866200c79d57bc46c9d5c59405","first_seen":"2025-08-19T12:54:30.927312Z","last_seen":"2026-07-28T19:23:40.847539Z","times_seen":21,"resource_available":false,"data":null}},"time_used":318,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":315,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_btc","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:32:04.992Z","timestamp":1785263524992,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_btc HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=btc"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:32:05 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":246,"size_decoded":556,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"ff21a961cc1f4a883acccaad380d9923","sha1":"a1b772fb96281c04bf7e508ed143b1fcf61207e8","sha256":"113444ca12b36c1ec52ee6e4335fa3fbfef4f1715b381535ec1b3973702aaebf","sha512":"978fd86b8bb33f5e1b6710259c94016d1f23081049d38517316515a0766d64d3ea7e1abffc7a1a5cb20b23e51a49587e564fc48c2eb42b74a9cdf45025d8cd49","ssdeep":"","tlshash":"b6d05bd07e354d151c21d3d1f4d5175f148e544644c5534a5bed8e79647920c3727812","first_seen":"2026-07-28T18:32:22.857945Z","last_seen":"2026-07-28T18:32:54.829092Z","times_seen":2,"resource_available":false,"data":null}},"time_used":330,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":330,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_uni","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:32:08.992Z","timestamp":1785263528992,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_uni HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=uni"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:32:09 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":249,"size_decoded":557,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"4fa3a1b8d02c771b97121ea2476f967a","sha1":"001d9515d30cd6637cd155a1be11b00f2001d85c","sha256":"81505790aeb1f1f317e2f7794a9bb1d47f2df2a91d64e37495054db8a2630afc","sha512":"c89e3b71963fb83c96c407ec9597a79f503cd85009caddb6ce6bf62215a0cbf72cc7ca609ac105e8c5c756b851c3096f7808b238f57e4c530962146c307f1a7c","ssdeep":"","tlshash":"4ed05b982abd4c350c135bd168d51b5d644e40918145424c66fd4f642a6850d3555817","first_seen":"2026-07-28T18:32:22.933109Z","last_seen":"2026-07-28T18:32:54.810016Z","times_seen":2,"resource_available":false,"data":null}},"time_used":329,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_bch","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:32:09.935Z","timestamp":1785263529935,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_bch HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=bch"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:32:10 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":234,"size_decoded":549,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"bfd7d1718d442617b7d04f21d09b2424","sha1":"544f27c2ef822e37f78bbebc8d49445905ee8910","sha256":"93ce2809c34c72f60958d9c430c1334854310a619956543059913f1e7f455d38","sha512":"f42458340b4f78f0f8ffd0489d8f688f9b736e5bd9dddeb326fb05d1b57be99421de8d4a6174e8aa39bc6c9315170c87d174ae7759765b4ffa2b35aa498e1ff4","ssdeep":"","tlshash":"e0d0a7907f7449251c379bd1b4d5571f2c8e4552c08886092fbfce7a485c71c3323852","first_seen":"2026-07-28T18:32:22.934224Z","last_seen":"2026-07-28T18:32:54.788564Z","times_seen":2,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Static/img/03.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.048Z","timestamp":1785263508048,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Static/img/03.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 27 Apr 2023 15:28:40 GMT\r\nvary: Accept-Encoding\r\netag: W/\"644a94a8-1a9a\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6810,"size_decoded":7185,"mime_type":"image/png","magic":"PNG image data, 166 x 166, 8-bit/color RGBA, non-interlaced","md5":"56cbeed439c47886d857bf2c36468714","sha1":"f1085c8cf5686c184ecfd383788b38aab1428a42","sha256":"9e57dec64abf89817fab6d672b352f9c281a42cc0ebe50810d2e550135eb59b3","sha512":"1080479fd7faad224f868223a8e1d257b95f0cce824ff4c88fd3050f3d6b38a54efc9f5f459dede1ea14cf7c1608bb66f71dbc30fddd9f0b0e7c391100f8ef9c","ssdeep":"192:mN4ScWnJjgwGAdnWrQA11CSTttFqU2fOk0tk:AvlnJkXUnWr/ttMUEO+","tlshash":"6fe19eff5bde6dd54e3a18aa4d6020cbb88e80285b10c90a834e4149d3c3ce08e299d4","first_seen":"2025-03-15T05:55:29.570582Z","last_seen":"2026-07-28T19:23:40.821805Z","times_seen":78,"resource_available":false,"data":null}},"time_used":863,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":863,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_btc","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:50.945Z","timestamp":1785263510945,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_btc HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=btc"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:51 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":246,"size_decoded":556,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"b93f2f5f910c9be6b93d57c3ce5d38fb","sha1":"e50b72a8387fa0913f437fb8ab034cb54db6951a","sha256":"261dd32033c6fe8ba859a57111616824463a72ca52816ece064d47e8614b17ab","sha512":"4d31a4dbf7fcbb69bfd43ab269aeca2be54efc66b41a07fe00e6996da31971d717fe73c46657b3038aa16740a1331a55ba76bf10a578a59f181486c76a7ce717","ssdeep":"","tlshash":"a5d05ed0be3888291c21e3d1f8ea176e684e848680c6460a1bedcaba256910c7737822","first_seen":"2026-07-28T18:32:22.814487Z","last_seen":"2026-07-28T18:32:22.814487Z","times_seen":1,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Static/img/08.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.054Z","timestamp":1785263508054,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Static/img/08.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 27 Apr 2023 15:28:47 GMT\r\nvary: Accept-Encoding\r\netag: W/\"644a94af-665\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1637,"size_decoded":2011,"mime_type":"image/png","magic":"PNG image data, 88 x 88, 8-bit/color RGBA, non-interlaced","md5":"ad3e6d20dd722c9eaf3cd4cc0bd3583f","sha1":"6aa85a1de7497e038de7aaec06e60ef2c83a434c","sha256":"cab305eca6f6aa45c6cfd463068ef215fe94fd338f69e8746632d3e61dd47f60","sha512":"f98110aa5e2513cb81f5732fa82b6c3326485ac7d47e3d2f9a38599b92d6733fcf9f42ffbb196115b53df211edd59bc1468d1b29b5ec7fefe6e19e1cb5802dd7","ssdeep":"","tlshash":"e8310a823235e4bdd40e1bb92b0e3270924a5a6c20c7c0fc1b1b2da141a66159869fd1","first_seen":"2025-03-15T05:55:29.519201Z","last_seen":"2026-07-28T19:23:40.866928Z","times_seen":77,"resource_available":false,"data":null}},"time_used":857,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":857,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Static/img/09.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.055Z","timestamp":1785263508055,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Static/img/09.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 27 Apr 2023 15:28:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"644a94b0-60a\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1546,"size_decoded":1920,"mime_type":"image/png","magic":"PNG image data, 89 x 89, 8-bit/color RGBA, non-interlaced","md5":"2361bcc4e0bd2c84f9aff90f02fe2ecb","sha1":"cf3f148d3573a8dc67153b9c927c20e384cb1d51","sha256":"229ea4eca7c7bacd3eeb632e310109aeadfe7f6fff1bd0359b7b134a0b68ba12","sha512":"b058d493f924c3a255a25ad629695f913699ddea5da8a4b8c848145db7c81be975c687f59c9420bd035c43857aa75ad9cf012e8d644b350dbe35c6d5852a6e91","ssdeep":"","tlshash":"9d31da9eeb68f93c4f870217d14efa455b7b0cf97a02523958991a8d2ad94404cdc369","first_seen":"2025-03-15T05:55:29.543505Z","last_seen":"2026-07-28T19:23:40.868428Z","times_seen":77,"resource_available":false,"data":null}},"time_used":856,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":856,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Static/img/light.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.006Z","timestamp":1785263508006,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Static/img/light.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 19 Aug 2025 06:29:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68a419da-2936\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10550,"size_decoded":10694,"mime_type":"image/png","magic":"PNG image data, 640 x 160, 8-bit/color RGBA, non-interlaced","md5":"93c7d8d11904f47c8478c2b7aff26267","sha1":"35af911036ef86b98d2d8933e2a0da8e806ce3da","sha256":"164be01dc3565dd768189c09d39867b3959cdf82c1701dd20dfbb64184f6e123","sha512":"23f202f8225d4e808ae2e4eac1a2c97aa786dfb6c3e8019b3c4b65256d8003cf291abbc234b178f38f482b1d18c3987a73b63e948b94ccc2fb245f406bfb7d99","ssdeep":"192:27ya7vsjNA9tp7Eg4A9uKieQ2Uch2i+l5U3Z8dzpsSgFlgmLFuR8o38ACS4BvG8R:tavJ9BiGeTbdzplgFl/FYMi4BvhR","tlshash":"e422b0d10571f910af9beaf3fa849f473c23c692f2e840f8e401ceac515ae09057652a","first_seen":"2025-08-19T12:54:30.851325Z","last_seen":"2026-07-28T19:23:40.826758Z","times_seen":22,"resource_available":false,"data":null}},"time_used":903,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":903,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/xm/BAL.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.034Z","timestamp":1785263508034,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /xm/BAL.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 03 Nov 2022 15:52:10 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6363e3aa-922\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2338,"size_decoded":2207,"mime_type":"image/png","magic":"PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced","md5":"434f95cf398ff96a140cbd3cae92cac1","sha1":"14ec93193a85de4ae155b6ad0f2a3edef58cf9e5","sha256":"920c160bd3dbb09de22b942672c48a724c389143c6347f841d60e6b938f82923","sha512":"e90d9eca88e37b4d2f5f7291ee9b3184868b6c8cc22f8a31f5190fc4359c209b6203d3feb696540111e1d8e543942446d0f1750eb8e1c58f9945e6f0aa042f1f","ssdeep":"","tlshash":"a2419854d2b8e49add276bf7a4159f33956bd129f6c80a40f5a87a3c0903f449dc52d0","first_seen":"2023-06-03T12:58:34Z","last_seen":"2026-07-28T19:23:40.868989Z","times_seen":331,"resource_available":false,"data":null}},"time_used":876,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":876,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_1inch","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.944Z","timestamp":1785263508944,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_1inch HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 10\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":10,"data":"coin=1inch"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:49 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":256,"size_decoded":558,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"0257ad6b4b77cdc02762883ff2752544","sha1":"341a8651586bc23662bacb1580083d217b441fe3","sha256":"ddfb99d0a6d67a48621fc282d0c08a54152d871f796c822bfae9fa6ddd3307bd","sha512":"3affe5c2a90c7efa107c9ddce16897b230709d90bcef25b8176fc81311600a2a8064fe56bbf16774065d0fa111cdc99356d434fb531789932ba766a077a7e467","ssdeep":"","tlshash":"7bd05ba03b7d45151ce1b7d554d6179d54cf0941c185d615abfd8d2cd4ad50d3216411","first_seen":"2026-07-28T18:32:22.938308Z","last_seen":"2026-07-28T18:32:22.938308Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1909,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1909,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_eth","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:54.932Z","timestamp":1785263514932,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_eth HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=eth"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:55 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":247,"size_decoded":557,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"80a062b8c8f573b1d758b274c3a6eef3","sha1":"ce40def67f98f24b23f44af8fa911a38bca00864","sha256":"9f63e878be16e243c43ea908d29984323ac8d11b9176dc124432990c78c6af71","sha512":"d1ec170f59974ae8b47d19c52677f0636b8d9b023327603b63d57e57c593be48f17e0e0fbfa58091c841730c367c37f8fbf1e6275f6ba5546145f29ec177cc39","ssdeep":"","tlshash":"61d05ea4be7848250c22a3d1b8da2b6e2e5d4842c089c6595afe8e6918e850c7262c75","first_seen":"2026-07-28T18:32:22.924739Z","last_seen":"2026-07-28T18:32:22.924739Z","times_seen":1,"resource_available":false,"data":null}},"time_used":332,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":332,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_eth","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:32:09.993Z","timestamp":1785263529993,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_eth HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=eth"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:32:10 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":247,"size_decoded":557,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"d97f27a167b00c2987f90b5ce8bca9b1","sha1":"2b1a53f01e62c53a1921a6748c0b53f7b2c53614","sha256":"5fb44e69a9511442d6d4aec0fe0498334fbb79a718e21230be9cd6d1086e1391","sha512":"df24ef220bb4362979ba10045b7d9a26fa45f3cf26074acbd4991c73b82923ce0db56de0927ea81e8060c3e757b45cac097e5fb3cdad8a97a460e9069d30d1e4","ssdeep":"","tlshash":"dcd02ea4be3488640ca2a3d2b8ca3f291d4e0482c08582484afe4e6814d8a0c3222ca2","first_seen":"2026-07-28T18:32:22.869869Z","last_seen":"2026-07-28T18:32:54.774253Z","times_seen":2,"resource_available":false,"data":null}},"time_used":335,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":335,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/new/2.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.014Z","timestamp":1785263508014,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/new/2.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 19 Aug 2025 07:15:34 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68a42496-202c2\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":131778,"size_decoded":131254,"mime_type":"image/png","magic":"PNG image data, 856 x 400, 8-bit/color RGBA, non-interlaced","md5":"49a5713fd8d293a6e3bbdceb47761e45","sha1":"635358162098d8aac73ed39d3e84535874adcf45","sha256":"01c75289d4901e1e8a4b50fe4d0e4ac10de1c14633782bf639fd4bee6902c575","sha512":"0a9552dfbd749ad24334b2342d23e7c06a892aa60c721574786610e9e4c92ff50d267019d5b549a616c9e631d4a2f3fdcce744657dda3d309b208529960a014c","ssdeep":"3072:+jyIJRJiTfUg/DHyywuYHowX3ax19U0GlzZXW+lD9:+j9RJsUg/LfQTH+jLGlzZm+z","tlshash":"33d312d2c2f3b46a291d29627cedcf6dd2a1e50976bf0198c05097ce5a328da5df0b4c","first_seen":"2025-08-19T12:54:30.91726Z","last_seen":"2026-07-28T19:23:40.853194Z","times_seen":17,"resource_available":false,"data":null}},"time_used":896,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":896,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/xm/ETH.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.021Z","timestamp":1785263508021,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /xm/ETH.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 03 Nov 2022 15:52:11 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6363e3ab-adc\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2780,"size_decoded":3119,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit colormap, non-interlaced","md5":"856bfdb63dc0d6fad6b92fc6a29719e1","sha1":"2fed2e3409ce1bbbfb37f6da4abeecc30cefc021","sha256":"eebe29898b8b7de5c9e47daab474152be8095e3ab42d768b84b085c5a12b95c6","sha512":"a61c0a108d63c89ae62a2b03108480b5c08bda0e80049089a2a84cd7973bd9e94dcd2902e166b92e1d7ad5b7356357c9b181cb1b6051dd25913e82d2420154f0","ssdeep":"","tlshash":"51518cc7a707f33a9c866161bed44509f244d80a8160b31c0f33a7572c8a83ea4f324f","first_seen":"2023-05-01T18:49:36Z","last_seen":"2026-08-08T10:03:11.284264Z","times_seen":23077,"resource_available":false,"data":null}},"time_used":889,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":889,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/xm/xmr.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.042Z","timestamp":1785263508042,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /xm/xmr.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 04 May 2023 07:53:06 GMT\r\nvary: Accept-Encoding\r\netag: W/\"64536462-a8f\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2703,"size_decoded":3077,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit colormap, non-interlaced","md5":"dd806331c821d34fd7e91bfc6897211c","sha1":"24b3825bf3a8f8b5e604bf6b444d7c2d97aded69","sha256":"b24a76bd9854df525b90521299de92ac4afd44f57d801e4aae184f9bca41b3dc","sha512":"57357fbe03f5e9d7d4235beca8a5e6b052f9f941797b3d094e55646d18d26fa48973067f69164c307dd7a4fbf399ccb0bb533984f59074217da0b2da0d44475b","ssdeep":"","tlshash":"91513c320899d51cd650d53d30cb94e2ad311c7e5b88b999d6d9d1b1096a4f5543dd20","first_seen":"2024-10-23T13:33:33.483221Z","last_seen":"2026-07-28T19:23:40.853754Z","times_seen":226,"resource_available":false,"data":null}},"time_used":869,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":869,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_eos","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:53.954Z","timestamp":1785263513954,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_eos HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=eos"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:54 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":25,"size_decoded":408,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"68ac40a84898f40747d958e0c0941c75","sha1":"a033ad6d2dddc4dcbabdf38740c1a8cd192dcf0d","sha256":"232ef71afd2e2d3a4a886bd164ac9ae400955e7f71505d3570e31635b2ecc00e","sha512":"0707d815ab13b1d6804fdee766d93c98b78e2ceddafbecda34f34372d1d689ada7e8777adf7264eb03a393dafa59e80ce9810cb74592580f0be1ac8ef4f453c2","ssdeep":"","tlshash":"ec70000002afa8a3028200288c0f000000ac28882ca080008c2822288a200028a00020","first_seen":"2023-05-02T21:54:45Z","last_seen":"2026-08-03T02:44:22.624109Z","times_seen":351,"resource_available":false,"data":null}},"time_used":329,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Static/bootstrap5Slide/bootstrap.bundle.min.js","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:47.996Z","timestamp":1785263507996,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Static/bootstrap5Slide/bootstrap.bundle.min.js HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 04 Jul 2022 17:20:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3214c-1339c\"\r\nexpires: Wed, 29 Jul 2026 06:31:48 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":78748,"size_decoded":23055,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65299)","md5":"8831aa095cdec88f66c2e46c339cf352","sha1":"5db4c40dbc6bd3d9623ee98a2061dd265885cf2e","sha256":"79d443b15f542c8a8acca8e937f2a3c90ecba78bd49fdbac6c9b878c7f1293e9","sha512":"b07f093e128951e03d3d693778e70e97c53e95f65382d0570f8d6ae9c3bfb25c311870b129c5b8e4ae283c25211c6ecd301e266ca11d75598fb935eda5b09b14","ssdeep":"1536:GaPTJR2t4PqiiyuL5FehgTr1voCBZx6wVlLBkS:4OANBZVV5","tlshash":"0f73c5493254b87309ee15a68037460bf7256d94b14b802cb5bdacde2b3dc8672b7f78","first_seen":"2023-03-07T01:34:42Z","last_seen":"2026-08-07T17:45:14.160774Z","times_seen":7972,"resource_available":true,"data":null}},"time_used":899,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":899,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/new/4.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.016Z","timestamp":1785263508016,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/new/4.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 19 Aug 2025 07:15:34 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68a42496-216b4\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":136884,"size_decoded":135950,"mime_type":"image/png","magic":"PNG image data, 856 x 400, 8-bit/color RGBA, non-interlaced","md5":"46ef3425ec53f6643ec9b85fbebd74f4","sha1":"a55514d9c1c9a47d079881ba132b38cc0505351a","sha256":"ffa5550e8494706611447bc613e27d390b5ee209a593b0dbc8e897ff5b387c70","sha512":"4f43839415c93257a8c98e15e82964d5e524bfaf91f62f28ab67ff832054e0cc6cbcafaf25f42d4b5155ac27c1712524e7b23241bc1900ccec0d030750a88cf9","ssdeep":"3072:dT1ZHDhXAoJZs9QxmeJ0Y0v0Qk2+h1h1PnBj+WuqW7:dTvtXAMWQxmdPQvP1PB7uqC","tlshash":"98d3123094a0ae7cee4f445b0da1f37ee370c043569429382e1da5a41bed45fb926f67","first_seen":"2025-08-19T12:54:30.882636Z","last_seen":"2026-07-28T19:23:40.838551Z","times_seen":16,"resource_available":false,"data":null}},"time_used":894,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":894,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Static/img/img_map.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.609Z","timestamp":1785263508609,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Static/img/img_map.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 19 Aug 2025 10:31:08 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68a4526c-705cf\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":460239,"size_decoded":459017,"mime_type":"image/png","magic":"PNG image data, 1400 x 850, 8-bit/color RGBA, non-interlaced","md5":"d97e46e39c059f9906db4d22fa1c1898","sha1":"ec1d29be89cb9920acb1f7f4a9bc3140e57ed272","sha256":"2c0979d901899472ecb03090be9da836ba2a12bab2de7605593341fe26522a54","sha512":"96cec1d32ffed32708b407c7e6424a3aae3f945f9eb660e6559a7c945877167595410c7c76325ee2147ba18b42a3690519f285c52ee8e24c71098dce130659ce","ssdeep":"12288:XvrdZRvGppqzg+4fqHYdcFAlrjbgIR82uKHN2ff:/gpqzT2qHYdcWtbDR82Ltaf","tlshash":"28a423f1b62f84efdcaf7536c321821d92e4dac80a5bcbe57920ce520352a444edb759","first_seen":"2025-08-19T12:54:30.925938Z","last_seen":"2026-07-28T19:23:40.833521Z","times_seen":17,"resource_available":false,"data":null}},"time_used":919,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":919,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_doge","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:53.934Z","timestamp":1785263513934,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_doge HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 9\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":9,"data":"coin=doge"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:54 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":252,"size_decoded":557,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"735f30e0abbe5dc413a133d897e89e8d","sha1":"2b65f8e4c07f8450b965f1d0ea169ac0cb83fa95","sha256":"3380d5e42ca26042d6615e9ad6f0ce967aa300a4ec5b121009e3581b4d44a11a","sha512":"6722225630c4eb1dcac5bd2fa419a0eacacd8bf1c1efc6b2e4e7cf2d6f466f638f74028dd99e06d91a9e6817f1b22f8a592b66f9e51bad688a9653e3515829f1","ssdeep":"","tlshash":"4dd02be0bb3844210c91a3e158d4272d554e00438180422553ff8d24852820c3919413","first_seen":"2026-07-28T18:32:22.835971Z","last_seen":"2026-07-28T18:32:22.835971Z","times_seen":1,"resource_available":false,"data":null}},"time_used":330,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":330,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_fil","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:32:03.937Z","timestamp":1785263523937,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_fil HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=fil"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:32:04 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":237,"size_decoded":550,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"6da9801568182c6a5fe634f076bfe48a","sha1":"0b466cd476982c17fe568704ef3b9602b4a61804","sha256":"7bb0398b30ccff9705f8d28ef3e38d895a432821392991c4d8069ca9515092de","sha512":"8432f4d1dedb5c9ca84a574a70e56dc96586dd94168d7f0775217e88704982748edc1ea72b364eb73cc75592f2fabada5e5fe051aa1495b232507585c448d9a7","ssdeep":"","tlshash":"93d0a7d03f3984297c32f3d268e9175d5dde4c468480420996ff8fb854ac62e3272866","first_seen":"2026-07-28T18:32:22.887019Z","last_seen":"2026-07-28T18:32:54.813717Z","times_seen":2,"resource_available":false,"data":null}},"time_used":331,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":331,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_eth","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:32:03.953Z","timestamp":1785263523953,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_eth HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=eth"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:32:04 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":247,"size_decoded":557,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"d97f27a167b00c2987f90b5ce8bca9b1","sha1":"2b1a53f01e62c53a1921a6748c0b53f7b2c53614","sha256":"5fb44e69a9511442d6d4aec0fe0498334fbb79a718e21230be9cd6d1086e1391","sha512":"df24ef220bb4362979ba10045b7d9a26fa45f3cf26074acbd4991c73b82923ce0db56de0927ea81e8060c3e757b45cac097e5fb3cdad8a97a460e9069d30d1e4","ssdeep":"","tlshash":"dcd02ea4be3488640ca2a3d2b8ca3f291d4e0482c08582484afe4e6814d8a0c3222ca2","first_seen":"2026-07-28T18:32:22.869869Z","last_seen":"2026-07-28T18:32:54.774253Z","times_seen":2,"resource_available":false,"data":null}},"time_used":340,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":340,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_uma","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:32:13.939Z","timestamp":1785263533939,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_uma HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=uma"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:32:14 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":236,"size_decoded":546,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"1c004da2599394dbd124322fc95656aa","sha1":"926a6532f3135a254d32a2395a3edd03c28548e9","sha256":"327c134e01992e1993a21b0af0d613981e90c5cbe63bcfc8f2d7f23f1ea52403","sha512":"aa06d6f5e22619f41eb78657367a92e9ab707af3b8953e70c6eba73d5c7e3563aa3a7705643e28cf882272fb966376862d85de4b4dc05cc809f240c9eb48a37a","ssdeep":"","tlshash":"87d0a7907a7e04191c73e3c1bcd93b5f184e4c4190884f0a67beceb42668b0d7222c66","first_seen":"2026-07-28T18:32:22.943125Z","last_seen":"2026-07-28T18:32:54.888844Z","times_seen":2,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Static/img/06.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.051Z","timestamp":1785263508051,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Static/img/06.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 27 Apr 2023 15:28:45 GMT\r\nvary: Accept-Encoding\r\netag: W/\"644a94ad-1b7d\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7037,"size_decoded":7412,"mime_type":"image/png","magic":"PNG image data, 166 x 166, 8-bit/color RGBA, non-interlaced","md5":"531f22459b2267c88d4c764feca7ed0e","sha1":"98056833a55cfbd4b2db51079fdda11733fe04ea","sha256":"ef86b87d812b9f2fa27fd2d349366318ad2c796877a8eea2fcae343f039fbdbb","sha512":"63cabed822d2357caa6f1cdfb6e5476e6bf34f23745e55ae9cc8cfdb840c0ffa2bc023b5db6759e72aed52b36df9c805b8a4c1f560bd1ddf1204d2f61ec2f91d","ssdeep":"192:QJzQ8aT3YqoWbksgOZceIP/J7o+6YEg31NvexLIb:WzzaT3c+cp/9933Sk","tlshash":"10e1aeffa9243523208d1187598e05aae65579e98e55ec0593e60372b42de1ca832b25","first_seen":"2025-03-15T05:55:29.57181Z","last_seen":"2026-07-28T19:23:40.835761Z","times_seen":78,"resource_available":false,"data":null}},"time_used":860,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":860,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/bootstrap-icons@1.3.0/font/fonts/bootstrap-icons.woff?4601c71fb26c9277391ec80789bfde9c","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.1.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.632Z","timestamp":1785263508632,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2026 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 20 May 2026 15:48:47 GMT","end":"Sat, 05 Dec 2026 14:48:47 GMT"},"fingerprint":{"sha1":"D4:05:C2:EC:C7:EE:2B:D0:08:68:0D:3D:33:77:48:78:43:E7:D1:E1","sha256":"ED:84:90:EE:71:BC:6B:5E:B3:D2:50:B0:23:3A:06:0D:E0:50:C6:B6:A9:09:36:E6:CE:FE:E8:66:89:EB:4E:C5"}}},"request":{"raw":"GET /npm/bootstrap-icons@1.3.0/font/fonts/bootstrap-icons.woff?4601c71fb26c9277391ec80789bfde9c HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://cdn.jsdelivr.net/npm/bootstrap-icons@1.3.0/font/bootstrap-icons.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=31536000, s-maxage=31536000, immutable\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: font/woff\r\nx-jsd-version: 1.3.0\r\nx-jsd-version-type: version\r\netag: W/\"1a13c-GxDOCA4lYqi36DlQRNPKg9wRKZk\"\r\naccept-ranges: bytes\r\nage: 2354339\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\nx-served-by: cache-fra-etou8220039-FRA, cache-bma-essb1270025-BMA\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 106812\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":106812,"size_decoded":107558,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 106812, version 1.0","md5":"df7de9fe96a30f78c7f652f5b00ae016","sha1":"1b10ce080e2562a8b7e8395044d3ca83dc112999","sha256":"011ae1fe8e56c310d82ec3795cb8f86b9dea521dd0bc560a0ae0c2e87baedd4b","sha512":"d8cd580ed4119b0d31c9f3b7ea1b2002ccef31ba26cc6791114e5017e9ccffbfbf57b8611aafa52a8b3e76fc8f77b0d51d333dfcd5b293ddde61da3bbbbda47e","ssdeep":"1536:IEGBxy7wyLnYmvpdgacZtaiLBug50yslpdHfaKoGS3MUt7jCP/KgpL+HoEf7HhDt:0zy7pnYm/zcZta+UNoGS3gpL+Zwul","tlshash":"8fa302c0688d7e9ade37df31a226826373d3094a637c2d6f26997852c946e0f7637341","first_seen":"2023-05-02T21:54:45Z","last_seen":"2026-08-08T09:27:00.391522Z","times_seen":10534,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":11,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_btc","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:58.993Z","timestamp":1785263518993,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_btc HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=btc"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:59 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":246,"size_decoded":556,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"b93f2f5f910c9be6b93d57c3ce5d38fb","sha1":"e50b72a8387fa0913f437fb8ab034cb54db6951a","sha256":"261dd32033c6fe8ba859a57111616824463a72ca52816ece064d47e8614b17ab","sha512":"4d31a4dbf7fcbb69bfd43ab269aeca2be54efc66b41a07fe00e6996da31971d717fe73c46657b3038aa16740a1331a55ba76bf10a578a59f181486c76a7ce717","ssdeep":"","tlshash":"a5d05ed0be3888291c21e3d1f8ea176e684e848680c6460a1bedcaba256910c7737822","first_seen":"2026-07-28T18:32:22.814487Z","last_seen":"2026-07-28T18:32:22.814487Z","times_seen":1,"resource_available":false,"data":null}},"time_used":340,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":340,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Static/js/jquery.flexslider.js","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:47.995Z","timestamp":1785263507995,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Static/js/jquery.flexslider.js HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 27 Apr 2023 15:40:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"644a9760-e028\"\r\nexpires: Wed, 29 Jul 2026 06:31:48 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":57384,"size_decoded":12900,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (325)","md5":"242034cacf5d08f9a4f4df40208f830b","sha1":"56cffde8b9ca0b7e3161714b786651ac2b87a953","sha256":"487639627bd943c11e40764b968904c921e505bb73f0ae5d7367c8c8ff84a526","sha512":"fcbb4ccb030b5d9dbd4c96c44de7387ba9dd4963f14034ddb2a0ae77ef10e08167290d56565afceebd03e68a3d40d3bdceea903490e6bd0c509afa9ef034582c","ssdeep":"768:oILMsh61e6anxUS1cdeAzMuwskDkg9iPFi2PU1SFzuLdu:kynN8P1PU1SFzuLdu","tlshash":"3043ff1a61b2166589a372ae2f5fdc14eaf78343901dc969fddd030cdf4442806b6bf9","first_seen":"2023-03-07T17:01:43Z","last_seen":"2026-08-05T02:35:19.338928Z","times_seen":830,"resource_available":true,"data":null}},"time_used":638,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":638,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/new/6.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.018Z","timestamp":1785263508018,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/new/6.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 19 Aug 2025 07:15:33 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68a42495-32a1f\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":207391,"size_decoded":207466,"mime_type":"image/png","magic":"PNG image data, 856 x 400, 8-bit/color RGBA, non-interlaced","md5":"670ecaecfff72572e89a339d91a08e3b","sha1":"4b1816f239c121542c68fc139ca857ff209b88bd","sha256":"958ba7b0f46edb40e8a5bdc204cb275f2bf4e4c6f8e23653cf0ae871c9289308","sha512":"da4f2bddccb6f4864a7b6adb63534625219fdef47d7406ca3595a03a4df83d87a73352c0ba77879b483c3546e8894955108dd21411781f4df1de18eda9c53044","ssdeep":"3072:XH4NNTrl3D6lyiiXrJ92w3ImKcStCkEWb7Z9Z7I0wzBRavyqWnqv/8s35671L3xI:XH4H9DbpJgw3IWSwidwzjpPu3QphNpTI","tlshash":"781422a47e53801ee12e50132fade20c84697ca79b45a7b45f89360ac7effa151e1fd0","first_seen":"2025-08-19T12:54:30.883822Z","last_seen":"2026-07-28T19:23:40.830087Z","times_seen":16,"resource_available":false,"data":null}},"time_used":892,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":892,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/xm/FIL.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.031Z","timestamp":1785263508031,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /xm/FIL.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 07 Nov 2022 05:50:05 GMT\r\nvary: Accept-Encoding\r\netag: W/\"63689c8d-4879\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18553,"size_decoded":18856,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"41173f1fac2d8fe9fcf0285d0e7d6acd","sha1":"2262cedafbeddfe8d47ffbd2ac442b0b92e681fa","sha256":"25f2ced7253fac8937192733091dc789301446bb306bdda4e7814999d03dc692","sha512":"73354a1dab8eec7ae4d2ea5c65ae235c9b9fe2860806f1a4825284a6971a001754649f868c91bd9e29e4141e6ac8bbad092296439678b02a26e9d3463e0ea070","ssdeep":"384:ci7lfIt9MsjkET7AlZaxL9qiCH5cAWs0IMzz9zgDlV52smW7NZorx:lRfTstPSa9SDIzVgbkXWAN","tlshash":"c682e0aee2d37c184a5bcb144be634b26cd23e694b636c43703dc70c9e5481963a327b","first_seen":"2023-05-22T05:59:44Z","last_seen":"2026-07-28T19:23:40.84226Z","times_seen":354,"resource_available":false,"data":null}},"time_used":880,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":880,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/xm/CHZ.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.036Z","timestamp":1785263508036,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /xm/CHZ.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 03 Nov 2022 15:52:10 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6363e3aa-13f5\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5109,"size_decoded":5422,"mime_type":"image/png","magic":"PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced","md5":"2b457b22e9dd64aff296943ce340e39b","sha1":"1a6df942d2444ffe89314234db270f625e99b04c","sha256":"5cb03d2a32e3eb095ff58017138d1dd83cbb535bc62800c4fc9079bc4a5eaf28","sha512":"8043dea1d186d07a7d18aaae7ecf65d4f1731f14a85e7a96efe9fe67969b9154cd978a175274f475a1882f031a45a5ec36b1cbd9273c15bcd49b6c627990b205","ssdeep":"96:rKMGADzM6KSkXoJi+qQFxda8WP2mdVyHTkR6I9RapHhQe52sg:3GADA6hkXJ+qgxdIxjyHQM0apHKe6","tlshash":"6eb17d7f1860523e53680e3112c187e411e20c937e984b568cb19a1867bff5c17f49fb","first_seen":"2023-06-03T12:58:34Z","last_seen":"2026-07-28T19:23:40.863696Z","times_seen":330,"resource_available":false,"data":null}},"time_used":875,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":875,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Static/img/footer_bg.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.611Z","timestamp":1785263508611,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Static/img/footer_bg.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 27 Apr 2023 15:28:55 GMT\r\nvary: Accept-Encoding\r\netag: W/\"644a94b7-119d3\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":72147,"size_decoded":72500,"mime_type":"image/png","magic":"PNG image data, 1920 x 557, 4-bit colormap, non-interlaced","md5":"562cc9b1820c0ccdf37b791052e55f53","sha1":"4be74f05976a4a9c7799afed24ce8bb23d5d7242","sha256":"130e1e871953055ac817d46049a5c056e37947749334d77bb1f4f775463d8759","sha512":"8f082c1a4aba14f2c86c1f9e670500075e9404443136b3a305a321e7a169b7fe71aa12306458e95efbb14f2cfc9916e845f086d6983e7996c3bea7e4b6784766","ssdeep":"1536:Zoy+yCtXmthvjqKfolFq/KBszk15nMrbrEdXA5aKSlAg952ucBXDvKqQ1:ZoyFEQh7sO/K5CEdXA8K4Ag952uIzyqY","tlshash":"2b63021728ae31e007319a3a52ed4a93e85e4fecf749ec161df1704fa294aca5c2617d","first_seen":"2024-10-23T13:33:33.49242Z","last_seen":"2026-07-28T19:23:40.869467Z","times_seen":417,"resource_available":false,"data":null}},"time_used":917,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":917,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_uni","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.943Z","timestamp":1785263508943,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_uni HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=uni"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:49 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":249,"size_decoded":557,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"54824f8ac0a14c54bc3f6bbf33b8970a","sha1":"51e3861ed172ea7c84853f80c185c439ecbee7a9","sha256":"a4b96de826b329a92d97726bd1475297c7f430fee06371caec37ec6b09075c0a","sha512":"30cc802ff13abd4f9158d667e1c3cb39876cf745a4c3d2c7bf38bf18bb0e583f1be04a39d7036ec2c9f14b7f7541584a5023a3591e9bc03e537fdd828d5e8142","ssdeep":"","tlshash":"9ad0a55c3a7e4d250c135fd16cd5172d944e8195c145434d77fe8f54166c50c3765417","first_seen":"2026-07-28T18:32:22.950273Z","last_seen":"2026-07-28T18:32:22.950273Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1910,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1910,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_eth","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:57.953Z","timestamp":1785263517953,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_eth HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=eth"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:58 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":247,"size_decoded":557,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"80a062b8c8f573b1d758b274c3a6eef3","sha1":"ce40def67f98f24b23f44af8fa911a38bca00864","sha256":"9f63e878be16e243c43ea908d29984323ac8d11b9176dc124432990c78c6af71","sha512":"d1ec170f59974ae8b47d19c52677f0636b8d9b023327603b63d57e57c593be48f17e0e0fbfa58091c841730c367c37f8fbf1e6275f6ba5546145f29ec177cc39","ssdeep":"","tlshash":"61d05ea4be7848250c22a3d1b8da2b6e2e5d4842c089c6595afe8e6918e850c7262c75","first_seen":"2026-07-28T18:32:22.924739Z","last_seen":"2026-07-28T18:32:22.924739Z","times_seen":1,"resource_available":false,"data":null}},"time_used":328,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":328,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_btc","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:32:06.998Z","timestamp":1785263526998,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_btc HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=btc"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:32:07 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":246,"size_decoded":556,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"ff21a961cc1f4a883acccaad380d9923","sha1":"a1b772fb96281c04bf7e508ed143b1fcf61207e8","sha256":"113444ca12b36c1ec52ee6e4335fa3fbfef4f1715b381535ec1b3973702aaebf","sha512":"978fd86b8bb33f5e1b6710259c94016d1f23081049d38517316515a0766d64d3ea7e1abffc7a1a5cb20b23e51a49587e564fc48c2eb42b74a9cdf45025d8cd49","ssdeep":"","tlshash":"b6d05bd07e354d151c21d3d1f4d5175f148e544644c5534a5bed8e79647920c3727812","first_seen":"2026-07-28T18:32:22.857945Z","last_seen":"2026-07-28T18:32:54.829092Z","times_seen":2,"resource_available":false,"data":null}},"time_used":342,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":342,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Home/static/imgs/hot-2.svg","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.008Z","timestamp":1785263508008,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Home/static/imgs/hot-2.svg HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Mon, 04 Jul 2022 17:20:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3214c-1ade\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6878,"size_decoded":2067,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"dd9279cfb541640afabd1d33527f1df4","sha1":"6d828472cfaa863044b92e5c884ea8d658df4d36","sha256":"6466ed8936ba729058d7e2ae3bc93a7d8f3fb8ec385d7e3c29f21968cbd5aaef","sha512":"53a3ddf98f9ea97b18e73e5ca308a452a16142e672dcf3d1c86e61cc83e94729651eb41301bc902cc2510178e0c708fb5b66f3bf1e4ccde0fcf5f61aff77fcf5","ssdeep":"96:QRslJ3A7/H2wd9Qci3A7/H2wd9Qccra97a9tx+duKNBBbNwKDNlUs7vkSqD:QWS/Zd9z/Zd9ia97a9tKblLs","tlshash":"96e197f7e1b8b993d246c771ed52485528aa84fbeb810391c2e8ff9a6135cc04c4edd4","first_seen":"2023-05-02T21:54:45Z","last_seen":"2026-08-03T02:44:22.699192Z","times_seen":5116,"resource_available":false,"data":null}},"time_used":902,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":902,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_btc","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:32:10.996Z","timestamp":1785263530996,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_btc HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=btc"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:32:11 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":246,"size_decoded":556,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"ff21a961cc1f4a883acccaad380d9923","sha1":"a1b772fb96281c04bf7e508ed143b1fcf61207e8","sha256":"113444ca12b36c1ec52ee6e4335fa3fbfef4f1715b381535ec1b3973702aaebf","sha512":"978fd86b8bb33f5e1b6710259c94016d1f23081049d38517316515a0766d64d3ea7e1abffc7a1a5cb20b23e51a49587e564fc48c2eb42b74a9cdf45025d8cd49","ssdeep":"","tlshash":"b6d05bd07e354d151c21d3d1f4d5175f148e544644c5534a5bed8e79647920c3727812","first_seen":"2026-07-28T18:32:22.857945Z","last_seen":"2026-07-28T18:32:54.829092Z","times_seen":2,"resource_available":false,"data":null}},"time_used":334,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":334,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_comp","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.953Z","timestamp":1785263508953,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_comp HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 9\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":9,"data":"coin=comp"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:49 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":231,"size_decoded":548,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"64435edc391f738dea170be378c8ad33","sha1":"2d91d1391f98d82d304478705506dacd2abcf963","sha256":"38b160cfe4c1fe223f8bc9f94b7772cd08d99c3d0e3fa771fe7a37ad77043eaa","sha512":"f64cc8fba874440febcfb02392c17be552b76fb59c3c64d02ffe1b359b7fcb8fee98fedcf332f014964d31ae33b8d4153b7ec5d4f15ff33d03080022a53f21d6","ssdeep":"","tlshash":"47d0a7e03f3885221c23afd1a8e6276f385d48868084920a17fe9f7814ad51d7b11c26","first_seen":"2026-07-28T18:32:22.952849Z","last_seen":"2026-07-28T18:32:22.952849Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1900,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1900,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Static/bootstrap5Slide/fonts/flexslider-icon.woff","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:51.013Z","timestamp":1785263511013,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Static/bootstrap5Slide/fonts/flexslider-icon.woff HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/Public/Static/bootstrap5Slide/flexslider.css\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:51 GMT\r\ncontent-type: text/html\r\ncontent-length: 504\r\netag: \"66541f8f-1f8\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":504,"size_decoded":659,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"b7f6c24fcd751e5a437f9a3700aa7074","sha1":"7462bb1e33a7a761363945ff31ff3e2b3a58c04e","sha256":"d7ee9daf35876b1fd867a1bff334dd0a2bf441f47b2cb3b8c4b7e33723d58678","sha512":"0af608e297389b14ff920bdc9335b777dd8314abe14da03627c62cf672b4218c47f7a91de98bd4e59e0b978c1f9ec1cb6ba2758542e51b0044b7972a486b8cfb","ssdeep":"","tlshash":"54f09e8340e14429111041302e9060054f4b7d8bdb5b4d0138afb1bbefc6a84c5635cc","first_seen":"2024-12-24T17:17:56.68958Z","last_seen":"2026-07-28T19:23:40.836319Z","times_seen":84,"resource_available":false,"data":null}},"time_used":321,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":321,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Home/static/css/base.css","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:47.978Z","timestamp":1785263507978,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Home/static/css/base.css HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 04 Jul 2022 17:20:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62c3214c-64a5\"\r\nexpires: Wed, 29 Jul 2026 06:31:48 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":25765,"size_decoded":6295,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (846)","md5":"8739b7f6cc1db5ea89afe0a14afacd7a","sha1":"f7dc32e9b67f5a0190cdb0d641f141294522fe46","sha256":"446377cfd8abce9140615cc2df1cfd3c2e8f908f179cbe1c7bc6209ef1bd2f3e","sha512":"8daa0f9ebd76dc9e94f4c5cf0acd3380b91abe7186648e41574d747c9cd0bfc2a6c28ba80c0e34ce2aba079782d9061d73bb37010cd77f7f59bc5879a19612a6","ssdeep":"384:BpFiOVTjRmNi2RoLy6IbRiWc2FDwFxYorvRnEkEZ58s8BXR8G8LrB888t7jL5ZBe:Y4cN39FDwFx9EZS9YzqtRB8TF3MDdu","tlshash":"12c295a7dfa30901b81bc5a41ff9ab55236c8017910bdebd7fc53648cf462d898a27c6","first_seen":"2023-06-09T02:38:16Z","last_seen":"2026-07-28T19:23:40.848946Z","times_seen":2269,"resource_available":false,"data":null}},"time_used":309,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":309,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_etc","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.940Z","timestamp":1785263508940,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_etc HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=etc"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:49 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":234,"size_decoded":546,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"c571ab61096a01825ec0103854a13f2a","sha1":"8f981aa8c96b50bf8dfe099115023147e56d4d35","sha256":"0ccd5e1065bfec6733650a93c4dd3421254e4f3e6f7f3ecf55c5d10fdeb677c4","sha512":"b58d8cf9659ad0a271af6c42ab61087bd9fd9a95b9a5ce66d52d0b79437e60d6d34ccfc684017a1f366462a6a23fc360a2b36db204528a766fa6fe66ae1f1037","ssdeep":"","tlshash":"68d0a7907f3c45150d22e7d1ecd63b5e558e508a80c7934d5abe8ea965e861e3522c22","first_seen":"2026-07-28T18:32:22.926708Z","last_seen":"2026-07-28T18:32:22.926708Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1913,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1913,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_btc","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:32:00.991Z","timestamp":1785263520991,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_btc HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=btc"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:32:01 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":246,"size_decoded":556,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"b93f2f5f910c9be6b93d57c3ce5d38fb","sha1":"e50b72a8387fa0913f437fb8ab034cb54db6951a","sha256":"261dd32033c6fe8ba859a57111616824463a72ca52816ece064d47e8614b17ab","sha512":"4d31a4dbf7fcbb69bfd43ab269aeca2be54efc66b41a07fe00e6996da31971d717fe73c46657b3038aa16740a1331a55ba76bf10a578a59f181486c76a7ce717","ssdeep":"","tlshash":"a5d05ed0be3888291c21e3d1f8ea176e684e848680c6460a1bedcaba256910c7737822","first_seen":"2026-07-28T18:32:22.814487Z","last_seen":"2026-07-28T18:32:22.814487Z","times_seen":1,"resource_available":false,"data":null}},"time_used":329,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":329,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_eos","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:32:13.996Z","timestamp":1785263533996,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_eos HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=eos"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:32:14 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":25,"size_decoded":408,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"68ac40a84898f40747d958e0c0941c75","sha1":"a033ad6d2dddc4dcbabdf38740c1a8cd192dcf0d","sha256":"232ef71afd2e2d3a4a886bd164ac9ae400955e7f71505d3570e31635b2ecc00e","sha512":"0707d815ab13b1d6804fdee766d93c98b78e2ceddafbecda34f34372d1d689ada7e8777adf7264eb03a393dafa59e80ce9810cb74592580f0be1ac8ef4f453c2","ssdeep":"","tlshash":"ec70000002afa8a3028200288c0f000000ac28882ca080008c2822288a200028a00020","first_seen":"2023-05-02T21:54:45Z","last_seen":"2026-08-03T02:44:22.624109Z","times_seen":351,"resource_available":false,"data":null}},"time_used":333,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":333,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/xm/1INCH.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.024Z","timestamp":1785263508024,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /xm/1INCH.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 03 Nov 2022 15:52:08 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6363e3a8-2970\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10608,"size_decoded":10957,"mime_type":"image/png","magic":"PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced","md5":"15d97161b65ddac5d4abad667dcddff6","sha1":"cc213aa8e905bee08ba0cb391d9ac525111270b9","sha256":"5c15c5889ca614021ec4458b6fa8180585a9d648161788206ab69a1173ddb780","sha512":"0a0d2b8f8262476940647be1d45891434d1f3ed1169161e2f5d6eb333f8168e89beb7719c846c4efb495a628a9f4fae810183b4ce663adddbcf6aa1e14b71d37","ssdeep":"192:5fSoETndenJtcoAPbMYjSVrz5pnYSPQcOGslchh4hplrk5M:hSHTCmu5yJfjBplAM","tlshash":"0a22bf4abc657815814f24db81a6cd1d86ff8dc17926c12d248ed22803daca7f8ba683","first_seen":"2023-06-03T12:58:34Z","last_seen":"2026-07-28T19:23:40.835155Z","times_seen":321,"resource_available":false,"data":null}},"time_used":886,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":886,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/xm/XRP.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.027Z","timestamp":1785263508027,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /xm/XRP.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 04 May 2023 13:56:01 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6453b971-f61\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3937,"size_decoded":4306,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit colormap, non-interlaced","md5":"7f4feb23b128c1683aa4bc450a625aa4","sha1":"4c022a2d5fd79660e39f614b0df8ce8bce9bcd90","sha256":"9b749ac3ebc1d5d7efb452e30695a43e340bafe8864abc48af63a548f607fddc","sha512":"e456437862ad7a67dbb471d853f738191e3f0fa372c87ac14e0e362270b8dce3b574b9302b9c33e4584eca98a8525490ef16b9442bf7cbff467fd361a9a345ae","ssdeep":"","tlshash":"7b813d97ef90cf2c66e7b7758baf5c45f4613820e0d7d1cc441a19a4618a693c9f2378","first_seen":"2023-09-30T09:31:08Z","last_seen":"2026-07-28T19:23:40.839116Z","times_seen":277,"resource_available":false,"data":null}},"time_used":883,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":883,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/xm/AAVE.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.033Z","timestamp":1785263508033,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /xm/AAVE.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 03 Nov 2022 15:52:09 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6363e3a9-1d26\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7462,"size_decoded":7596,"mime_type":"image/png","magic":"PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced","md5":"1e4fb53364a553f65bd6ec3f3e023efb","sha1":"0b0709507914d48422e154e322ad67ad18bb4b76","sha256":"03579a2133847bd338e3e36c718ade13cb5beff8877c82e9792df2fed29e93a7","sha512":"531c3cb811e370eb0c3ee723087582ab226bfac6228ffbbe80deaa1b59f51579c9c6bb89a7f4c0a5c88034758cf457bc0a4320ba6ab0fdd560a64e21859b0f5a","ssdeep":"192:DJGYhMdsWTVDAtOW7NdIJ5kyKXgLnX/A1biUEEb17RXZsjX:DJGhieAAWZiienX/YbiUEG1xZsjX","tlshash":"ddf18effc1a105a3e60dacb08a74dbd8b6e1a425fa8c6652fdb6d3053d005335c75aa2","first_seen":"2023-06-03T12:58:34Z","last_seen":"2026-07-28T19:23:40.85063Z","times_seen":336,"resource_available":false,"data":null}},"time_used":877,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":877,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Static/img/02.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.047Z","timestamp":1785263508047,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Static/img/02.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 27 Apr 2023 15:29:08 GMT\r\nvary: Accept-Encoding\r\netag: W/\"644a94c4-1774\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6004,"size_decoded":6379,"mime_type":"image/png","magic":"PNG image data, 164 x 164, 8-bit/color RGBA, non-interlaced","md5":"427f187da485ae1eb8b37166ea4bdb52","sha1":"e563c994b0b025e87e59c6f05119290af8200766","sha256":"f5a54d35e121d6b7927803c6b3e9740ef66e19b0a3271be1f78fbbfdd7258ac9","sha512":"3004c92f5edac978b91b586b519a03e0a4ab40319517bedd8039278b3683a25ea0c0d1c8f927478ab80558bdb92a7a5ba7669bf6c7aff54de4e3f07166dfee26","ssdeep":"96:UZdW5NqbiSYZC2RX/QHvfQnLREVXEECneHcE4P1A1fzqqHPTEhf2N0l1NlwW/D:ULECVYEI/ofQLRUjpHKPSzbG2N0hl/7","tlshash":"23c18ed38302107f52f54f6140f990b7a57b04ae868532e8f67969c7c68df5c947a0cd","first_seen":"2025-03-15T05:55:29.528231Z","last_seen":"2026-07-28T19:23:40.851243Z","times_seen":78,"resource_available":false,"data":null}},"time_used":865,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":865,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_eos","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.956Z","timestamp":1785263508956,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_eos HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=eos"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:49 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":25,"size_decoded":408,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"68ac40a84898f40747d958e0c0941c75","sha1":"a033ad6d2dddc4dcbabdf38740c1a8cd192dcf0d","sha256":"232ef71afd2e2d3a4a886bd164ac9ae400955e7f71505d3570e31635b2ecc00e","sha512":"0707d815ab13b1d6804fdee766d93c98b78e2ceddafbecda34f34372d1d689ada7e8777adf7264eb03a393dafa59e80ce9810cb74592580f0be1ac8ef4f453c2","ssdeep":"","tlshash":"ec70000002afa8a3028200288c0f000000ac28882ca080008c2822288a200028a00020","first_seen":"2023-05-02T21:54:45Z","last_seen":"2026-08-03T02:44:22.624109Z","times_seen":351,"resource_available":false,"data":null}},"time_used":1898,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1898,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Ajaxtradenew/obtain_xmr","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.963Z","timestamp":1785263508963,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"POST /Ajaxtradenew/obtain_xmr HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 8\r\nOrigin: https://gxecghz.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":8,"data":"coin=xmr"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:49 GMT\r\ncontent-type: application/json; charset=utf-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\npragma: no-cache\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":246,"size_decoded":556,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"60adbafa9cf3a12263a5704e4b760839","sha1":"233360f86a3f9c53fefeeb29187e0e9a15c8cccb","sha256":"02895db1f94f2786bc1b1f97af272c97d8b84357cca3af6786faa0ca201cfacd","sha512":"d62c80e3a80718b4b1dce4686b8cd00bb04722c226d3a2658f09370b5c3c9ac46a1030fbf6df29f1e6c5ba2b2235531fcb54e4751dc8f20dfefa21af0a6d6c35","ssdeep":"","tlshash":"53d097f03d39482428669be6b8f723ba60ccc54ac08482127bedcb312668208b000c13","first_seen":"2026-07-28T18:32:22.958213Z","last_seen":"2026-07-28T18:32:22.958213Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1890,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1890,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Static/img/laba.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.011Z","timestamp":1785263508011,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Static/img/laba.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\ncontent-length: 657\r\nlast-modified: Thu, 27 Apr 2023 15:28:59 GMT\r\netag: \"644a94bb-291\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":657,"size_decoded":997,"mime_type":"image/png","magic":"PNG image data, 41 x 30, 8-bit/color RGBA, non-interlaced","md5":"9922ce5610e60c1b36d997c0a1e19f3d","sha1":"de825176c21b98e6f80ad0821374b33832087686","sha256":"a958b6d624b2d1320fb2a3831b68ed1665208db708aced2868aee7bad5257206","sha512":"7505d8c2edea3e033c0148ae9099333a7f39ce6d77bb7ab2e78e8c9292efed5a563b23e0c34bfa8b3e2d6d3721d9948c5322742dfa99828e33262d24a96a4f33","ssdeep":"","tlshash":"a20128d7417320bd6a8921e34c814447da733fff06555951103cc76650f755e627a642","first_seen":"2025-03-15T05:55:29.555381Z","last_seen":"2026-07-28T19:23:40.872348Z","times_seen":81,"resource_available":false,"data":null}},"time_used":968,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":899,"receive":69,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/xm/BCH.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.022Z","timestamp":1785263508022,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /xm/BCH.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 03 Nov 2022 15:52:10 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6363e3aa-e86\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3718,"size_decoded":4092,"mime_type":"image/png","magic":"PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced","md5":"ceb22af48692db74ae22f6892bd8cc7d","sha1":"a169f22c6828df50428b9c044ccd8f92834c122e","sha256":"1ba1c59bbd92737d720f5d5df59d2674830fe6c09deb757e23540dccecb5310a","sha512":"22d0b05dcb30a9fdd4554da487b9558fe945d89e0c969a932f07fe783e06449cfc5b8e5c15d9839e8ab0a46377b3e55a71263b6afac7a586aeb04f2bbac2c1c6","ssdeep":"","tlshash":"14717ed19717ea53fa27439331241f3759afc6950e902580879292d51215ac711962ac","first_seen":"2023-06-03T12:58:34Z","last_seen":"2026-07-28T19:23:40.873367Z","times_seen":373,"resource_available":false,"data":null}},"time_used":888,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":888,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gxecghz.com/Public/Static/img/05.png","fqdn":"gxecghz.com","domain":"gxecghz.com","tld":"com"},"ip":{"addr":"112.213.108.93","port":443,"asn":152194,"as":"CTG Server Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gxecghz.com/","date":"2026-07-28T18:31:48.050Z","timestamp":1785263508050,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gcexx.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Sun, 31 May 2026 16:01:36 GMT","end":"Sat, 29 Aug 2026 16:01:35 GMT"},"fingerprint":{"sha1":"E8:A1:4B:2C:38:E3:BF:9D:67:5F:53:61:9D:9A:01:2B:64:EC:6E:A6","sha256":"DE:FA:6C:AD:A8:60:A7:E4:75:CD:57:2D:4E:3B:13:E6:7C:8C:63:92:64:9F:64:D9:DF:44:D4:6E:01:A2:1A:5D"}}},"request":{"raw":"GET /Public/Static/img/05.png HTTP/1.1\r\nHost: gxecghz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gxecghz.com/\r\nCookie: PHPSESSID=vmook9oevsc0dp11u3t676hlu7\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 18:31:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 27 Apr 2023 15:28:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"644a94ac-1909\"\r\nexpires: Thu, 27 Aug 2026 18:31:48 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6409,"size_decoded":6784,"mime_type":"image/png","magic":"PNG image data, 166 x 166, 8-bit/color RGBA, non-interlaced","md5":"e002b0ae266b131f28f491204c9dd839","sha1":"77dae3fb93ddd56d003a0b6d57b4c57dfa6f48fc","sha256":"052368ff965c4c65e69ddc97c452d04b0f220a8309607ea1d7249c89a9d80ffc","sha512":"3670da28afed6d7a8bb27a2beafb51858626e7895ddd87b416dc0b3860cec91fc11bd0f727450f7518056a5d6a90aa51edd62fdb6559cbe1337161483ad17ff4","ssdeep":"96:7eeJGUxxQWBGmerw7+xzUPvZRdwSChV7dCBBrvy89EJlZ0RJAp87ay9:7ZZxtKrC+xz+RKBhHKFvTWJkReC7aG","tlshash":"ddd19dc667ad7a5f5e112a1b6c12da8ac0aff1b1a932843ab43e590bc5a6010e0bd745","first_seen":"2025-03-15T05:55:29.560362Z","last_seen":"2026-07-28T19:23:40.860887Z","times_seen":78,"resource_available":false,"data":null}},"time_used":861,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":861,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-28","alert":"Phishing Block","trigger":"gxecghz.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"gxecghz.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}