{"report_id":"4f221494-725d-4590-b7d9-994b7a474fae","version":6,"status":"done","tags":[],"date":"2026-03-24T00:49:48Z","url":{"schema":"https","addr":"enus-user.ghost.io/bridge/","fqdn":"enus-user.ghost.io","domain":"ghost.io","tld":"io"},"ip":{"addr":"151.101.239.7","port":0,"asn":54113,"as":"FASTLY","country":"Norway","country_code":"NO"},"final":{"url":{"schema":"https","addr":"enus-user.ghost.io/bridge/","fqdn":"enus-user.ghost.io","domain":"ghost.io","tld":"io"},"title":"Trezor Bridge® | Official Trezor Connection Software","dom":{"size":26460,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5578)","md5":"4c88dc05412e83bd23d460a94f0803f1","sha1":"03011be931b1548a5632dbf10ce436d16aa812ca","sha256":"02377e637938eee57a46ed2bbedf51cc454da686cedabd4b9bf7906861c6309f","sha512":"e57ec1143f5b984b3680c2984daaec70ef6c92698b2dcadc3fee3c03b370273aeca063df20ab51c53d804bbd4efce7f340a8bc382d46d9d2372e76e421c85314","ssdeep":"768:WzYzrP34Qvt6AECtv02ECoMBhzW9Q3vo13azA:WzYn34EEtCoMnWuw13a0","tlshash":"01c2da6661f42539021303da66d2378dba33e55fe58e1990f1fcc1781f82de286b398e","dom_hash":"domhash0c786c03c28357cc5c55150d1a389c1b","first_seen":"2026-03-24T00:49:52.065292Z","last_seen":"2026-03-24T00:49:52.065292Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"enus-user.ghost.io/bridge/","fqdn":"enus-user.ghost.io","domain":"ghost.io","tld":"io"},"ip":{"addr":"151.101.239.7","port":0,"asn":54113,"as":"FASTLY","country":"Norway","country_code":"NO"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-28T00:49:48Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-23","alert":"Sinkholed","trigger":"enus-user.ghost.io","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-23","alert":"Sinkholed","trigger":"enus-user.ghost.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"104.16.174.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2026-03-22T22:34:23.857339Z","alert_count":0,"request_count":2,"received_data":2285611,"sent_data":963,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"enus-user.ghost.io","ip":{"addr":"151.101.131.7","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2011-10-02","domain_rank":0,"first_seen":"2026-02-28T11:36:59.874969Z","last_seen":"2026-03-23T20:50:26.35423Z","alert_count":28,"request_count":14,"received_data":292519,"sent_data":6840,"comment":"","tags":null,"fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"Ghost:6.22","description":"Ghost is a powerful app for new-media creators to publish, share, and grow a business around their content.","website":"https://ghost.org","common_platform_enumeration":"","icon":"Ghost.svg","categories":["CMS","Blogs"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]},{"name":"Google Cloud Trace","description":"Google Cloud Trace is a distributed tracing system that collects latency data from applications and displays it in the Google Cloud Console.","website":"https://cloud.google.com/trace","common_platform_enumeration":"","icon":"google-cloud-trace.svg","categories":["Performance"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"enus-user.ghost.io/public/cards.min.js?v=8b29e623b6","fqdn":"enus-user.ghost.io","domain":"ghost.io","tld":"io"},"ip":{"addr":"151.101.131.7","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"91fcf6fd1c2761b582cda90883e5ff94","sha1":"c9c4aef48fd4c48f1a38d4f37460150385d5551b","sha256":"0fa389a717242bfe900c9d688e7e086b5db05a740db66317011ae6c09be3eb80","sha512":"9fa6d7a307e6483ed83fa43845cce9bc993ee188fc4a5ce6a5d1c0e9e657bdfb401096634513b50a3418ee83e158c2c67ba22a4d7dd8bad93bda5c98a0d2d4d4","ssdeep":"96:u8PUphCyqtL9LYedNLYCKX7jKjh9CQrclQ9xtCNDFmSe:8phCyqR1YedNLYCKajh9CQrgQ9xQZTe","tlshash":"b8e1049632682b3642966ee357dc12d07ea40ac9f20e0a746077ddcd16b9cc243b93e7","size":6892,"data":"","first_seen":"2025-06-21T00:42:26.174777Z","last_seen":"2026-08-11T07:19:43.042883Z","times_seen":3988,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"enus-user.ghost.io/assets/built/source.js?v=8b29e623b6","fqdn":"enus-user.ghost.io","domain":"ghost.io","tld":"io"},"ip":{"addr":"151.101.131.7","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"06da1ab26a236c21e474ef93709bfc6b","sha1":"a573c212aa648c587934343d9089f7c08729c527","sha256":"8609efddd15136b71f2113a7afdb7c272752bf062ab84e82ceb4e2757517b84e","sha512":"5ee1109cea4c0a6ef5380ce00c2669345412a2802682d5c71912942ed784a0e6300a63e182582755a60a0a200fe9306342d1b90a4245b2027d7ebecf6decca14","ssdeep":"768:RZ00sMczA7o64bFMZRyxfjUp7PDArx9/RTnfTkqr2IRRMfogj8DcX:0t/A7AKZRf7PDArxjTn79r2IRqZtX","tlshash":"9b334be8315176b703d76176617fa50e23322aaaac0a80407c36dce66cf8d59527ff6c","size":52613,"data":"","first_seen":"2026-01-23T22:00:43.180907Z","last_seen":"2026-08-10T19:22:13.117642Z","times_seen":242,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"enus-user.ghost.io/public/ghost-stats.min.js?v=8b29e623b6","fqdn":"enus-user.ghost.io","domain":"ghost.io","tld":"io"},"ip":{"addr":"151.101.131.7","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"8d277181953c9efeddf289903f07fbc1","sha1":"6cf5d70a1be024d87b5c5cd8db2d18304255e859","sha256":"deae6adf1d10fdb425bda1ad02c7b9606f23bd9525be71f26c674509f7708d12","sha512":"e0ac5f79e1987d91cc0b5e563f8b784e9d4214b7ce92c565b73e5ba5d50353b40a05a5d6b6f361c4a7f015f6f3db27e7ad90591a6423c35da84bd0b084696963","ssdeep":"768:bCBeCTGRx9s7+qhm6+CwbCQZ16xHK35dhX+URyz2dg4l:kPRhmWwvZ8Ktr","tlshash":"6f03408d91ae22134efbc0113be7fbe56477e6c844c65e037d268e44801dcb673b6a99","size":39811,"data":"","first_seen":"2025-09-18T21:28:58.858668Z","last_seen":"2026-08-10T19:22:13.13631Z","times_seen":910,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/ghost/sodo-search@~1.8/umd/sodo-search.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"104.16.174.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"1b38addebf76db903d4cab29810635fe","sha1":"a9ff66b42d8f142c9149e00b07069ba69472b11d","sha256":"4b28c3e2ef4abafdc39c38fc6227d7e6f3d566c38469446afee290949ea9b410","sha512":"03e26442d20e52f1abf4d00dc210675a15239c651906a7691cd654586cea02ef8e893c40152ae830293a88cae7f0f930d9f30ecf7f6f8833ac58354efc4478aa","ssdeep":"3072:0wQO1GXLjwQxdFO/hVr4hYhW4Fu/6VykSIsBrOrQSh0JiAPV7VOLnv:ulbjwo/O+lCykJstONv","tlshash":"f6543bdc32aab56657e216a5106f1107b3392c162c0c4814f52cfdea7ab590a61fffbc","size":289924,"data":"","first_seen":"2026-03-04T12:41:37.945589Z","last_seen":"2026-04-11T08:32:24.891885Z","times_seen":296,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/ghost/portal@~2.66/umd/portal.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"104.16.174.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"462069ea601bff9b0da035c35283d8aa","sha1":"e897486f7e9aa9059eb357fdc2e335a7d90e25b3","sha256":"f3869962571b6161c7c822ae830197ef973e2f6e4ee6e248e8e352a353d12448","sha512":"11b8df47e8a36159c54d26102d683416191fceb866a932caf77b9c1cfed07fbd185f5b26abddc7e808373537bbbf67fb30752131ab0bcf89fbfe6aca90d42bf9","ssdeep":"49152:2/2PRjn5WkBBl43jEgjIaKQMA3gt1Hoa3B0i+kgpHivY1ZHwV7RTu6e5:I+0i+m1W","tlshash":"0e957e99964472f10a9201a1740e3a2ab3e504786b49c1a5fcdc4d2c13e5e9ebf7f9fc","size":1993413,"data":"","first_seen":"2026-03-22T18:14:55.336288Z","last_seen":"2026-03-25T15:31:46.553469Z","times_seen":15,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"enus-user.ghost.io/bridge/","fqdn":"enus-user.ghost.io","domain":"ghost.io","tld":"io"},"ip":{"addr":"151.101.131.7","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"20149cffdc3c2617f208d3afde1ca1a0","sha1":"4f9ee5a3abe3b02f572e0ad416520a8cc601fae6","sha256":"177b1439363af96c42cd7371cca28de7b3a19c98a4f4767b89d3a4b47b60db91","sha512":"72ba3f79694a757c66110beda93d35df18acd2edb5e56b882087604f237dcc3de00ee1d89b076499eca0d4325d9fb392e5ebd203e45c86b5b15b39ec2113fabc","ssdeep":"","tlshash":"55118968bba301252bd382bc2fadd704581be48f9516ea083d3de8600f1074d4433ce6","size":903,"data":"","first_seen":"2024-11-21T06:43:46.363817Z","last_seen":"2026-07-13T03:24:26.027397Z","times_seen":2929,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"enus-user.ghost.io/public/member-attribution.min.js?v=8b29e623b6","fqdn":"enus-user.ghost.io","domain":"ghost.io","tld":"io"},"ip":{"addr":"151.101.131.7","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"76d7f9c7c5c4b0f99bca6af29aaaa4df","sha1":"f64555987bcbaec6537a84dbfcb7a6014a463b8c","sha256":"8d97fc3ba6ae7b879296907086fd0cd2e7d40651d9be04a6ce72255b7096a702","sha512":"19f7362ab3ff62e3af85596a08b7940b2dd653a894ed7c7166b91ecd57e78af957257e6968336bc0af493bab58a2ae8a544d6ecd633a20faf352a96a388196dd","ssdeep":"","tlshash":"b85185f72508621353f10220886f138072224ae9186650b9baa9895339bdf47d5b3fef","size":2972,"data":"","first_seen":"2025-10-01T17:11:02.568426Z","last_seen":"2026-08-10T19:22:13.118982Z","times_seen":3211,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"enus-user.ghost.io/public/member-attribution.min.js?v=8b29e623b6","fqdn":"enus-user.ghost.io","domain":"ghost.io","tld":"io"},"ip":{"addr":"151.101.131.7","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://enus-user.ghost.io/bridge/","date":"2026-03-24T00:49:24.373Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ghost.io","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 20 Feb 2026 16:08:31 GMT","end":"Thu, 21 May 2026 16:08:30 GMT"},"fingerprint":{"sha1":"4C:45:A4:15:CA:85:9D:99:BC:4D:A7:B6:3C:E7:8F:5E:21:5D:F4:2C","sha256":"01:5F:E1:24:63:34:94:E0:F1:2C:A5:59:18:44:31:EE:B4:5D:22:55:CE:55:52:10:B9:82:8D:08:0F:A2:D6:49"}}},"request":{"raw":"GET /public/member-attribution.min.js?v=8b29e623b6 HTTP/1.1\r\nHost: enus-user.ghost.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://enus-user.ghost.io/bridge/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nstatus: 200 OK\r\ncontent-type: application/javascript\r\nvia: 1.1 varnish, 1.1 varnish, 1.1 varnish\r\nserver: openresty\r\netag: W/\"76d7f9c7c5c4b0f99bca6af29aaaa4df\"\r\ncontent-encoding: gzip\r\ncache-control: public, max-age=31536000\r\naccept-ranges: bytes\r\nage: 4796\r\ndate: Tue, 24 Mar 2026 00:49:24 GMT\r\nx-served-by: cache-ams21043-AMS, cache-ams21031-AMS, cache-hel1410028-HEL\r\nx-cache: MISS, HIT, MISS\r\nx-cache-hits: 0, 7, 0\r\nx-timer: S1774313364.381059,VS0,VE26\r\nvary: Accept-Encoding\r\nx-request-id: 04443f4b-5f65-4338-872d-e79115040dde\r\nghost-fastly: true;production\r\nalt-svc: clear\r\ncontent-length: 1324\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}],"data":{"size":2972,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2971)","md5":"76d7f9c7c5c4b0f99bca6af29aaaa4df","sha1":"f64555987bcbaec6537a84dbfcb7a6014a463b8c","sha256":"8d97fc3ba6ae7b879296907086fd0cd2e7d40651d9be04a6ce72255b7096a702","sha512":"19f7362ab3ff62e3af85596a08b7940b2dd653a894ed7c7166b91ecd57e78af957257e6968336bc0af493bab58a2ae8a544d6ecd633a20faf352a96a388196dd","ssdeep":"","tlshash":"b85185f72508621353f10220886f138072224ae9186650b9baa9895339bdf47d5b3fef","first_seen":"2025-10-01T17:11:02.568426Z","last_seen":"2026-08-10T19:22:13.118982Z","times_seen":3211,"resource_available":true,"data":null}},"time_used":79,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":79,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-23","alert":"Sinkholed","trigger":"enus-user.ghost.io","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-23","alert":"Sinkholed","trigger":"enus-user.ghost.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"enus-user.ghost.io/ghost/api/content/settings/?key=9429a0a871fade6fb93cac485d","fqdn":"enus-user.ghost.io","domain":"ghost.io","tld":"io"},"ip":{"addr":"151.101.131.7","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://enus-user.ghost.io/bridge/","date":"2026-03-24T00:49:24.970Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ghost.io","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 20 Feb 2026 16:08:31 GMT","end":"Thu, 21 May 2026 16:08:30 GMT"},"fingerprint":{"sha1":"4C:45:A4:15:CA:85:9D:99:BC:4D:A7:B6:3C:E7:8F:5E:21:5D:F4:2C","sha256":"01:5F:E1:24:63:34:94:E0:F1:2C:A5:59:18:44:31:EE:B4:5D:22:55:CE:55:52:10:B9:82:8D:08:0F:A2:D6:49"}}},"request":{"raw":"GET /ghost/api/content/settings/?key=9429a0a871fade6fb93cac485d HTTP/1.1\r\nHost: enus-user.ghost.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://enus-user.ghost.io/bridge/\r\nContent-Type: application/json\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\ncontent-version: v6.22\r\ncontent-type: application/json; charset=utf-8\r\ncache-control: public, max-age=0\r\nstatus: 200 OK\r\ncontent-encoding: gzip\r\nvia: 1.1 varnish, 1.1 varnish, 1.1 varnish\r\netag: W/\"78f-03kcf6lXgbfAVJtz29t5+ASjwCM\"\r\nserver: openresty\r\naccept-ranges: bytes\r\nage: 1362\r\ndate: Tue, 24 Mar 2026 00:49:25 GMT\r\nx-served-by: cache-ams2100119-AMS, cache-ams2100119-AMS, cache-hel1410028-HEL\r\nx-cache: MISS, HIT, MISS\r\nx-cache-hits: 0, 1, 0\r\nx-timer: S1774313365.984539,VS0,VE26\r\nvary: Accept-Version, Cookie, Accept-Encoding\r\nx-request-id: 47159c87-9a8f-4a3d-9d67-9b36af2dabe7\r\nghost-fastly: true;production\r\nalt-svc: clear\r\ncontent-length: 898\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1935,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"c862a2314de0148b94e485619971ccc3","sha1":"d3791c7fa95781b7c0549b73dbdb79f804a3c023","sha256":"627cfdc18225ff3ddd524bead061a10214ef6567fef2d86978f48e5402842ab2","sha512":"a7d2579890cc4fe7bcf2c1d224aa2732991bdbcbf8229e3234297774487fec6085c1a3a387336403fc9174bde7fae0fadfc6a5bf0f50c09c13a2b3de227893c0","ssdeep":"","tlshash":"9441ef5a45049d3a8bd95281d81abdcf11bc82bb78446c74a8f4cf1e10f21fab32b197","first_seen":"2026-03-14T08:41:08.225489Z","last_seen":"2026-03-24T00:49:52.067101Z","times_seen":4,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-23","alert":"Sinkholed","trigger":"enus-user.ghost.io","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-23","alert":"Sinkholed","trigger":"enus-user.ghost.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"enus-user.ghost.io/ghost/api/content/tiers/?limit=100\u0026include=monthly_price%2Cyearly_price%2Cbenefits\u0026key=9429a0a871fade6fb93cac485d","fqdn":"enus-user.ghost.io","domain":"ghost.io","tld":"io"},"ip":{"addr":"151.101.131.7","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://enus-user.ghost.io/bridge/","date":"2026-03-24T00:49:24.972Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ghost.io","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 20 Feb 2026 16:08:31 GMT","end":"Thu, 21 May 2026 16:08:30 GMT"},"fingerprint":{"sha1":"4C:45:A4:15:CA:85:9D:99:BC:4D:A7:B6:3C:E7:8F:5E:21:5D:F4:2C","sha256":"01:5F:E1:24:63:34:94:E0:F1:2C:A5:59:18:44:31:EE:B4:5D:22:55:CE:55:52:10:B9:82:8D:08:0F:A2:D6:49"}}},"request":{"raw":"GET /ghost/api/content/tiers/?limit=100\u0026include=monthly_price%2Cyearly_price%2Cbenefits\u0026key=9429a0a871fade6fb93cac485d HTTP/1.1\r\nHost: enus-user.ghost.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://enus-user.ghost.io/bridge/\r\nContent-Type: application/json\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nstatus: 200 OK\r\ncontent-type: application/json; charset=utf-8\r\ncontent-version: v6.22\r\nvia: 1.1 varnish, 1.1 varnish, 1.1 varnish\r\nserver: openresty\r\naccess-control-allow-origin: *\r\netag: W/\"2bf-u3C5lVHHcES6NLR8/nPVHpdOzF8\"\r\ncache-control: public, max-age=0\r\ncontent-encoding: gzip\r\naccept-ranges: bytes\r\ndate: Tue, 24 Mar 2026 00:49:25 GMT\r\nage: 6216\r\nx-served-by: cache-ams2100125-AMS, cache-ams2100125-AMS, cache-hel1410028-HEL\r\nx-cache: MISS, HIT, HIT\r\nx-cache-hits: 0, 48, 1\r\nx-timer: S1774313365.986907,VS0,VE28\r\nvary: Accept-Version, Cookie, Accept-Encoding\r\nx-request-id: 64e6da78-592b-421b-b63e-4b9d0845dc71\r\nghost-fastly: true;production\r\nalt-svc: clear\r\ncontent-length: 337\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":703,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"fd9f47d9c9b52b938958adb15d0b7cbb","sha1":"bb70b99551c77044ba34b47cfe73d51e974ecc5f","sha256":"fc04fc4dd0898c8cb394fe63d16cc6705583c8bd32adba3e0f9a99b85845ba43","sha512":"ae1149cc1a673ae992ae581c3f11d47f06a1db6fb9b454604a255962406f68f76bb1e86a5e3e11b46925663bfa5c2c6f81841718f180564c896eb5a73c937104","ssdeep":"","tlshash":"6501feb444755870072616635c623fc2c4dd703f70a5cc257ec8560c82da972298b62b","first_seen":"2026-02-28T11:37:02.89068Z","last_seen":"2026-03-24T08:54:38.701646Z","times_seen":7,"resource_available":false,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-23","alert":"Sinkholed","trigger":"enus-user.ghost.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-23","alert":"Sinkholed","trigger":"enus-user.ghost.io","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"enus-user.ghost.io/ghost/api/content/newsletters/?limit=100\u0026key=9429a0a871fade6fb93cac485d","fqdn":"enus-user.ghost.io","domain":"ghost.io","tld":"io"},"ip":{"addr":"151.101.131.7","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://enus-user.ghost.io/bridge/","date":"2026-03-24T00:49:24.975Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ghost.io","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 20 Feb 2026 16:08:31 GMT","end":"Thu, 21 May 2026 16:08:30 GMT"},"fingerprint":{"sha1":"4C:45:A4:15:CA:85:9D:99:BC:4D:A7:B6:3C:E7:8F:5E:21:5D:F4:2C","sha256":"01:5F:E1:24:63:34:94:E0:F1:2C:A5:59:18:44:31:EE:B4:5D:22:55:CE:55:52:10:B9:82:8D:08:0F:A2:D6:49"}}},"request":{"raw":"GET /ghost/api/content/newsletters/?limit=100\u0026key=9429a0a871fade6fb93cac485d HTTP/1.1\r\nHost: enus-user.ghost.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://enus-user.ghost.io/bridge/\r\nContent-Type: application/json\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nstatus: 200 OK\r\ncontent-type: application/json; charset=utf-8\r\ncontent-version: v6.22\r\nvia: 1.1 varnish, 1.1 varnish, 1.1 varnish\r\nserver: openresty\r\naccess-control-allow-origin: *\r\netag: W/\"1a5-ufmjqsFHFYtei2T8MmOWUdLnN0M\"\r\ncache-control: public, max-age=0\r\ncontent-encoding: gzip\r\naccept-ranges: bytes\r\nage: 4780\r\ndate: Tue, 24 Mar 2026 00:49:25 GMT\r\nx-served-by: cache-ams2100127-AMS, cache-ams2100102-AMS, cache-hel1410028-HEL\r\nx-cache: MISS, HIT, MISS\r\nx-cache-hits: 0, 5, 0\r\nx-timer: S1774313365.988466,VS0,VE28\r\nvary: Accept-Version, Cookie, Accept-Encoding\r\nx-request-id: 44e86a9b-7450-4ad0-bd7f-6287765d670c\r\nghost-fastly: true;production\r\nalt-svc: clear\r\ncontent-length: 306\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}],"data":{"size":421,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"3c350170cd5f246ea7650bb8298547d7","sha1":"b9f9a3aac147158b5e8b64fc32639651d2e73743","sha256":"3f553fbb9792f051d440b829fa3ba93a50df91797be0b81e0b0075dcfc106e8e","sha512":"8244c43870d5fa114c738a1ec0f988f37b185f2bb7e4c4799020e097e45c32cf2973f16ca0fef6c81200f82996d8c4bb8323fbcfebd08d105d2fc830d5f3dfbf","ssdeep":"","tlshash":"c1e0abb5913268b48742526344667bc2a4dc717f58028d3873c02b040186a7d1d0b926","first_seen":"2026-02-28T11:37:02.881625Z","last_seen":"2026-03-24T08:54:38.706003Z","times_seen":7,"resource_available":false,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-23","alert":"Sinkholed","trigger":"enus-user.ghost.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-23","alert":"Sinkholed","trigger":"enus-user.ghost.io","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"enus-user.ghost.io/bridge/","fqdn":"enus-user.ghost.io","domain":"ghost.io","tld":"io"},"ip":{"addr":"151.101.131.7","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-24T00:49:23.997Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ghost.io","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 20 Feb 2026 16:08:31 GMT","end":"Thu, 21 May 2026 16:08:30 GMT"},"fingerprint":{"sha1":"4C:45:A4:15:CA:85:9D:99:BC:4D:A7:B6:3C:E7:8F:5E:21:5D:F4:2C","sha256":"01:5F:E1:24:63:34:94:E0:F1:2C:A5:59:18:44:31:EE:B4:5D:22:55:CE:55:52:10:B9:82:8D:08:0F:A2:D6:49"}}},"request":{"raw":"GET /bridge/ HTTP/1.1\r\nHost: enus-user.ghost.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nvia: 1.1 varnish, 1.1 varnish, 1.1 varnish\r\nserver: openresty\r\ncontent-encoding: gzip\r\netag: W/\"64c5-sG4KFkB0TukYzs4lsup1i71RMvs\"\r\ncontent-type: text/html; charset=utf-8\r\ncache-control: public, max-age=0\r\nstatus: 200 OK\r\naccept-ranges: bytes\r\nage: 6216\r\ndate: Tue, 24 Mar 2026 00:49:24 GMT\r\nx-served-by: cache-ams2100090-AMS, cache-ams21079-AMS, cache-hel1410028-HEL\r\nx-cache: MISS, HIT, MISS\r\nx-cache-hits: 0, 4, 0\r\nx-timer: S1774313364.095478,VS0,VE27\r\nvary: Cookie, Accept-Encoding\r\nx-request-id: dd10a3ee-3f90-4e5e-868a-33f6590353d6\r\nghost-fastly: true;production\r\nalt-svc: clear\r\ncontent-length: 7194\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ghost:6.22","description":"Ghost is a powerful app for new-media creators to publish, share, and grow a business around their content.","website":"https://ghost.org","common_platform_enumeration":"","icon":"Ghost.svg","categories":["CMS","Blogs"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":25797,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5578)","md5":"40b81daad159963082a7fbd03bb18e13","sha1":"11957d7017324c6caedd9d87c61cca93d7296b2b","sha256":"64ebfa0380cf9c01da1653b074412893204d24d06304bb2da855ed09e403f9b9","sha512":"0e3a8f4b6d84b35baa2deb806869235d78fe79dd9e3ab76f33f4ec2cc2e11854fa0d1358a05c760c5db583ba795ec3155fd500772c251b57674962458e1a5a0c","ssdeep":"768:y+YzrP34Qvt6JECGv5p6/oMBhzW9Q3ko13amK:y+Yn34Ep4/oMnWuZ13aB","tlshash":"b1c2c96761f42639061303ca66d23789ba73e55fe58e1990f1fcc1781f82de186b398e","first_seen":"2026-03-24T00:49:52.068789Z","last_seen":"2026-03-24T00:49:52.068789Z","times_seen":1,"resource_available":false,"data":null}},"time_used":212,"timings":{"blocked":76,"dns":23,"connect":26,"send":0,"wait":53,"receive":1,"ssl":30},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-23","alert":"Sinkholed","trigger":"enus-user.ghost.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-23","alert":"Sinkholed","trigger":"enus-user.ghost.io","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"enus-user.ghost.io/assets/built/screen.css?v=8b29e623b6","fqdn":"enus-user.ghost.io","domain":"ghost.io","tld":"io"},"ip":{"addr":"151.101.131.7","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://enus-user.ghost.io/bridge/","date":"2026-03-24T00:49:24.360Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ghost.io","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 20 Feb 2026 16:08:31 GMT","end":"Thu, 21 May 2026 16:08:30 GMT"},"fingerprint":{"sha1":"4C:45:A4:15:CA:85:9D:99:BC:4D:A7:B6:3C:E7:8F:5E:21:5D:F4:2C","sha256":"01:5F:E1:24:63:34:94:E0:F1:2C:A5:59:18:44:31:EE:B4:5D:22:55:CE:55:52:10:B9:82:8D:08:0F:A2:D6:49"}}},"request":{"raw":"GET /assets/built/screen.css?v=8b29e623b6 HTTP/1.1\r\nHost: enus-user.ghost.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://enus-user.ghost.io/bridge/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 13 Mar 2026 20:29:16 GMT\r\ncontent-type: text/css; charset=UTF-8\r\ncache-control: public, max-age=31536000\r\nstatus: 200 OK\r\ncontent-encoding: gzip\r\nvia: 1.1 varnish, 1.1 varnish, 1.1 varnish\r\netag: W/\"d165-19ce8e39960\"\r\nserver: openresty\r\naccept-ranges: bytes\r\nage: 6216\r\ndate: Tue, 24 Mar 2026 00:49:24 GMT\r\nx-served-by: cache-ams2100107-AMS, cache-ams2100092-AMS, cache-hel1410028-HEL\r\nx-cache: MISS, HIT, MISS\r\nx-cache-hits: 0, 9, 0\r\nx-timer: S1774313364.374296,VS0,VE26\r\nvary: Accept-Encoding\r\nx-request-id: 0bc4c9c9-e749-4646-af0b-ecb33ee4ae01\r\nghost-fastly: true;production\r\nalt-svc: clear\r\ncontent-length: 9723\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}],"data":{"size":53605,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"Unicode text, UTF-8 text, with very long lines (53602)","md5":"ea3e2625e6a8400fe6fa1e242570c0ae","sha1":"3307504a612f8a9426b1d9c2513631427d3cb9c5","sha256":"b99b13232a6b8c1ec1cf7988cdbbd43e3f3f8ccd6595959a4d4505f8ca2c927d","sha512":"b3078145c5131e71f0da754cb25f8aed3496c0c247a723c2613fa03bff28f7e96660bc9a2faf823a59bf1175a570598410ea9797a8b478bd168b0f9f0c41e8fd","ssdeep":"768:2f16rmPNfGOARgftYVYnxVe7nwHCfppBAMiWwtpOBt9tP5yxLxkxxxmxuxU:o7e7nwHCfppBAMFapOBrt8pirM8e","tlshash":"4833a466fe50333860338a57ebd1674e3024d842aa561fede0c6e15949c7ba3d73d728","first_seen":"2026-03-12T13:38:49.172936Z","last_seen":"2026-07-17T02:08:05.310415Z","times_seen":71,"resource_available":false,"data":null}},"time_used":56,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-23","alert":"Sinkholed","trigger":"enus-user.ghost.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-23","alert":"Sinkholed","trigger":"enus-user.ghost.io","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"enus-user.ghost.io/assets/fonts/inter-roman.woff2?v=8b29e623b6","fqdn":"enus-user.ghost.io","domain":"ghost.io","tld":"io"},"ip":{"addr":"151.101.131.7","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://enus-user.ghost.io/bridge/","date":"2026-03-24T00:49:24.365Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ghost.io","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 20 Feb 2026 16:08:31 GMT","end":"Thu, 21 May 2026 16:08:30 GMT"},"fingerprint":{"sha1":"4C:45:A4:15:CA:85:9D:99:BC:4D:A7:B6:3C:E7:8F:5E:21:5D:F4:2C","sha256":"01:5F:E1:24:63:34:94:E0:F1:2C:A5:59:18:44:31:EE:B4:5D:22:55:CE:55:52:10:B9:82:8D:08:0F:A2:D6:49"}}},"request":{"raw":"GET /assets/fonts/inter-roman.woff2?v=8b29e623b6 HTTP/1.1\r\nHost: enus-user.ghost.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://enus-user.ghost.io/bridge/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\nlast-modified: Fri, 13 Mar 2026 20:29:16 GMT\r\ncache-control: public, max-age=31536000\r\nstatus: 200 OK\r\netag: W/\"9394-19ce8e39960\"\r\ncontent-type: font/woff2\r\nvia: 1.1 varnish, 1.1 varnish, 1.1 varnish\r\naccept-ranges: bytes\r\nage: 3372\r\ndate: Tue, 24 Mar 2026 00:49:24 GMT\r\nx-served-by: cache-ams2100115-AMS, cache-ams21048-AMS, cache-hel1410028-HEL\r\nx-cache: MISS, HIT, MISS\r\nx-cache-hits: 0, 4, 0\r\nx-timer: S1774313364.375873,VS0,VE28\r\nx-request-id: e86e15c2-fa8d-4909-b8dc-22b1ce0c702a\r\nghost-fastly: true;production\r\nalt-svc: clear\r\ncontent-length: 37780\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}],"data":{"size":37780,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 37780, version 1.0","md5":"e1b9f0ecaaebb12c93064cd3c406f82b","sha1":"f0e872352fc5af11960d0eb4fd6ed09e9e98f4ab","sha256":"39e72c0794c12f2dbb14a0f61ca946b535f795b1478fcf795bd26e5cb52ded34","sha512":"5fe73910046b2873220a73be768f1153475a869ec0e59abb06609fef867b44b84450ad3c3140b47328defbbdd2ce7740791f1795d8160a50ca0af058f925a0e2","ssdeep":"768:lsC2ANerCPjvZx4cl+OVNrOxS+miAS5VDcNTVMDeDjwT1fTWEbDFTGn:r2AICrZbl++KxSPAVDcMeDeWWTGn","tlshash":"6603f2fb0322620725471bb53daf4c8a16695adce349b08da4757b6958bbd98500ecc3","first_seen":"2023-04-08T12:04:12Z","last_seen":"2026-08-10T23:34:59.850398Z","times_seen":10776,"resource_available":false,"data":null}},"time_used":84,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-23","alert":"Sinkholed","trigger":"enus-user.ghost.io","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-23","alert":"Sinkholed","trigger":"enus-user.ghost.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"enus-user.ghost.io/.ghost/analytics/api/v1/page_hit?name=analytics_events","fqdn":"enus-user.ghost.io","domain":"ghost.io","tld":"io"},"ip":{"addr":"151.101.131.7","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://enus-user.ghost.io/bridge/","date":"2026-03-24T00:49:25.038Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ghost.io","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 20 Feb 2026 16:08:31 GMT","end":"Thu, 21 May 2026 16:08:30 GMT"},"fingerprint":{"sha1":"4C:45:A4:15:CA:85:9D:99:BC:4D:A7:B6:3C:E7:8F:5E:21:5D:F4:2C","sha256":"01:5F:E1:24:63:34:94:E0:F1:2C:A5:59:18:44:31:EE:B4:5D:22:55:CE:55:52:10:B9:82:8D:08:0F:A2:D6:49"}}},"request":{"raw":"POST /.ghost/analytics/api/v1/page_hit?name=analytics_events HTTP/1.1\r\nHost: enus-user.ghost.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://enus-user.ghost.io/bridge/\r\nContent-Type: application/json\r\nx-site-uuid: d1b69032-e6a5-4e68-af5f-00a7307d5ad7\r\nContent-Length: 655\r\nOrigin: https://enus-user.ghost.io\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":655,"data":"{\"timestamp\":\"2026-03-24T00:49:25.035Z\",\"action\":\"page_hit\",\"version\":\"1\",\"payload\":{\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"locale\":\"en-US\",\"location\":null,\"parsedReferrer\":{\"url\":null,\"source\":null,\"medium\":null},\"pathname\":\"/bridge/\",\"href\":\"https://enus-user.ghost.io/bridge/\",\"utm_source\":null,\"utm_medium\":null,\"utm_campaign\":null,\"utm_term\":null,\"utm_content\":null,\"event_id\":\"4cd2eba5-a1df-4808-a909-e5c32f02e5b0\",\"site_uuid\":\"d1b69032-e6a5-4e68-af5f-00a7307d5ad7\",\"post_uuid\":\"7d2c1bc0-0b1a-45c2-9a3c-fed306e336d8\",\"post_type\":\"post\",\"member_uuid\":\"undefined\",\"member_status\":\"undefined\"}}"}},"response":{"raw":"HTTP/2 202 Accepted\r\ncontent-type: application/json; charset=utf-8\r\nx-cloud-trace-context: f8cf584922415cfa750e0435ce13f42c\r\naccess-control-allow-origin: *\r\nvia: 1.1 varnish, 1.1 varnish, 1.1 varnish\r\nserver: openresty\r\naccept-ranges: bytes\r\ndate: Tue, 24 Mar 2026 00:49:25 GMT\r\nx-served-by: cache-ams2100095-AMS, cache-ams2100095-AMS, cache-hel1410028-HEL\r\nx-cache: MISS, MISS, MISS\r\nx-cache-hits: 0, 0, 0\r\nx-timer: S1774313365.060047,VS0,VE120\r\nx-request-id: 0c32e433-504e-4962-a0ba-ad404b1e7d82\r\nghost-fastly: true;production\r\nalt-svc: clear\r\ncontent-length: 37\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"202","status_text":"Accepted","fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Google Cloud Trace","description":"Google Cloud Trace is a distributed tracing system that collects latency data from applications and displays it in the Google Cloud Console.","website":"https://cloud.google.com/trace","common_platform_enumeration":"","icon":"google-cloud-trace.svg","categories":["Performance"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":37,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"692bb730f6ee780f4a0082c67c5a98cf","sha1":"0f1657922586e4e6031a662ddb2738a71ff0e571","sha256":"0cdc78cf36c208af3def1624585124bac443f7f1f3536c3e82fc573a7d8252e1","sha512":"a66fb6d9cc6740e3d4a7e13aa312f10b205d32a1e0ec8cd5fd6d703c00f7d5ea9a0957b4e7020fab77ce5a9452db698bc9c5e2f64d49cd505fe742c7d3aefaa9","ssdeep":"","tlshash":"c080045754435dd7d34f410531443411445000d5014031c1c4fc0d1443004700003100","first_seen":"2025-08-08T07:43:36.58723Z","last_seen":"2026-08-11T07:19:43.065014Z","times_seen":1131,"resource_available":false,"data":null}},"time_used":147,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":146,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-23","alert":"Sinkholed","trigger":"enus-user.ghost.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-23","alert":"Sinkholed","trigger":"enus-user.ghost.io","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"enus-user.ghost.io/assets/built/source.js?v=8b29e623b6","fqdn":"enus-user.ghost.io","domain":"ghost.io","tld":"io"},"ip":{"addr":"151.101.131.7","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://enus-user.ghost.io/bridge/","date":"2026-03-24T00:49:24.362Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ghost.io","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 20 Feb 2026 16:08:31 GMT","end":"Thu, 21 May 2026 16:08:30 GMT"},"fingerprint":{"sha1":"4C:45:A4:15:CA:85:9D:99:BC:4D:A7:B6:3C:E7:8F:5E:21:5D:F4:2C","sha256":"01:5F:E1:24:63:34:94:E0:F1:2C:A5:59:18:44:31:EE:B4:5D:22:55:CE:55:52:10:B9:82:8D:08:0F:A2:D6:49"}}},"request":{"raw":"GET /assets/built/source.js?v=8b29e623b6 HTTP/1.1\r\nHost: enus-user.ghost.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://enus-user.ghost.io/bridge/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 13 Mar 2026 20:29:16 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000\r\nstatus: 200 OK\r\ncontent-encoding: gzip\r\nvia: 1.1 varnish, 1.1 varnish, 1.1 varnish\r\netag: W/\"cd85-19ce8e39960\"\r\nserver: openresty\r\naccept-ranges: bytes\r\nage: 6216\r\ndate: Tue, 24 Mar 2026 00:49:24 GMT\r\nx-served-by: cache-ams21056-AMS, cache-ams21050-AMS, cache-hel1410028-HEL\r\nx-cache: MISS, HIT, MISS\r\nx-cache-hits: 0, 8, 0\r\nx-timer: S1774313364.375064,VS0,VE27\r\nvary: Accept-Encoding\r\nx-request-id: ca451180-ca68-4f0b-8f85-11299df68603\r\nghost-fastly: true;production\r\nalt-svc: clear\r\ncontent-length: 18453\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":52613,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (52612)","md5":"06da1ab26a236c21e474ef93709bfc6b","sha1":"a573c212aa648c587934343d9089f7c08729c527","sha256":"8609efddd15136b71f2113a7afdb7c272752bf062ab84e82ceb4e2757517b84e","sha512":"5ee1109cea4c0a6ef5380ce00c2669345412a2802682d5c71912942ed784a0e6300a63e182582755a60a0a200fe9306342d1b90a4245b2027d7ebecf6decca14","ssdeep":"768:RZ00sMczA7o64bFMZRyxfjUp7PDArx9/RTnfTkqr2IRRMfogj8DcX:0t/A7AKZRf7PDArxjTn79r2IRqZtX","tlshash":"9b334be8315176b703d76176617fa50e23322aaaac0a80407c36dce66cf8d59527ff6c","first_seen":"2026-01-23T22:00:43.180907Z","last_seen":"2026-08-10T19:22:13.117642Z","times_seen":242,"resource_available":true,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":55,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-23","alert":"Sinkholed","trigger":"enus-user.ghost.io","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-23","alert":"Sinkholed","trigger":"enus-user.ghost.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/ghost/sodo-search@~1.8/umd/sodo-search.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"104.16.174.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://enus-user.ghost.io/bridge/","date":"2026-03-24T00:49:24.368Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jsdelivr.net","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Fri, 25 Apr 2025 00:00:00 GMT","end":"Mon, 04 May 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:DD:A1:61:65:41:D0:8F:18:9A:2F:B3:5C:A4:20:AA:B2:8C:AD:1F","sha256":"20:CE:80:8C:8A:B7:48:3B:0B:A0:F2:AC:61:42:83:EC:54:84:A8:FA:4C:2D:98:10:FF:8B:FA:A5:1D:F5:21:28"}}},"request":{"raw":"GET /ghost/sodo-search@~1.8/umd/sodo-search.min.js HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://enus-user.ghost.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://enus-user.ghost.io/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 24 Mar 2026 00:49:24 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 94714\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=600, s-maxage=43200, stale-while-revalidate=600, stale-if-error=86400\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\netag: W/\"46c84-qf9mtC2PFCyRSeALBwabppRysR0\"\r\nx-jsd-version: 1.8.6\r\nx-jsd-version-type: version\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\nx-served-by: cache-fra-eddf8230231-FRA\r\nx-cache: HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=86400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\nage: 16946\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jy39QOs2PfgK7Ym5F2OqKP6SR487GVEyj23cIBGhOutKYViCTsgj%2Bmorzvaxoeu2AZir6%2FvjKxldsvvEorARL988IWYxSRcTDc2FBGqlaw%3D%3D\"}]}\r\nserver: cloudflare\r\ncf-ray: 9e11acff5cb5a0f0-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":289924,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (43314)","md5":"1b38addebf76db903d4cab29810635fe","sha1":"a9ff66b42d8f142c9149e00b07069ba69472b11d","sha256":"4b28c3e2ef4abafdc39c38fc6227d7e6f3d566c38469446afee290949ea9b410","sha512":"03e26442d20e52f1abf4d00dc210675a15239c651906a7691cd654586cea02ef8e893c40152ae830293a88cae7f0f930d9f30ecf7f6f8833ac58354efc4478aa","ssdeep":"3072:0wQO1GXLjwQxdFO/hVr4hYhW4Fu/6VykSIsBrOrQSh0JiAPV7VOLnv:ulbjwo/O+lCykJstONv","tlshash":"f6543bdc32aab56657e216a5106f1107b3392c162c0c4814f52cfdea7ab590a61fffbc","first_seen":"2026-03-04T12:41:37.945589Z","last_seen":"2026-04-11T08:32:24.891885Z","times_seen":296,"resource_available":true,"data":null}},"time_used":32,"timings":{"blocked":5,"dns":3,"connect":1,"send":0,"wait":7,"receive":4,"ssl":8},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"enus-user.ghost.io/public/cards.min.css?v=8b29e623b6","fqdn":"enus-user.ghost.io","domain":"ghost.io","tld":"io"},"ip":{"addr":"151.101.131.7","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://enus-user.ghost.io/bridge/","date":"2026-03-24T00:49:24.370Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ghost.io","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 20 Feb 2026 16:08:31 GMT","end":"Thu, 21 May 2026 16:08:30 GMT"},"fingerprint":{"sha1":"4C:45:A4:15:CA:85:9D:99:BC:4D:A7:B6:3C:E7:8F:5E:21:5D:F4:2C","sha256":"01:5F:E1:24:63:34:94:E0:F1:2C:A5:59:18:44:31:EE:B4:5D:22:55:CE:55:52:10:B9:82:8D:08:0F:A2:D6:49"}}},"request":{"raw":"GET /public/cards.min.css?v=8b29e623b6 HTTP/1.1\r\nHost: enus-user.ghost.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://enus-user.ghost.io/bridge/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nstatus: 200 OK\r\ncontent-type: text/css\r\nvia: 1.1 varnish, 1.1 varnish, 1.1 varnish\r\nserver: openresty\r\netag: W/\"781668c539d7a83eb1aa862009ffeb96\"\r\ncontent-encoding: gzip\r\ncache-control: public, max-age=31536000\r\naccept-ranges: bytes\r\nage: 6216\r\ndate: Tue, 24 Mar 2026 00:49:24 GMT\r\nx-served-by: cache-ams21045-AMS, cache-ams2100123-AMS, cache-hel1410028-HEL\r\nx-cache: MISS, HIT, MISS\r\nx-cache-hits: 0, 8, 0\r\nx-timer: S1774313364.380903,VS0,VE27\r\nvary: Accept-Encoding\r\nx-request-id: 828aa918-9754-4368-baf6-2c05364a484b\r\nghost-fastly: true;production\r\nalt-svc: clear\r\ncontent-length: 7680\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}],"data":{"size":45375,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (45371), with no line terminators","md5":"781668c539d7a83eb1aa862009ffeb96","sha1":"af95f9a04da7947cb0c2dd4a18edf1fedb66b4c7","sha256":"421fb1f72fcbf14392019a3cbe173424511a277cabc84ccfa56c9c75552328f2","sha512":"f343a1828128c468e225f07dd1e46105c8b2cb6cd6803bc39ae2144528e60dacc4e24142d3474463f39ff8b6315d2d642d5083fda17e06e1a5067f3543931d56","ssdeep":"768:mfCS98MZFfX7Mp1y8lehzmwfxEYa2WdphRlnHW5q3bGWmA/yJ:K98MZFfX7Mp1y8ls0RBHGm1w","tlshash":"8c1373556313313ce2378250d1c26bca712ed601d2a706aaf852b5aec3ee1e35e767dc","first_seen":"2026-03-02T19:44:33.515746Z","last_seen":"2026-08-10T19:22:13.139437Z","times_seen":851,"resource_available":false,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":80,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-23","alert":"Sinkholed","trigger":"enus-user.ghost.io","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-23","alert":"Sinkholed","trigger":"enus-user.ghost.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"enus-user.ghost.io/public/ghost-stats.min.js?v=8b29e623b6","fqdn":"enus-user.ghost.io","domain":"ghost.io","tld":"io"},"ip":{"addr":"151.101.131.7","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://enus-user.ghost.io/bridge/","date":"2026-03-24T00:49:24.375Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ghost.io","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 20 Feb 2026 16:08:31 GMT","end":"Thu, 21 May 2026 16:08:30 GMT"},"fingerprint":{"sha1":"4C:45:A4:15:CA:85:9D:99:BC:4D:A7:B6:3C:E7:8F:5E:21:5D:F4:2C","sha256":"01:5F:E1:24:63:34:94:E0:F1:2C:A5:59:18:44:31:EE:B4:5D:22:55:CE:55:52:10:B9:82:8D:08:0F:A2:D6:49"}}},"request":{"raw":"GET /public/ghost-stats.min.js?v=8b29e623b6 HTTP/1.1\r\nHost: enus-user.ghost.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://enus-user.ghost.io/bridge/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: application/javascript\r\ncache-control: public, max-age=31536000\r\nstatus: 200 OK\r\nserver: openresty\r\ncontent-encoding: gzip\r\netag: W/\"8d277181953c9efeddf289903f07fbc1\"\r\nvia: 1.1 varnish, 1.1 varnish, 1.1 varnish\r\naccept-ranges: bytes\r\nage: 6216\r\ndate: Tue, 24 Mar 2026 00:49:24 GMT\r\nx-served-by: cache-ams2100101-AMS, cache-ams21055-AMS, cache-hel1410028-HEL\r\nx-cache: MISS, HIT, MISS\r\nx-cache-hits: 0, 7, 0\r\nx-timer: S1774313364.381849,VS0,VE28\r\nvary: Accept-Encoding\r\nx-request-id: ffa96a1a-c111-49e8-bcfa-119e84a30a28\r\nghost-fastly: true;production\r\nalt-svc: clear\r\ncontent-length: 12891\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":39811,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (38414)","md5":"8d277181953c9efeddf289903f07fbc1","sha1":"6cf5d70a1be024d87b5c5cd8db2d18304255e859","sha256":"deae6adf1d10fdb425bda1ad02c7b9606f23bd9525be71f26c674509f7708d12","sha512":"e0ac5f79e1987d91cc0b5e563f8b784e9d4214b7ce92c565b73e5ba5d50353b40a05a5d6b6f361c4a7f015f6f3db27e7ad90591a6423c35da84bd0b084696963","ssdeep":"768:bCBeCTGRx9s7+qhm6+CwbCQZ16xHK35dhX+URyz2dg4l:kPRhmWwvZ8Ktr","tlshash":"6f03408d91ae22134efbc0113be7fbe56477e6c844c65e037d268e44801dcb673b6a99","first_seen":"2025-09-18T21:28:58.858668Z","last_seen":"2026-08-10T19:22:13.13631Z","times_seen":910,"resource_available":true,"data":null}},"time_used":82,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":80,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-23","alert":"Sinkholed","trigger":"enus-user.ghost.io","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-23","alert":"Sinkholed","trigger":"enus-user.ghost.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"enus-user.ghost.io/members/api/member/","fqdn":"enus-user.ghost.io","domain":"ghost.io","tld":"io"},"ip":{"addr":"151.101.131.7","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://enus-user.ghost.io/bridge/","date":"2026-03-24T00:49:24.670Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ghost.io","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 20 Feb 2026 16:08:31 GMT","end":"Thu, 21 May 2026 16:08:30 GMT"},"fingerprint":{"sha1":"4C:45:A4:15:CA:85:9D:99:BC:4D:A7:B6:3C:E7:8F:5E:21:5D:F4:2C","sha256":"01:5F:E1:24:63:34:94:E0:F1:2C:A5:59:18:44:31:EE:B4:5D:22:55:CE:55:52:10:B9:82:8D:08:0F:A2:D6:49"}}},"request":{"raw":"GET /members/api/member/ HTTP/1.1\r\nHost: enus-user.ghost.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://enus-user.ghost.io/bridge/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 204 No Content\r\naccess-control-allow-origin: *\r\nstatus: 204 No Content\r\nvia: 1.1 varnish, 1.1 varnish, 1.1 varnish\r\nserver: openresty\r\naccept-ranges: bytes\r\nage: 4780\r\ndate: Tue, 24 Mar 2026 00:49:24 GMT\r\nx-served-by: cache-ams2100144-AMS, cache-ams2100144-AMS, cache-hel1410028-HEL\r\nx-cache: MISS, HIT, MISS\r\nx-cache-hits: 0, 4, 0\r\nx-timer: S1774313365.691792,VS0,VE28\r\nvary: Cookie\r\nx-request-id: c475c183-b766-4728-9d92-78534cea1341\r\ncache-control: no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0\r\nghost-fastly: true;production\r\nalt-svc: clear\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-11T22:57:34.772395Z","times_seen":17845104,"resource_available":true,"data":null}},"time_used":54,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-23","alert":"Sinkholed","trigger":"enus-user.ghost.io","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-23","alert":"Sinkholed","trigger":"enus-user.ghost.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"enus-user.ghost.io/favicon.ico","fqdn":"enus-user.ghost.io","domain":"ghost.io","tld":"io"},"ip":{"addr":"151.101.131.7","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://enus-user.ghost.io/bridge/","date":"2026-03-24T00:49:24.766Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ghost.io","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 20 Feb 2026 16:08:31 GMT","end":"Thu, 21 May 2026 16:08:30 GMT"},"fingerprint":{"sha1":"4C:45:A4:15:CA:85:9D:99:BC:4D:A7:B6:3C:E7:8F:5E:21:5D:F4:2C","sha256":"01:5F:E1:24:63:34:94:E0:F1:2C:A5:59:18:44:31:EE:B4:5D:22:55:CE:55:52:10:B9:82:8D:08:0F:A2:D6:49"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: enus-user.ghost.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://enus-user.ghost.io/bridge/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/x-icon\r\netag: W/\"a9c6dbdcdc3ae568f4e0dad92149a0e3\"\r\ncache-control: public, max-age=86400\r\ncontent-encoding: gzip\r\nserver: openresty\r\nstatus: 200 OK\r\nvia: 1.1 varnish, 1.1 varnish, 1.1 varnish\r\naccept-ranges: bytes\r\nage: 6216\r\ndate: Tue, 24 Mar 2026 00:49:24 GMT\r\nx-served-by: cache-ams2100135-AMS, cache-ams21034-AMS, cache-hel1410028-HEL\r\nx-cache: MISS, HIT, MISS\r\nx-cache-hits: 0, 5, 0\r\nx-timer: S1774313365.787343,VS0,VE27\r\nvary: Cookie, Accept-Encoding\r\nx-request-id: c3923005-c3fd-4247-b3a0-ba3df7747334\r\nghost-fastly: true;production\r\nalt-svc: clear\r\ncontent-length: 3848\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":15406,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel","md5":"a9c6dbdcdc3ae568f4e0dad92149a0e3","sha1":"9c651e0e4bcfbcbad5e8473d123ba49b1547dfd9","sha256":"467b9feccbe0d278bd918d989b50c1b956a730dc2dbc7cf4b650840f031a326d","sha512":"5a6673f10e8f2c1c078805cc2b8589d99b636b27c227b2770115b54c2791be9ed9d870471137af93dba0de7e640faf0a9d014eb99aa1ce149f1d6042cef2be21","ssdeep":"96:PvfeiDZYtDP/kJX21o2PCWCksBFJDmP83351Ayg4ROT/T:3feiutDXoXuo7ksnJiE3tg6O3","tlshash":"e7628681b3994e57f76c97384da6af28903f7cb05930227b4af53e861fbb6944f40406","first_seen":"2023-05-18T21:56:31Z","last_seen":"2026-08-07T23:09:20.997952Z","times_seen":2877,"resource_available":false,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-23","alert":"Sinkholed","trigger":"enus-user.ghost.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-23","alert":"Sinkholed","trigger":"enus-user.ghost.io","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/ghost/portal@~2.66/umd/portal.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"104.16.174.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://enus-user.ghost.io/bridge/","date":"2026-03-24T00:49:24.366Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jsdelivr.net","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Fri, 25 Apr 2025 00:00:00 GMT","end":"Mon, 04 May 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:DD:A1:61:65:41:D0:8F:18:9A:2F:B3:5C:A4:20:AA:B2:8C:AD:1F","sha256":"20:CE:80:8C:8A:B7:48:3B:0B:A0:F2:AC:61:42:83:EC:54:84:A8:FA:4C:2D:98:10:FF:8B:FA:A5:1D:F5:21:28"}}},"request":{"raw":"GET /ghost/portal@~2.66/umd/portal.min.js HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://enus-user.ghost.io\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://enus-user.ghost.io/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 24 Mar 2026 00:49:24 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 428904\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=600, s-maxage=43200, stale-while-revalidate=600, stale-if-error=86400\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\netag: W/\"1e6ac5-6JdIb36aqQWes1f9wuM1p9kOJbM\"\r\nx-jsd-version: 2.66.8\r\nx-jsd-version-type: version\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\nx-served-by: cache-fra-eddf8230108-FRA, cache-ber1080027-BER\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=86400\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\nage: 22501\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=emB%2BGU1tn9wFFls0VWrn1OnKiPVLJ1LRDoHfmF1J47xt49rBYh3dTrRDeyrkq4yKO7gBKm6lIaQLsvS3IgTQprhg3FhTF00HtgMYaUwcIg%3D%3D\"}]}\r\nserver: cloudflare\r\ncf-ray: 9e11acff5caea0f0-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1993413,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (44370)","md5":"c532aa8bc5f4b988f547ff86a602117b","sha1":"6d3d66bc5f2b3ddabbed7bb54b8753f6d0988efa","sha256":"c6b8a4ce75ea36d80479c0fba740eabd03a5ce5810b6ebd795004318320bad50","sha512":"d7e2ff6286288ca2f5e2d932e90fded90e1c7e9137ee67db83f0c2d050eb284689fe3c39f6211514b371ac7066460c7d06d51e57c46468c0e6fb66f1843fca1d","ssdeep":"24576:jy/2PRjn5WkBBl43jEgjIa7SJAtwhQMA3gtA3qQW/ODoQ:2/2PRjn5WkBBl43jEgjIaKQMA3gtSHoQ","tlshash":"b5456d19d78433b10a9106e2744e3933b6e588385b4dc116dc8d9a2d21e5eedbf7f8e8","first_seen":"2026-03-22T18:14:55.312667Z","last_seen":"2026-03-25T15:31:46.534598Z","times_seen":14,"resource_available":false,"data":null}},"time_used":46,"timings":{"blocked":3,"dns":1,"connect":1,"send":0,"wait":4,"receive":24,"ssl":10},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"enus-user.ghost.io/public/cards.min.js?v=8b29e623b6","fqdn":"enus-user.ghost.io","domain":"ghost.io","tld":"io"},"ip":{"addr":"151.101.131.7","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://enus-user.ghost.io/bridge/","date":"2026-03-24T00:49:24.369Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ghost.io","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 20 Feb 2026 16:08:31 GMT","end":"Thu, 21 May 2026 16:08:30 GMT"},"fingerprint":{"sha1":"4C:45:A4:15:CA:85:9D:99:BC:4D:A7:B6:3C:E7:8F:5E:21:5D:F4:2C","sha256":"01:5F:E1:24:63:34:94:E0:F1:2C:A5:59:18:44:31:EE:B4:5D:22:55:CE:55:52:10:B9:82:8D:08:0F:A2:D6:49"}}},"request":{"raw":"GET /public/cards.min.js?v=8b29e623b6 HTTP/1.1\r\nHost: enus-user.ghost.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://enus-user.ghost.io/bridge/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nstatus: 200 OK\r\ncontent-type: application/javascript\r\nvia: 1.1 varnish, 1.1 varnish, 1.1 varnish\r\nserver: openresty\r\netag: W/\"91fcf6fd1c2761b582cda90883e5ff94\"\r\ncontent-encoding: gzip\r\ncache-control: public, max-age=31536000\r\naccept-ranges: bytes\r\nage: 4796\r\ndate: Tue, 24 Mar 2026 00:49:24 GMT\r\nx-served-by: cache-ams2100091-AMS, cache-ams21023-AMS, cache-hel1410028-HEL\r\nx-cache: MISS, HIT, MISS\r\nx-cache-hits: 0, 7, 0\r\nx-timer: S1774313364.380761,VS0,VE26\r\nvary: Accept-Encoding\r\nx-request-id: 7fe11883-85c3-406e-b419-8b8d061a70ee\r\nghost-fastly: true;production\r\nalt-svc: clear\r\ncontent-length: 1640\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":6892,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (6882), with no line terminators","md5":"91fcf6fd1c2761b582cda90883e5ff94","sha1":"c9c4aef48fd4c48f1a38d4f37460150385d5551b","sha256":"0fa389a717242bfe900c9d688e7e086b5db05a740db66317011ae6c09be3eb80","sha512":"9fa6d7a307e6483ed83fa43845cce9bc993ee188fc4a5ce6a5d1c0e9e657bdfb401096634513b50a3418ee83e158c2c67ba22a4d7dd8bad93bda5c98a0d2d4d4","ssdeep":"96:u8PUphCyqtL9LYedNLYCKX7jKjh9CQrclQ9xtCNDFmSe:8phCyqR1YedNLYCKajh9CQrgQ9xQZTe","tlshash":"b8e1049632682b3642966ee357dc12d07ea40ac9f20e0a746077ddcd16b9cc243b93e7","first_seen":"2025-06-21T00:42:26.174777Z","last_seen":"2026-08-11T07:19:43.042883Z","times_seen":3988,"resource_available":true,"data":null}},"time_used":79,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":79,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-23","alert":"Sinkholed","trigger":"enus-user.ghost.io","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-03-23","alert":"Sinkholed","trigger":"enus-user.ghost.io","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}