{"report_id":"7733372f-4b39-4f47-80a0-603dfc3f08a8","version":0,"status":"done","tags":[],"date":"2026-06-20T13:38:05Z","url":{"schema":"http","addr":"gocoin.top","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"gocoin.top/","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"title":"Pump","dom":{"size":3890049,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (553)","md5":"7103cfdcb19af62fc9e515cf3d112904","sha1":"f58d3d19f5ee33ba2c214b05012a76fdaafe42fe","sha256":"716c3e02ca4b109101272506df8016c3c97be99363fe71e9ce61eb6d8e97f26d","sha512":"fce27f4eb8599bb6e96723902b0a6f3bbaec168e60394ab10745015bdf88cda53bfaae99b85f13243e1b4e08342287eaf09b588db1b6ecfc52a708aa984176df","ssdeep":"3072:TNIQ0nBphlLHz8TkfUB8GuLTdLbAiNbs8ihMuum0ZYkvlyubjD3TnUle2oK7wcOn:TNIQ0zPLvm8oql4S","tlshash":"1e0655f152b453e60087ca75fa31da1ba793f9bbed1ba20473ec87906f4a8d2cc12554","dom_hash":"domhashdce4430f7ebd40e7e329d660e85001e4","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"gocoin.top","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-07-25T13:38:05Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"gocoin.top","ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":135,"request_count":45,"received_data":16136090,"sent_data":22818,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"dc.js","description":"A multi-dimensional charting library built to work natively with crossfilter and rendered using d3.js","website":"https://dc-js.github.io/dc.js/","common_platform_enumeration":"","icon":"dc.js.png","categories":["JavaScript graphics","JavaScript libraries"]},{"name":"C3.js","description":"D3 based reusable chart library","website":"https://c3js.org/","common_platform_enumeration":"","icon":"C3.js.png","categories":["JavaScript libraries"]},{"name":"Nuxt.js","description":"Nuxt is a Vue framework for developing modern web applications.","website":"https://nuxt.com","common_platform_enumeration":"","icon":"Nuxt.js.svg","categories":["JavaScript frameworks","Web frameworks","Web servers","Static site generator"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"gocoin.top/","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"0fa11b8d2ba399cdd4aec08f73d1d5bb","sha1":"21f1ec6439a5bb88b61a481dd62e39f78308ed7c","sha256":"8b44078d1a70fe2cb5f0f0386476f77b3ca302ed706abd223314fe7791d2870b","sha512":"9642fd09699775954b5bdba0265bfbdcb7fa0004768ceaca6fabbde6c39c2bb83b68fb3b5bfb90b575269493b6f4ee4c69abe29d733551d763f024d268cf15df","ssdeep":"","tlshash":"6ec0c000c9304cf64c4800ff903c13dc31151c2cc2471087c6fcd84e049cd410f88414","size":180,"data":"","first_seen":"2026-06-20T13:38:12.704479Z","last_seen":"2026-06-20T13:38:12.704479Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"38e3afae2c196377895ac472c991a80c","sha1":"b407af8385e79478575f6bca8446fe74498dddeb","sha256":"5c6b41d2b14257a1e31a8a371daca51b3982a19595711849cfc14c9c11721599","sha512":"113fac127dd2b9008d506466c48fe3b1cbed913d0b28cffaa2acbd9dff70fc0508836304cd22a7b179b69a13337f3a57e8301f40c3d159f9f8319ef18b2dee56","ssdeep":"","tlshash":"0fd0125d7064a96628cf697e5ccf088e7e369812a2080dc999ecd4547fb1e6d42e488c","size":198,"data":"","first_seen":"2025-09-20T14:46:13.54982Z","last_seen":"2026-06-20T13:38:12.706001Z","times_seen":72,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"0fa11b8d2ba399cdd4aec08f73d1d5bb","sha1":"21f1ec6439a5bb88b61a481dd62e39f78308ed7c","sha256":"8b44078d1a70fe2cb5f0f0386476f77b3ca302ed706abd223314fe7791d2870b","sha512":"9642fd09699775954b5bdba0265bfbdcb7fa0004768ceaca6fabbde6c39c2bb83b68fb3b5bfb90b575269493b6f4ee4c69abe29d733551d763f024d268cf15df","ssdeep":"","tlshash":"6ec0c000c9304cf64c4800ff903c13dc31151c2cc2471087c6fcd84e049cd410f88414","size":180,"data":"","first_seen":"2026-06-20T13:38:12.704479Z","last_seen":"2026-06-20T13:38:12.704479Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"38e3afae2c196377895ac472c991a80c","sha1":"b407af8385e79478575f6bca8446fe74498dddeb","sha256":"5c6b41d2b14257a1e31a8a371daca51b3982a19595711849cfc14c9c11721599","sha512":"113fac127dd2b9008d506466c48fe3b1cbed913d0b28cffaa2acbd9dff70fc0508836304cd22a7b179b69a13337f3a57e8301f40c3d159f9f8319ef18b2dee56","ssdeep":"","tlshash":"0fd0125d7064a96628cf697e5ccf088e7e369812a2080dc999ecd4547fb1e6d42e488c","size":198,"data":"","first_seen":"2025-09-20T14:46:13.54982Z","last_seen":"2026-06-20T13:38:12.706001Z","times_seen":72,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/secureproxy?c=%2Fipfs%2FTw1SNmwNPfNaFgLschkEKw4f6885d41631efed3c3d11cfd77ddeb8%3Ft%3D1781962650811","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"20a3fa2b2ef19ca173431cfc20f6e948","sha1":"4f3bb60efa9b007e1254ab390b97e6c9cffbeb03","sha256":"ee4021de44561cbaf378d1c721bfdbf7899bbdcab71d24fb5f966f6126ecaa94","sha512":"059b2a7838acc61612adb35085f03f657a48dc161beec6143cf58b4f91205bdbc3010e85aa2b89f448c16728fc18814a21f83b6407cbeab1d6341e1e11cdfaff","ssdeep":"6144:Bh5gD1zQDCMEWm7ECNF0gct3VyBKbMboOeC2PYqxQWNahLYzO5WuS2KImDnyJnU6:Js1zQDC6m7hFqa/J/","tlshash":"fad4becaa73d377f5ae01aab0c2b413fefc80d1e216b09c852d1b8d9527970693d915e","size":619191,"data":"","first_seen":"2026-06-20T13:38:12.685807Z","last_seen":"2026-06-20T13:38:12.685807Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"gocoin.top/css2.css","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:30.538Z","timestamp":1781962650538,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /css2.css HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:30 GMT\r\ncontent-type: text/css\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\netag: W/\"6a1b1388-1dcc\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UMxiey6jSFYBsBtedDz18PSq6Y413UE%2FJ%2FBTCxHrPkVYy7qm2FkzlD0NZ6FE7kME9D525i3LNxLigmtOmHu0Qh5lc67UjeSyZ%2FJ%2BMSDiRcsk9TB0xVaXTaQi51Iq\"}]}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nvary: accept-encoding\r\ncf-ray: a0eb2b25db94b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7628,"size_decoded":1595,"mime_type":"text/css","magic":"ASCII text","md5":"a945690afba190bdf35bdbc8dca91152","sha1":"d93d79ba5c4ff541fb62d683c5d6b488b9f53ba8","sha256":"e3588f89e8f3d36d7befdcd1ad777d37963acce98132704f84f1d7ab2d5e1b4b","sha512":"72a22e14d311d595ee72e60b3ae2692c0cf6745594fab8f6f60c522f0f91a227d67e0dbbbc34e4fdfae78e152a29498981398ad2f56e511e7abe26664268a393","ssdeep":"192:9/NAPt34yaDD/OnIt3/ha8G/rKht3iIall/E5yt3RPaGc:JwSfyGKVm","tlshash":"ebf14490046b9400eb872cd277cf7f376d9da148a045c9795ffd1898acded2613a1b4d","first_seen":"2024-12-17T11:31:53.647668Z","last_seen":"2026-06-20T13:38:12.651205Z","times_seen":535,"resource_available":false,"data":null}},"time_used":168,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":168,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/QmdELH6irxDS6E6ByxtHyDZxJbLoPXq9vqVipc3r1nbnvv.png","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:30.577Z","timestamp":1781962650577,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /QmdELH6irxDS6E6ByxtHyDZxJbLoPXq9vqVipc3r1nbnvv.png HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:32 GMT\r\ncontent-type: image/png\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=U5r7hwYl3FLhp2VcamwTGHaxf4TdeNGRCxBSMzD8nM7sSX%2BPHZaqVmRmoJ9kRAcWT0d76V8lgkL4LNv0Ie2L4djBVFTtsNV8SUKSTawqSoxsUPdw%2Buj6q5P0ybdz\"}]}\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\netag: \"6a1b1388-d7f\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncontent-length: 3455\r\ncf-ray: a0eb2b261b99b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3455,"size_decoded":4364,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit colormap, non-interlaced","md5":"c0cfdfdf600e26de3f1c44cc727a0ad0","sha1":"7834fe1a4ae0130d00b5c8eb0c980be3a9cd9a21","sha256":"a6c376fb1612879c8f3f787447b08121d136425b8a12f4c8609197d0265ae36c","sha512":"ba50d13329091d8e9866aaf34b97e958c183510daaaf93ff7550afcd7e17e30017349e571cf39b931c7c02c930570b160893f16576934385f650445708656b7b","ssdeep":"","tlshash":"45617e585d76f804484775ef3d544260b97c44289fc18f5a98ced583290fa63a03f90d","first_seen":"2026-04-12T23:10:39.545531Z","last_seen":"2026-06-20T13:38:12.654877Z","times_seen":11,"resource_available":false,"data":null}},"time_used":2175,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2175,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/image_4bedd7a8bb870242463c32dd6514110998619883.svg","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:30.591Z","timestamp":1781962650591,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /image_4bedd7a8bb870242463c32dd6514110998619883.svg HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:31 GMT\r\ncontent-type: image/svg+xml\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sJM438LdGNdEm6oyvXzGCFu86uXS8l2LjzBLXfHGaJYTF2TexdXL9rxKe2frOBJ0wGusNIHBJ8oDB5knLQUqtppC%2B0Ii%2BB2mXZs6yl26ZLi7Rt51uj57dcvt3P%2Bl\"}]}\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=5,i\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\netag: W/\"6a1b1388-115\"\r\ncf-ray: a0eb2b263ba0b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":277,"size_decoded":1092,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"84e69edfdc5f95304ca09ecdb8b4470a","sha1":"4bedd7a8bb870242463c32dd6514110998619883","sha256":"99dfaae864d697c0c85271501b1c9d3fa055bbcd5891ff143412e482ddd05226","sha512":"b92795a66c3d7f0691604f8448fa2a68bd1e8627148b5d22b55de5805fe9524246d3130e9f69d5613cf42b4f25b34edee62992238ee14cb56599f268fa367469","ssdeep":"","tlshash":"53d02b15530cad1cfe228510c35c723950ea62521b5e054ce9622235751c59f7d3fadd","first_seen":"2025-12-18T09:47:26.941018Z","last_seen":"2026-06-20T13:38:12.655408Z","times_seen":128,"resource_available":false,"data":null}},"time_used":1175,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1175,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/index_2.html","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:33.118Z","timestamp":1781962653118,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /index_2.html HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:33 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nvary: accept-encoding\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\ncontent-encoding: zstd\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=D6D77ucjP36czOkme%2F8v%2B4MhBrjGKBLKzkQlGvoyFeXCpApB1gVQnYn6vsFcP%2FSwCc6h%2BmPYO54FOD2D4jhyYa7F7Z0otjxaNeM8EJN7Mk50I61uh736bT7eFJXH\"}]}\r\ncf-ray: a0eb2b35fcceb518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":142,"size_decoded":975,"mime_type":"text/html","magic":"HTML document, ASCII text, with no line terminators","md5":"292f74c92c97c686c723a291030cfa93","sha1":"ff7ce2a278d64bb71b8a15797fd10276ea6f0df2","sha256":"baf0572ea402de47c8c0c44f67fe0b4af40bd7bc06f5733bac13f51bb4ac4d08","sha512":"4f34b0d47baba42b1c93958d291540f76e16fb3f67405fec9d87d0d8d57bf4ae454b63e8462a3b238ff1f6306323f7af84e182781658961d0acac1e55b70d953","ssdeep":"","tlshash":"54c02b22dc04480f3d009fd1cb8af1c4c003dc3ce8315c00b867b544e9ac131c012548","first_seen":"2024-08-19T15:34:07.77924Z","last_seen":"2026-06-20T13:38:12.656096Z","times_seen":462,"resource_available":true,"data":null}},"time_used":79,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":79,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/stream-video.mp4","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:33.758Z","timestamp":1781962653758,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /stream-video.mp4 HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nRange: bytes=1605632-\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 206 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:33 GMT\r\ncontent-type: video/mp4\r\npriority: u=4,i=?0\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\netag: \"6a1b1388-2c6b4c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 1\r\ncontent-range: bytes 1605632-2911051/2911052\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=AMXCRLBXVsUHfYaBstodjMRc2xYb6P1KOkTBe5u3Jh%2BJlvS3s5wDNeOhgLIJGouq2z4%2BrHgb9XWiCl0GnvAkcbVAzEcOA2EbSuvMjB9E5dGLArVO5V7DM5CZITlO\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-length: 1305420\r\ncf-ray: a0eb2b39fceeb518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"video/mp4","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-20T18:29:40.417331Z","times_seen":16586757,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/db808e5b83343dd3.css","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:30.528Z","timestamp":1781962650528,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /db808e5b83343dd3.css HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:30 GMT\r\ncontent-type: text/css\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\netag: W/\"6a1b1388-30e85\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pKTITbeJbhi4MsSTIVOVTshdvk1meBvboL5ZU5iPco0ljUfdWNh5uwLhPNVIkMJwRc%2BDv5%2Bj4%2B6P79AznhnJkIFSqblsVtNEDkeg2pwrGpXcBctcYAh33lEc7aJJ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: a0eb2b25cb8eb518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":200325,"size_decoded":38617,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"80ba684b5a3e800810c797d40a1de559","sha1":"947a1f50491c338e8828e2e1a05332180d3ac876","sha256":"89555ccff6e6f9d7ca76b6b26d67ac3570584b9d45c484f8b84bbdb427bf14f1","sha512":"2455a20d86117c4fd7baf96dd09731a235652498990236bb91a73e1ac9e41ff57e2346450730c3a35551bd3ffe82da0a768b305318b287799ed279f0eb7c1a31","ssdeep":"6144:GGQ1hflhQZaLAb0MesXbTaHkPSVI2EEJaGF+ChfViJEExfPuh/4AVgO4eEWAinZL:OIQWo","tlshash":"6914a26da765443f3c27a0f9d29cbcad911ab1c0ef3a56eafc42511097e17f62ca7600","first_seen":"2026-06-07T04:18:21.526014Z","last_seen":"2026-06-20T13:38:12.657825Z","times_seen":11,"resource_available":false,"data":null}},"time_used":239,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":210,"receive":29,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/5e76b3fbfdc7e54e.css","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:30.531Z","timestamp":1781962650531,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /5e76b3fbfdc7e54e.css HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:30 GMT\r\ncontent-type: text/css\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\netag: W/\"6a1b1388-cb0\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=X5GdpNl0LrKkqyINAbXCuqHJpztc%2BcOOdXNfW2wFa1HawahdxvhDL8Ws5JqvAfHtht3Q456hey%2Fj18HHRQcMPsms%2BGE2RsbE7fRVwsUdk6DYZFA3NvNoqvpfJPm4\"}]}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nvary: accept-encoding\r\ncf-ray: a0eb2b25db8fb518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3248,"size_decoded":1834,"mime_type":"text/css","magic":"ASCII text, with very long lines (3247)","md5":"ff62e2f01eb791a568c3033cb87d3961","sha1":"af58e2e1d26931dc68d1016942c26beeda3835b0","sha256":"0d789746e233b154f39f0ab97ad2fa51de10c03a624b6b70245faa7c3b08c23d","sha512":"6322263c83123d8003f97fc94c8e79a5c8a7d42de8b2794c30d1a762dd5f8a0b8c97c27595ff44e8ae6c156373cddfe467b7a264329e1ca54ba0b6170664ffe1","ssdeep":"","tlshash":"f7617d24f17269a3531b847e80c6fa86b291520d9f3fabf37f90c424708c65707e967a","first_seen":"2025-12-20T19:39:47.581885Z","last_seen":"2026-06-20T13:38:12.659597Z","times_seen":132,"resource_available":false,"data":null}},"time_used":169,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":169,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/wallet_magiceden.webp","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:30.601Z","timestamp":1781962650601,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /wallet_magiceden.webp HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:31 GMT\r\ncontent-type: image/webp\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\netag: W/\"6a1b1388-642\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=n%2BAYEiYS7uPba5PI3nH%2F7RIPWK8NRRSF%2B81zzQi%2Bqf%2BqQisHjltAZGpCVGUOx%2FsQNavF5qo2iIenIMyHKIQgUX4vNLqx1XbUREQZdK5u939Mg%2F0010N2VkZSrUhN\"}]}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\nvary: accept-encoding\r\ncf-ray: a0eb2b264ba6b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1602,"size_decoded":2555,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 200x200, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"b9545f7118bfe56b75fe56c2b67ce762","sha1":"b1dbe54a44548df39418e1979a44a15946a3871c","sha256":"751f8332aea0f7cefabc4c7835cbd69294ca2dad4d8192d77da7123d79f67571","sha512":"0f57266a7d2b388e19e7f70a307c2ae09c228027a68657db737b4b8ab6c369794d469bfc2f08520b11e12d33aad527b1361585884ceed8aa70579f4755d74e0c","ssdeep":"","tlshash":"96312a8c04a873d92a96f6a8679bb6762c480c4ba3d74cf6c074dde00fec1c4b300759","first_seen":"2025-12-31T12:24:56.569709Z","last_seen":"2026-06-20T13:38:12.660249Z","times_seen":109,"resource_available":false,"data":null}},"time_used":1196,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1196,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/wallet_solflare.svg","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:30.602Z","timestamp":1781962650602,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /wallet_solflare.svg HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:30 GMT\r\ncontent-type: image/svg+xml\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5yf4dcGlnxagjyD7OiRvlmt3PFr13mCquronVcm9CRw7L1pmBYHBf9y2yDLL6JvLz62YJrIqCSZfSr47iXETu6iaTsnjSYRa%2BSuCB5XapRASMfDTz64rdPPVa3Or\"}]}\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=5,i\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\netag: W/\"6a1b1388-3fd\"\r\ncf-ray: a0eb2b264ba7b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1021,"size_decoded":1523,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4d559b3c7bf65f2029dd8c0acf2fbfe9","sha1":"9c7d272dfad966afc017026c7cca308f86824e86","sha256":"3657af4bb3ce6c20f8703d7620cd965a6441d0806121cea9c5d013ff793b298e","sha512":"05a78b75739fd9fc440adff181350371dfce5ab8d6f7b3fdf0ef001654657a142bd52ef228fa3bbb248b159b360eaec26a80291797bf168e4f02133ef46ee357","ssdeep":"","tlshash":"a311125a033c3674d6e64d20a528b0c326b2b0c5825471eceab35b722229af244b0a78","first_seen":"2025-09-23T12:59:34.155422Z","last_seen":"2026-06-20T13:38:12.660835Z","times_seen":119,"resource_available":false,"data":null}},"time_used":181,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":181,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/index_4.html","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:33.121Z","timestamp":1781962653121,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /index_4.html HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:34 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\nvary: accept-encoding\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=q0ZPgjKOSxJAQoGJYuroVkvGq2EHc8MOUTa9nRU6w%2Bvl39l6H8VTSbuqhgZcE7od7V2qUfcuDYcBdEUSj%2FW68wHkSCFReGp3ICG8N209QcsDo91t2CWwkRR%2Fyx5N\"}]}\r\ncontent-encoding: zstd\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a0eb2b360cd0b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":142,"size_decoded":973,"mime_type":"text/html","magic":"HTML document, ASCII text, with no line terminators","md5":"292f74c92c97c686c723a291030cfa93","sha1":"ff7ce2a278d64bb71b8a15797fd10276ea6f0df2","sha256":"baf0572ea402de47c8c0c44f67fe0b4af40bd7bc06f5733bac13f51bb4ac4d08","sha512":"4f34b0d47baba42b1c93958d291540f76e16fb3f67405fec9d87d0d8d57bf4ae454b63e8462a3b238ff1f6306323f7af84e182781658961d0acac1e55b70d953","ssdeep":"","tlshash":"54c02b22dc04480f3d009fd1cb8af1c4c003dc3ce8315c00b867b544e9ac131c012548","first_seen":"2024-08-19T15:34:07.77924Z","last_seen":"2026-06-20T13:38:12.656096Z","times_seen":462,"resource_available":true,"data":null}},"time_used":1106,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1106,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/solana-logo-square.webp","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:33.755Z","timestamp":1781962653755,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /solana-logo-square.webp HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:33 GMT\r\ncontent-type: image/webp\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\netag: W/\"6a1b1388-3d4\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\npriority: u=5,i\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=S68QpdytO35%2B1IFvqNOImSuN3lC7%2BdlTnDmvqeKC1cKMcMNpgJKLNCNjOdz%2B%2FDOtTMXNjpVCpq79ANucikR9wwmFxrwtVqSI4vTK1A03k3J1p0eDVjPLzxuXElH7\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: a0eb2b39fcedb518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":980,"size_decoded":1922,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 64x64, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"0cbc759a1b712af205cf8c917417197a","sha1":"397d6cb5137d6f300c91602f7302f594c26f63ff","sha256":"6acf5ab7c9dc0bcb852b17056f6407ba60fb12680d0537f058928c2db6e4aef4","sha512":"042f0e379a47039e67720bb23fb417c4881b25ad40eb6cae55cb2e2fdb1c5b3885707e84f7866225e5764bf2ca0815b57f2ee8cee8747307c78da7b96a1bcafa","ssdeep":"","tlshash":"1811a540f19444908017a218589b24a3e93a54c051b6a27e5bb8bb8190b2535b8ed1fc","first_seen":"2026-02-02T10:11:27.507559Z","last_seen":"2026-06-20T13:38:12.661865Z","times_seen":22,"resource_available":false,"data":null}},"time_used":165,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":165,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/QmNa1AZq4wdhJpVEt5D5kDriNPAUFFP5PjhehT36BquQqi.jpg","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:30.581Z","timestamp":1781962650581,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /QmNa1AZq4wdhJpVEt5D5kDriNPAUFFP5PjhehT36BquQqi.jpg HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:31 GMT\r\ncontent-type: image/jpeg\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MP1a1d6uK81OQ9upDU8s4FmXz%2F%2BDqKdpfUJuQe5AbmqS%2BosNgrmX1ZjroRvWqH1qA0MMxJckmri%2BqRd3hkgohCO52Igo%2FKWZDFATVd79uUO%2F4juCcMSkBklhr5wT\"}]}\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\netag: \"6a1b1388-6b3\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncontent-length: 1715\r\ncf-ray: a0eb2b262b9bb518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1715,"size_decoded":2633,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 64x63, components 3","md5":"1d23c0100a797fb2c494136293958d79","sha1":"c22b2396d8081a29fdc70f867d278e523e4f7919","sha256":"25541c2e919c1130cde9b1844eb21786a942dfdbf592c70155c2cfed4f2422f6","sha512":"6ea445d656a550e104e0457a2dacb027fb87e47ef99b2fba1afd3373452549aeea2e4733b71f28b89ddbb9ce7cea70c13912cdd01f8cd5065497bab521fcf787","ssdeep":"","tlshash":"3031f82aaf1393e2f8ccc3b06ba3275bf69458bbc3b247015e40226608e72519740759","first_seen":"2026-04-12T23:11:38.130434Z","last_seen":"2026-06-20T13:38:12.662442Z","times_seen":10,"resource_available":false,"data":null}},"time_used":1186,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1186,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/wallet_coinbase.svg","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:30.604Z","timestamp":1781962650604,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /wallet_coinbase.svg HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:32 GMT\r\ncontent-type: image/svg+xml\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qUUl%2Bnp2gxrgmP7Vg8aJ%2BFW4Fikf9S1aGpLYeaICA6aYVbNqcXbjiiau7bWfD4X8xG0%2BFBc7HDVhQoH8kqqA4x%2FTWt5c1KhBg9us5gbFDPLQPyQ9GBWqDyxNn8QW\"}]}\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=5,i\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\netag: W/\"6a1b1388-206\"\r\ncf-ray: a0eb2b264ba8b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":518,"size_decoded":1214,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"03d813a0c0c8a475559c8cec40f5d1b3","sha1":"ea4813335e225371c30a56027e2f7e54e247e5d5","sha256":"eb728f9afa3b934f43dc77e99914c2fe62124c056fa6b1c3d00c8b80c917acf4","sha512":"9444c473e807bbc985a03cf74ad5b06cab25237d848c1fbdb6a1b2622a6dfdfc1271adc19df88b0b503d60b5004c54dcbe4c357b9929e735bc112a4d8e61af5c","ssdeep":"","tlshash":"e6f0246f7438a191093cdf786e3ae6c8cc07db4886c5c6ddd3202f055202f851909a86","first_seen":"2024-09-19T20:57:03.484662Z","last_seen":"2026-06-20T13:38:12.665873Z","times_seen":144,"resource_available":false,"data":null}},"time_used":2165,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2165,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/index_3.html","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:33.119Z","timestamp":1781962653119,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /index_3.html HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:33 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\nvary: accept-encoding\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UddS6GVWKDndc5TMTrbp4J9ESaiYrgZd%2BYGJ7Gm5bp9V7BVAPMF%2BTt8Xi08SUKNuQ4ggl%2FyXxSPylW%2FhA%2B14DyOYKa2QZut8DT2mqqCWQqoBwTXl6OMHOzWXAh5P\"}]}\r\ncontent-encoding: zstd\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a0eb2b360ccfb518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":142,"size_decoded":977,"mime_type":"text/html","magic":"HTML document, ASCII text, with no line terminators","md5":"292f74c92c97c686c723a291030cfa93","sha1":"ff7ce2a278d64bb71b8a15797fd10276ea6f0df2","sha256":"baf0572ea402de47c8c0c44f67fe0b4af40bd7bc06f5733bac13f51bb4ac4d08","sha512":"4f34b0d47baba42b1c93958d291540f76e16fb3f67405fec9d87d0d8d57bf4ae454b63e8462a3b238ff1f6306323f7af84e182781658961d0acac1e55b70d953","ssdeep":"","tlshash":"54c02b22dc04480f3d009fd1cb8af1c4c003dc3ce8315c00b867b544e9ac131c012548","first_seen":"2024-08-19T15:34:07.77924Z","last_seen":"2026-06-20T13:38:12.656096Z","times_seen":462,"resource_available":true,"data":null}},"time_used":80,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":80,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/stream-video.mp4","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:33.760Z","timestamp":1781962653760,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /stream-video.mp4 HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nRange: bytes=1245184-\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 206 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:33 GMT\r\ncontent-type: video/mp4\r\npriority: u=4,i=?0\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\netag: \"6a1b1388-2c6b4c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 1\r\ncontent-range: bytes 1245184-2911051/2911052\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qjnvchDICZPChvx6fs1gx51zoNTzvfGgt%2BIZW7porTR0sh%2BNENy9xCAQfUfxPydTfaM22kEtOBVGQMtNt38N5rnBdl8ljFHyvwKmwv0eNfnlGgOUuJNZSHcz8kQ3\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-length: 1665868\r\ncf-ray: a0eb2b3a0cefb518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1665868,"size_decoded":1666817,"mime_type":"video/mp4","magic":"data","md5":"d73da2931ddc3495e6645d74f1ee3b07","sha1":"1bdb87a9a9b65e3d58ffe63aead2c1690ffe3513","sha256":"15154f635fc23e77795dc2738a6dd7a21a758bce5d48b789e04e359d4096dee4","sha512":"317f40b4cdb652357ebf1b341062588eecfafa2a64c9fe772a9d10ab6d64205000cc3f19383f1c4e3e07cc26de6d1e46fe006f2f4c5078ba12970b2081846ffa","ssdeep":"24576:Dd7ULX5/+DL5OQNZSsDZH8T2F4DNeZ8ZkQCOQmWs:Dd7u5WDl9jj4D0Z+kLQ","tlshash":"5725014a62e83774e658633b62dc6d2387dbf516cffa0b27814c542a85874c2fc9ad07","first_seen":"2026-06-20T13:30:33.127367Z","last_seen":"2026-06-20T13:38:12.666451Z","times_seen":2,"resource_available":false,"data":null}},"time_used":56,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":42,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/pump-logomark.svg","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:34.123Z","timestamp":1781962654123,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /pump-logomark.svg HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:34 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=6,i=?0\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BFu%2BfmPkKpbh4lkDPYJPzcQi5MHhB%2FLIuNGWBDIjiVGj2tc2OrVp6dlzgm4k6WIuL5EQr3dvnS%2FtVCriJh2e9oKnnucqTZNpAT1lWxMWYMYoK%2FB4%2FPaJfO4zm3NW\"}]}\r\nage: 3\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\ncontent-encoding: zstd\r\netag: W/\"6a1b1388-a62\"\r\ncf-ray: a0eb2b3c4d18b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2658,"size_decoded":2012,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"8f63fff8de4385a3e5a132656e5343cd","sha1":"860a2077e73020e3898bbdb847ddbb6a252b8da6","sha256":"b51b06b474d5110c9dd864aa915624a6f4b2d128a289ac48621f69fa42bc6db8","sha512":"c5d475efd0538580110d932ce792335bfa95c9e02fad6bde4e4e4fc11956070a81cc2951eadb6cdf0bb56b14a6feec6349f742db6fef03ced9514797121d047f","ssdeep":"","tlshash":"fa5172ff6b444de5de86c2f8eb252ad7782a24d97120464193d43f2a740236c4d8ac93","first_seen":"2026-04-12T23:10:39.468926Z","last_seen":"2026-06-20T13:38:12.667264Z","times_seen":15,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/secureproxy?c=%2Fjmpd%2F","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:34.947Z","timestamp":1781962654947,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"POST /secureproxy?c=%2Fjmpd%2F HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://gocoin.top/\r\ncontent-type: application/json\r\nContent-Length: 1391\r\nOrigin: https://gocoin.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 204 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:35 GMT\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\ncdn-pullzone: 5966451\r\ncdn-requestcountrycode: NL\r\ncache-control: no-cache\r\netag: W/\"a-bAsFyilMr4Ra1hIU5PyoyFRunpI\"\r\nx-ratelimit-limit: 20\r\nx-ratelimit-remaining: 19\r\nx-ratelimit-reset: 1781962715086\r\ncdn-proxyver: 1.57\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 204\r\ncdn-cachedat: 06/20/2026 13:37:35\r\ncdn-edgestorageid: 1332\r\ncdn-requestid: e69fe18637e6051a5f3062dfcb5449ab\r\ncdn-requesttime: 0\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uBde1vCzprHahRpaWUC83SvesnsfKGyGtlP1EJ%2BOD6SWw6ZzDJ5FFl18NBtn%2FvHr%2BOSW%2B42xDrbtxYjbbyYQgMd3PiNr901a72GaiF0fbo45yTIIawHWq1FGV2Zm\"}]}\r\npriority: u=4,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a0eb2b416d44b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":3328,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-06-20T18:29:40.417331Z","times_seen":16586757,"resource_available":true,"data":null}},"time_used":580,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":580,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/wallet_tokenpocket.svg","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:30.605Z","timestamp":1781962650605,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /wallet_tokenpocket.svg HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:31 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=5,i\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6b7g%2F6id23mlgf1v9fbUNXgeJc5%2FbUkNt3%2BhBS676A7g6TsqQwouq8%2FPMbDLE%2F8hDMHBk0LQL%2BktF%2F6C9PzyRZe4w4h59yP07vxUyj3CkDmLW%2FP7ooonv1suOWyo\"}]}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\netag: W/\"6a1b1388-8ac\"\r\ncf-ray: a0eb2b264ba9b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2220,"size_decoded":1941,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c8b05a7db1289009d5b1cff1fce3c318","sha1":"2960c5887c4fc46e03b54edd9c3a814930adae58","sha256":"8639f1b554805fc4f701a8629deddd603c18f622b60d35f63ad686032b91b549","sha512":"adef4da670e5e225fefa46f3f37dd92a6d92a7414b71b07a208c218bdfbfe349ed4cd022884da8caddf62bdb55aabf6f42b5578fc5f492c2961057833ef552ab","ssdeep":"","tlshash":"a84111e93b94d4505114979b7f7874bcc42bc2c6a98588d1d0517f1f64981fe2d2efc1","first_seen":"2025-12-31T12:24:56.570544Z","last_seen":"2026-06-20T13:38:12.667841Z","times_seen":113,"resource_available":false,"data":null}},"time_used":1194,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1194,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/stream-video.mp4","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:32.270Z","timestamp":1781962652270,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /stream-video.mp4 HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nRange: bytes=0-\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 206 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:32 GMT\r\ncontent-type: video/mp4\r\npriority: u=4,i=?0\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\netag: \"6a1b1388-2c6b4c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-range: bytes 0-2911051/2911052\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fJwt2Kl2ph7fu3%2BxjAUtjIRIBmc2uqlPnBzwigMIDGDkuvozrqSoeq0uVzqudTobbb914q0GiAOc7BT1cAvQlT3Jb%2FyDuB7PlodpkgZjRXGNJt%2Be5ecmXlaWRVGE\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-length: 2911052\r\ncf-ray: a0eb2b30bc75b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2036032,"size_decoded":2036970,"mime_type":"video/mp4","magic":"ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]","md5":"7d0cf68fe3a5186fba5097615532eae2","sha1":"1bce7c232f8f012e8c31f4bd291c541e762c4986","sha256":"225c37f087287ae6c320d2e76a5739426574a2ef6dbd527b94a4ba2e8aabd0fa","sha512":"3bbc1e75c348fd8e8e9b9e1bf149ec6deea5d974c9359f0cd8b1a6c3858a308715f1e32ec3a6b04b5d58d6e11c668f3ef1b776e6b8e0cd312072e57b9fef55ff","ssdeep":"24576:IWeJxcPJMQohgp507DxGhuFBz1I/3C2bJDAeDqNaZ:pbhmIPuFF1I/3KeWNaZ","tlshash":"9625128960f53330ca69277b21ec6d03a7c7f526cafe1b2b554c44a691874c3edda943","first_seen":"2026-04-12T23:10:39.531445Z","last_seen":"2026-06-20T13:38:12.668781Z","times_seen":12,"resource_available":false,"data":null}},"time_used":863,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":185,"receive":678,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/QmTbWsPMUHRbCarGWtsGaP2bcynNMvzWMQw5MgVYP9vprW.gif","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:32.278Z","timestamp":1781962652278,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /QmTbWsPMUHRbCarGWtsGaP2bcynNMvzWMQw5MgVYP9vprW.gif HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:32 GMT\r\ncontent-type: image/gif\r\npriority: u=5,i\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\netag: \"6a1b1388-22b27\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0m74m4IOpBF6AzXoLJVuciOpSt2R83iqWWkPBMwnuMfuTVifQY04wDX%2FBSsHH6sFYmLhumi2BH%2BlBXlwU%2BzkqK0b0qNMd%2BjpNpveujEA5n9pfFxxinvdXchwaZsp\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-length: 142119\r\ncf-ray: a0eb2b30bc86b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":142119,"size_decoded":143036,"mime_type":"image/gif","magic":"GIF image data, version 89a, 64 x 64","md5":"5a2e6c28f5368cb6e21828050b00f59b","sha1":"cf8c655b5bd0a2e593b15f09e688e02c33df1fbf","sha256":"1dc36240e6ef1014a5674165a37be6cb521d57563e77f6d8240fc09617995a44","sha512":"55e87c1f5e6072fb29dea2c177f42b1a1b0e6c1f110d559d052ffd1032d1b55b283f4a474be9e3c60b345c5cef6a4b25b571e8f20ffda7966eb6222dbecdd88b","ssdeep":"3072:n+MntJ7StAkJYLBXiaHePMOeKb0yQjpYZOIMey:+MtJ7StDYLBXrHjOeKb0hjpY1Ly","tlshash":"67d3024eec690ad0fc162431596ddfae162e6289cc10fb06ec6007e875e506b92f67f9","first_seen":"2025-12-20T19:39:47.743294Z","last_seen":"2026-06-20T13:38:12.669378Z","times_seen":106,"resource_available":false,"data":null}},"time_used":278,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":192,"receive":86,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/wallet_metamask.svg","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:30.599Z","timestamp":1781962650599,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /wallet_metamask.svg HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:32 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=5,i\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MCfhp5vvqphl58Gj%2BALIZ4RtHV4SZxlxXhULrvysAxTos7jbEqoyKpZRAGZBSbtcdbJ%2Fz5g56M3YgrtS737NKMsGexUGeOAR0pfc9yyRFL4lqIjngBFjY5IdBrNR\"}]}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\netag: W/\"6a1b1388-676\"\r\ncf-ray: a0eb2b263ba5b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1654,"size_decoded":1688,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1515717ec860410450bca1a8ff648326","sha1":"d3add77c919057501b4dcc619a2178c3be401b85","sha256":"fe9211cd30dbcbbbf40bc3dab22c8f29e5e8c9159085c524e93ff0d555a4f7e0","sha512":"f51d8d0d53db239f3d0317bfc6e4405a657e6f406764355a29900c8a05b9726b344e2167fcffefe463a99c700d4b115a2fe16bb1b0d5ffcf6b0ff8f72524f545","ssdeep":"","tlshash":"3d311284e1b90bbd180357f0c528b5e375677cae6b6483e8248843b02107befc4d466c","first_seen":"2025-09-28T19:09:38.680842Z","last_seen":"2026-06-20T13:38:12.669961Z","times_seen":116,"resource_available":false,"data":null}},"time_used":2165,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2165,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/b731d5a1fd2592a1.css","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:30.536Z","timestamp":1781962650536,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /b731d5a1fd2592a1.css HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:31 GMT\r\ncontent-type: text/css\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\netag: W/\"6a1b1388-c3d4\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IiSCkG597082%2Bjlo2VkRNAUffSU6Adqy1de9oqLzunBluiaf2DhIHHGldnQMd4cM82O5pvBhd2EeAzNAeyBzFVgW%2F%2B1wDY7L1AfEbXoOKHPzb5nVtbZv5ec%2BWRnC\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: a0eb2b25db93b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":50132,"size_decoded":12035,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (47995)","md5":"337ce5ab722c2ccec8c586343a0dffde","sha1":"87ea45d0d03ed6ba76ab67c422740684864f2fe9","sha256":"2b0f56f296550c868629d8e893f80f2285622be5427adf900e04102a45624712","sha512":"1787db460e83854d9437e40b44c1ae8837decf634eabf8e7706a49f701e39313cc26ace2e4748ebf67dab66e50728d6d158f78e539601b85d749b9bf2ac190ec","ssdeep":"384:peyoBoIUcYPWuOV8Q+cmOzFkR5E2iCsn+D7MJf+EhKRhOrFzR04NZO6QePLlDZbR:gKc5uOR6MJzKjOpRT6qm7C","tlshash":"943345e8ee8ca13aa813615d178c958d922dfe00afd35a98e9d17138cdc7be31578744","first_seen":"2025-12-20T19:39:47.5671Z","last_seen":"2026-06-20T13:38:12.670532Z","times_seen":110,"resource_available":false,"data":null}},"time_used":1226,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1226,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/pump-logomark.svg","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:30.547Z","timestamp":1781962650547,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /pump-logomark.svg HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:30 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=5,i\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=95CVwntXQVRc5J2ZRFsXHt337C4Q36Vsyozc3Kfd657vPvk40mZCb%2FVMdEi4Ch4pwDrhlSZB3zAjo55j8gnGH8Hr35ZV8QzGRMkqmQWV84ClMjAgQdLChskBehOP\"}]}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\netag: W/\"6a1b1388-a62\"\r\ncf-ray: a0eb2b25eb96b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2658,"size_decoded":1994,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"8f63fff8de4385a3e5a132656e5343cd","sha1":"860a2077e73020e3898bbdb847ddbb6a252b8da6","sha256":"b51b06b474d5110c9dd864aa915624a6f4b2d128a289ac48621f69fa42bc6db8","sha512":"c5d475efd0538580110d932ce792335bfa95c9e02fad6bde4e4e4fc11956070a81cc2951eadb6cdf0bb56b14a6feec6349f742db6fef03ced9514797121d047f","ssdeep":"","tlshash":"fa5172ff6b444de5de86c2f8eb252ad7782a24d97120464193d43f2a740236c4d8ac93","first_seen":"2026-04-12T23:10:39.468926Z","last_seen":"2026-06-20T13:38:12.667264Z","times_seen":15,"resource_available":false,"data":null}},"time_used":168,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":168,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/mobile-upsell.svg","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:30.549Z","timestamp":1781962650549,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /mobile-upsell.svg HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:30 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=5,i\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=icnHBQiu4rFE6RibGxebA4qXzj9sF9%2B%2FKfIU7Q%2B%2FV%2BTXzFZ%2F5xs9GqFGDHqP9Ae195q3Qw87%2F7DceNehTWO0N%2FF4l0h2arZWhWgPUuzUa%2FWnFfuKG0SYt6iD8LCV\"}]}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\netag: W/\"6a1b1388-ec48\"\r\ncf-ray: a0eb2b25fb97b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":60488,"size_decoded":23469,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"20e346583b6756a13559f1583009b9e2","sha1":"9b7703a462a9c20fb947cc1fd724a75d61ba3238","sha256":"d2161f883307c949aa8149a3de14fe1571e050c577c8af6b38a4a3b56c3cba83","sha512":"ede21f2d59a546e212d8dedd1afdde210ddcbb5706a55325bbb4ca132f96b848fefedaa394b97e4b8843792cc031fc53614e501378a620f4acea8146bab9ca3c","ssdeep":"768:hFj6oZjZWzlcH6iVbSCqjew8xrGfKsqaI4:1ZjZS2RMSRxriH","tlshash":"7c43ab30778c1509d270abdd831ca496e833a0839a1b0594cb433dea5f6a795fd7b1ee","first_seen":"2025-08-29T22:10:37.955387Z","last_seen":"2026-06-20T13:38:12.671256Z","times_seen":207,"resource_available":false,"data":null}},"time_used":240,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":191,"receive":49,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/QmbViKxCrG8e9jdWPcQNqLBYDY18xvvgYrx61ZP8HuFYPd.gif","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:30.587Z","timestamp":1781962650587,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /QmbViKxCrG8e9jdWPcQNqLBYDY18xvvgYrx61ZP8HuFYPd.gif HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:33 GMT\r\ncontent-type: image/gif\r\npriority: u=5,i\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\netag: \"6a1b1388-7a62\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Q47VFcs9KUhIyM7LlJpTbveVexWz0OxYYS%2BYdnGS4pmPvcjLql%2FPrL%2FLGZHjNNvYP%2Bz3igmC2CT9Qn4PXLtqAQfPJ8frHKv3AHshwwUh4lShTTU7Hl0HA%2FVDGeNW\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-length: 31330\r\ncf-ray: a0eb2b262b9db518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31330,"size_decoded":32247,"mime_type":"image/gif","magic":"GIF image data, version 89a, 64 x 64","md5":"303c540c9d97f0670bd5632d2806d301","sha1":"16d0319eccace15d6b135e25b5304213819c7a80","sha256":"34ce4f2790d31d512d2b5b34501b445d5123385a4c47573731abae9e2817e4b6","sha512":"a31cc9f0b8411e4866da0cd39d92a2718b0dead4cade0825c1325cb702412214c5c7b0bb5a406955b0dfe2d42501df71ef8e132cc2b1f236eb2627bf310a86af","ssdeep":"768:L5z2/TRvjQxpDaD6uevgsiLZa8shIw2KwZq0PYW+onwZ8/C:L5z2bCvJvpNIw2dPYVonZC","tlshash":"a7e2d09be40674a9f8590bb253d04abd2990bae8704ad3429f4438babd4c5fc371c1fd","first_seen":"2026-05-02T21:27:14.121076Z","last_seen":"2026-06-20T13:38:12.671838Z","times_seen":9,"resource_available":false,"data":null}},"time_used":3235,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":3215,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/Inter-Regular.woff2","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:32.016Z","timestamp":1781962652016,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /Inter-Regular.woff2 HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/b1ceb54df6a409e5.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:32 GMT\r\ncontent-type: font/woff2\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rexJ%2F%2FfJlYhE0Vic3gug%2Bx2watWGGzBGFK52VLK0llj4YAFsGPEJHvbCzqGNGjANzmR1XtLDqxmrSCGC1qu9PjEPOBvhOx8hUzMeenXo3pGofk1uzaym%2Bd9dWPmX\"}]}\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\netag: \"6a1b1388-1b2a4\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncontent-length: 111268\r\ncf-ray: a0eb2b2f2c46b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":111268,"size_decoded":112189,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 111268, version 4.66","md5":"3875f83574973c732136a45f628e64a6","sha1":"b7a0b6fbebc40eb29b76cf135c4b7be50b981b4b","sha256":"e06f6b1bc553aaea4e4668023ed0ab0a147129c3107f511bc7d03d361b0ae085","sha512":"c4d06c4d73f83f3bc150ec5c3fc792af04161ec98c298a526b717b09e0f10597c688ea1827c1b54324b809cccd7c8a51e637eb822f192744f16556d0fd5b2efb","ssdeep":"3072:oSVIcbST1rITm6KORAGB/6lp7l8MBrVAPg:oSVIcEwm6xlB/6lp7lzBJ/","tlshash":"2ab312cd46ab0e22c7db93b491ea634d5ab188f8e3b630358993ff31155093723e615d","first_seen":"2024-11-19T20:50:46.185622Z","last_seen":"2026-06-20T18:08:17.791409Z","times_seen":54204,"resource_available":false,"data":null}},"time_used":671,"timings":{"blocked":8,"dns":0,"connect":0,"send":0,"wait":605,"receive":58,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/stream-video.mp4","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:33.139Z","timestamp":1781962653139,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /stream-video.mp4 HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nRange: bytes=2686976-\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 206 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:33 GMT\r\ncontent-type: video/mp4\r\npriority: u=4,i=?0\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\netag: \"6a1b1388-2c6b4c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 0\r\ncontent-range: bytes 2686976-2911051/2911052\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BU073B%2B1jK2YzFJMwhZHR2%2BJREOR98ZHHBZqn%2BXV8TAgcn3bkOb0OBDbvMH%2FXv3JhxdOkcEoW0Jk9dbSlOTkpqpm8VLPM67pauJ8iNvSniPNjueaU9W7SvBFMIar\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-length: 224076\r\ncf-ray: a0eb2b361cd1b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":224076,"size_decoded":225030,"mime_type":"video/mp4","magic":"data","md5":"50be76425bd97896c6ca5ce8b47e0344","sha1":"a1eef451690ac6aa0a5931d9baa34adb398f1bb3","sha256":"fd6873b4eff5bc8529370dc61c4f50d5191fc0539427a8bbaa74fb234724f459","sha512":"7ad7130ef487ae590125bfd488cf30814f34f73b6538cda43272c9bc9befcd95c11ef235415f71fc7727466e1eb6f04ce80172471ae9ed3b40ce6ebff3cea5c9","ssdeep":"3072:iHVTKivHN7GBDZpBX6SoWOpTthBM6GlyXFKDVF6vK3OgZBrncJwnRCf5R8Fd1xTr:WTKi17wDBE5+Qrt61QFF8l","tlshash":"eb248f9dbb04803bd6a15372e8f107243372d4a817d7034f4aaca73d4e993a86eb6dd5","first_seen":"2026-04-12T23:10:39.54337Z","last_seen":"2026-06-20T13:38:12.679917Z","times_seen":15,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/c43a4607efe63bdf.css","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:30.533Z","timestamp":1781962650533,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /c43a4607efe63bdf.css HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:30 GMT\r\ncontent-type: text/css\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\netag: W/\"6a1b1388-33ee9\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YZEB9kTvkUoRK8X5AWrCOVNI%2FX2ImAvm2jhFeI6o9G87AXHgW57NhRAXZtUCrpa6PadluevbUdBm8wpMgbOtVTxVxOcJnmuwMNZUo3gppDcYy8r%2F2mn9PuZH1K9P\"}]}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nvary: accept-encoding\r\ncf-ray: a0eb2b25db90b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":212713,"size_decoded":41515,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"4bf5177e8fc18cb70d7f1c178cad3d88","sha1":"609a177d9d66c9dcbf362ff847d1a4d6e063085d","sha256":"cdd104a91682a2e1f06864a906ee540ae4d6f3d51f1f03dc743fcec6d6629547","sha512":"f98c935761603ee6a22393b4a33d3436f8eaa0f64db2a93303e2ff880c85fe977a23c247fa0ac552eaf256004b0bf2b3f9f51961d2a2e77545989f879ef4fa44","ssdeep":"6144:GXWQ1hflhQZaLAb0MesXbTaHkPSVI2EEJaGF+ChfViJEExfPuh/4AVgO4eEWAinf:IoIIQWo","tlshash":"9d24a36da765443f7c2760f9d29cbcad901ab1c0ef3a1aeafc42511097e17f62da7600","first_seen":"2026-06-07T04:18:21.512977Z","last_seen":"2026-06-20T13:38:12.681946Z","times_seen":11,"resource_available":false,"data":null}},"time_used":250,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":218,"receive":32,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/QmeSzchzEPqCU1jwTnsipwcBAeH7S4bmVvFGfF65iA1BY1.png","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:30.579Z","timestamp":1781962650579,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /QmeSzchzEPqCU1jwTnsipwcBAeH7S4bmVvFGfF65iA1BY1.png HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:30 GMT\r\ncontent-type: image/png\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Z8s9MusFsGrXEVN5h%2Fq6%2BfedKNGhap0nn3%2B4X5THm9utMjw%2BuRdEjxC2gCWH78wbrP6a4aLJqVdfMhvjK7g6LZFHfqHta%2BA%2BKHvd3clRrj0CHz85wikdmyRxpPhZ\"}]}\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\netag: \"6a1b1388-96a\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncontent-length: 2410\r\ncf-ray: a0eb2b261b9ab518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2410,"size_decoded":3327,"mime_type":"image/png","magic":"PNG image data, 64 x 51, 8-bit colormap, non-interlaced","md5":"01c0a2dbdcd2087be395e8a4eab047ed","sha1":"fa18c291f3d8fc828ac36825b3f7de19d82516e2","sha256":"41a4a5021384c0b0beb0c21b2842a98e75452ad80066d9825d7222687f653aea","sha512":"f5ea4f58624cb2a14d125d834771778d8b58caed981050c8348cea897244f20429232cd3d74701da4c73917a72c626d7409ff6e121dec86bb7cd8816bf4b2d85","ssdeep":"","tlshash":"fd411d165e533db98d2945d903a3a32dd339f1a8d25c47c0dd97d75381358cc8384ea9","first_seen":"2025-08-29T22:10:37.991619Z","last_seen":"2026-06-20T13:38:12.682604Z","times_seen":121,"resource_available":false,"data":null}},"time_used":191,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":191,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/image_6499a8936200143cdbce9dd84f628c77ed25c7cd.svg","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:30.592Z","timestamp":1781962650592,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /image_6499a8936200143cdbce9dd84f628c77ed25c7cd.svg HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:30 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=5,i\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MVSPMRGx5Y85oI8lknLsS2FgMWmDdRTeJht2ppEeAgZIPa0TvdOKmuJBFZY%2F86%2Fb1SIr5LisBZ56bN44QBOSelpOWa33E3KcAUZsdEgOr163eB6ZVj8AFDd%2B9Xc%2F\"}]}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\netag: W/\"6a1b1388-89b\"\r\ncf-ray: a0eb2b263ba1b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2203,"size_decoded":1866,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2453bde6c21392341f27c6d2152db2cd","sha1":"6499a8936200143cdbce9dd84f628c77ed25c7cd","sha256":"5fd26b35cde9423feac2a555312cd5a8e32bc07d934c59e6b750bdbdebac5049","sha512":"8417ad500c4643fcf4333cede2ac6b93051a97d29bea9e731d317156d357c3d8e394dce7a25e213bf07851b2168ab3a982473e298aa4d8ff7b41400e56dfbe35","ssdeep":"","tlshash":"a54181ecb71498bcea9807bfb61420d8361981f93a2740de903e339034219adc414ccf","first_seen":"2025-12-18T09:47:26.931007Z","last_seen":"2026-06-20T13:38:12.683277Z","times_seen":124,"resource_available":false,"data":null}},"time_used":163,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":163,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/icon2.png","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:34.121Z","timestamp":1781962654121,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /icon2.png HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:35 GMT\r\ncontent-type: image/png\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZGaFzhjmzqOIMK7Eoo%2Bj8D1zB8aU3ByukCtLu%2Fom3G6wKdkshlTzw5dEv5K6JqUsgjFahaw%2FkqI53r3k%2Fc%2B8wXHJiwz3Ono%2BaPxCfPY2TABc2mvc3LJENYJtouhX\"}]}\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\netag: \"6a1b1388-29c20\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\ncontent-length: 171040\r\ncf-ray: a0eb2b3c4d17b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":171040,"size_decoded":171964,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"f1bd488f76adea521d1cfd37122ca30e","sha1":"1bbb7d1e1f5307bc38c179d1da114edebf2cc75e","sha256":"7dc9c4c4c538d66db7cb3a92f6481c57cb1d435742ec651e6db3d3953431707d","sha512":"c03166a137e07787b923e1683e7b02199be51f7e41d9497c6f33bc9ab0ccc4111895692be41c36f9c1810d76e1c761d3397e35fa72e4267c73d4aaaad48c66cb","ssdeep":"3072:Cd5h51rQK4TzyXx20z6RqAicPFqIcM5gRy1xNfXE0wBBLhO0y+0pVxX1Hilw:C/1EtyX40z6Y4PAVSCsxNfXElBJ/y+iL","tlshash":"d3f323da1e689adceb1302917db05ded37a670e45ba1b640fcc80d14b5d3379a891bf0","first_seen":"2025-02-16T19:20:16.384713Z","last_seen":"2026-06-20T13:38:12.68455Z","times_seen":187,"resource_available":false,"data":null}},"time_used":1202,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1118,"receive":84,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/secureproxy?c=%2Fipfs%2FTw1SNmwNPfNaFgLschkEKw4f6885d41631efed3c3d11cfd77ddeb8%3Ft%3D1781962650811","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:30.813Z","timestamp":1781962650813,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /secureproxy?c=%2Fipfs%2FTw1SNmwNPfNaFgLschkEKw4f6885d41631efed3c3d11cfd77ddeb8%3Ft%3D1781962650811 HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:31 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncast-mode: default\r\ncontent-security-policy: frame-ancestors http: https:, frame-ancestors http: https:\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,PUT,POST,DELETE,PATCH,OPTIONS\r\naccess-control-allow-headers: Content-Type, Authorization, Content-Length, X-Requested-With, Accept, Origin\r\naccess-control-allow-credentials: true\r\nvary: Accept-Encoding\r\ncdn-pullzone: 5966451\r\ncdn-requestcountrycode: NL\r\ncache-control: no-cache\r\netag: W/\"972b7-Tzu2DvqbAH4SVKs5C5fmyc/76wM\"\r\npragma: no-cache\r\ncontent-disposition: attachment; filename=GZpEtX7WmWkFtrrGbkkclw.js\r\ncdn-proxyver: 1.57\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 06/20/2026 13:37:31\r\ncdn-edgestorageid: 1328\r\ncdn-requestid: 06d9894c2649aa5ca06acca9e27a9196\r\ncdn-cache: BYPASS\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7ThLdY2pd2X%2Fy%2Fv6CdC8jcdUvDY7DDS02Q8qms9yXfGG%2Bh5vO74w7jcAaqXLxzz7l3ieDKewtfknWrxum0ChWfOvtKzwaYCkCnpLFv8KDQ64%2BrG6YaTuVu2ApQTG\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a0eb2b279bb3b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":619191,"size_decoded":137411,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"20a3fa2b2ef19ca173431cfc20f6e948","sha1":"4f3bb60efa9b007e1254ab390b97e6c9cffbeb03","sha256":"ee4021de44561cbaf378d1c721bfdbf7899bbdcab71d24fb5f966f6126ecaa94","sha512":"059b2a7838acc61612adb35085f03f657a48dc161beec6143cf58b4f91205bdbc3010e85aa2b89f448c16728fc18814a21f83b6407cbeab1d6341e1e11cdfaff","ssdeep":"6144:Bh5gD1zQDCMEWm7ECNF0gct3VyBKbMboOeC2PYqxQWNahLYzO5WuS2KImDnyJnU6:Js1zQDC6m7hFqa/J/","tlshash":"fad4becaa73d377f5ae01aab0c2b413fefc80d1e216b09c852d1b8d9527970693d915e","first_seen":"2026-06-20T13:38:12.685807Z","last_seen":"2026-06-20T13:38:12.685807Z","times_seen":1,"resource_available":true,"data":null}},"time_used":636,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":566,"receive":70,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/stream-video.mp4","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:32.272Z","timestamp":1781962652272,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /stream-video.mp4 HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nRange: bytes=0-\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 206 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:32 GMT\r\ncontent-type: video/mp4\r\npriority: u=4,i=?0\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\netag: \"6a1b1388-2c6b4c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 0\r\ncontent-range: bytes 0-2911051/2911052\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hg9z3O%2Bs%2FCmU5iVSB1SXu5FgO3kgCU5kIeufgBPvBw142%2BAUflXNyEyoxjS2djwRBhT4A89q7ODfco7bPJzBJZQNGbD1zSClI0Gz3ABZq%2F28viVJvfqSEduL24AO\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-length: 2911052\r\ncf-ray: a0eb2b30bc77b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1613003,"size_decoded":1613950,"mime_type":"video/mp4","magic":"ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]","md5":"7d0cf68fe3a5186fba5097615532eae2","sha1":"1bce7c232f8f012e8c31f4bd291c541e762c4986","sha256":"225c37f087287ae6c320d2e76a5739426574a2ef6dbd527b94a4ba2e8aabd0fa","sha512":"3bbc1e75c348fd8e8e9b9e1bf149ec6deea5d974c9359f0cd8b1a6c3858a308715f1e32ec3a6b04b5d58d6e11c668f3ef1b776e6b8e0cd312072e57b9fef55ff","ssdeep":"24576:IWeJxcPJMQohgp507DxGhuFBz1I/3C2bJDAeDqNaZ:pbhmIPuFF1I/3KeWNaZ","tlshash":"9625128960f53330ca69277b21ec6d03a7c7f526cafe1b2b554c44a691874c3edda943","first_seen":"2026-04-12T23:10:39.531445Z","last_seen":"2026-06-20T13:38:12.668781Z","times_seen":12,"resource_available":false,"data":null}},"time_used":862,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":182,"receive":680,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/QmRNZ8dzk34RhMMyoSiR4QzHCbSB4Fo9utMMsLG1mtqaua.jpg","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:32.280Z","timestamp":1781962652280,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /QmRNZ8dzk34RhMMyoSiR4QzHCbSB4Fo9utMMsLG1mtqaua.jpg HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:32 GMT\r\ncontent-type: image/jpeg\r\npriority: u=5,i\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\netag: \"6a1b1388-533\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=53DX3njfqNoICkjko6yOIq%2FWru6XUnLkTgGoMnyZE7HojSKSupvKZKC54%2Fi945TJZhFBaUmjOUYk8gIO2DBeg28Xi4qQhV9W%2FXN71phBuXAKynQdgEmim5B0UjjZ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-length: 1331\r\ncf-ray: a0eb2b30cc8eb518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1331,"size_decoded":2243,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 64x64, components 3","md5":"2f4e2ec11d224287a3012da780a67ff9","sha1":"4394b071e38e95205a7c1d42e34003a0321d6700","sha256":"7fa8737433a619abe632d305306e6b00201e5a16159ee8ce3b92262081790341","sha512":"e485cac6ec1478e9d874e96fa1f716989b178e8ec17810a3b5a1e99ecb0d50562d71320b74dc7b72e2d4b1699105be6ddd9d31d9d292b554cbe5dbb17c28a384","ssdeep":"","tlshash":"d721c5aebf38e4a3edcea3b407950d326803b9c3105d870a9141ecd510ff042479274a","first_seen":"2025-12-20T19:39:47.628849Z","last_seen":"2026-06-20T13:38:12.690171Z","times_seen":110,"resource_available":false,"data":null}},"time_used":88,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":88,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-20T13:37:30.053Z","timestamp":1781962650053,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:30 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nvary: accept-encoding\r\ncf-cache-status: DYNAMIC\r\npriority: u=0,i\r\ncontent-encoding: zstd\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7sdW5plj%2FGxqISkgxpxHdXVZK0N%2FmadiIkfHunHqrH3Mv3fMTB0Kl2D7nB3l8vxfMUJduyv8UQcuETt%2Bam4etpYbC6fbKnGoOc0pm7twf2W7dPU7AX5dPRQ7Wtw7\"}]}\r\ncf-ray: a0eb2b233b6ab518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4257940,"size_decoded":84595,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (553)","md5":"f3a1bee52c72ab6eb25574a97b4d1f7b","sha1":"5b3942df8440d9fdfe77af527fc8ab63bda187bc","sha256":"1f90924a8d5d5b74df1cbdc0ca52968d5792954a263ce09f94bc49684a7cff51","sha512":"795bae69c2acac3d4a71383d94effd96e5c5809b5308bcd4990c17e8e68579a1d9101da3b2e34a305bcf2f3b601f2141bc926d2398eab16576f365bfff40bca3","ssdeep":"1536:Mc7rIXg0txluWyXcLo+TVHphUJ/fX7EmhViAasu/YhenNLAw3bnO542PFFm:nHIQ0nnphs7VhQpkbgjOe2NFm","tlshash":"ec2545f163b452e60087ca75fa31d51ba393f9bbed1ba20473ec87805f4a8e2cc56558","first_seen":"2026-06-20T13:38:12.694503Z","last_seen":"2026-06-20T13:38:12.694503Z","times_seen":1,"resource_available":true,"data":null}},"time_used":387,"timings":{"blocked":-1,"dns":35,"connect":22,"send":0,"wait":189,"receive":141,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/b1ceb54df6a409e5.css","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:30.526Z","timestamp":1781962650526,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /b1ceb54df6a409e5.css HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:30 GMT\r\ncontent-type: text/css\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\netag: W/\"6a1b1388-2b80\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=j5ulRF4WJ4vDLy8pCAhWCSqsr40EEPfEEdenxlgjQf8AcBKGqFfSH63LAeIYnXhcs%2FTFaRdHihht60hbooMUgqFqboOSEUKXaMgT3Np38gVsrO4DVNnUsrHYo87A\"}]}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nvary: accept-encoding\r\ncf-ray: a0eb2b25cb8db518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11136,"size_decoded":3476,"mime_type":"text/css","magic":"ASCII text, with very long lines (4808)","md5":"4c376c0b3d4ff89c29a839d79a68ee63","sha1":"6a988cb659ecb1de8a1df6a2d10258273fc04f28","sha256":"e2d77f1ac5e7001ef39d20e6476d4c1f05899e2460a6462de0999e179c35365f","sha512":"0afdf5e075996fb522ccd2b9d4c05101c953e863c7f0562f62f5aa1be1c070af7ffa1ff5aab0c2b6f2303c550429ac818aaa49dc0ca9c35bbc50ee91449d3283","ssdeep":"192:R+Xuj1zxMi7ttEtfKmw88YtOkKTuaGXYF:QXs1zxMi7ttEtfKmw88YtiTuab","tlshash":"d83222b1b0b01333661f2402f18b5809efc1a6d58a622fe5e97d93e84ad315522fef17","first_seen":"2026-06-07T04:18:21.474158Z","last_seen":"2026-06-20T13:38:12.696002Z","times_seen":7,"resource_available":false,"data":null}},"time_used":164,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":164,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/QmeSzchzEPqCU1jwTnsipwcBAeH7S4bmVvFGfF65iA1BY1.html","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:30.588Z","timestamp":1781962650588,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /QmeSzchzEPqCU1jwTnsipwcBAeH7S4bmVvFGfF65iA1BY1.html HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:32 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nvary: accept-encoding\r\ncf-cache-status: DYNAMIC\r\npriority: u=5,i\r\ncontent-encoding: zstd\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eYv4KWrmVzebijzFui7uDFQg%2BiE7Fim8caYi5L6nI%2BJ5asUMFhieADNczNzVcauRFk%2BEwAmqoxJXCwLID7I3xEjKwQuKggZkMOlguNt1Jz4ibdNSASYdLoO4prU0\"}]}\r\ncf-ray: a0eb2b262b9eb518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"dc.js","description":"A multi-dimensional charting library built to work natively with crossfilter and rendered using d3.js","website":"https://dc-js.github.io/dc.js/","common_platform_enumeration":"","icon":"dc.js.png","categories":["JavaScript graphics","JavaScript libraries"]},{"name":"C3.js","description":"D3 based reusable chart library","website":"https://c3js.org/","common_platform_enumeration":"","icon":"C3.js.png","categories":["JavaScript libraries"]},{"name":"Nuxt.js","description":"Nuxt is a Vue framework for developing modern web applications.","website":"https://nuxt.com","common_platform_enumeration":"","icon":"Nuxt.js.svg","categories":["JavaScript frameworks","Web frameworks","Web servers","Static site generator"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4339986,"size_decoded":101268,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (4092)","md5":"9da31dc01aaf095bc452f89427dfc4ee","sha1":"a735efc9a0c3010cadca7c5b6f16a8ab1b274746","sha256":"5dc41b29f7ef85ce6f89956473de5a1b10dc9b7ac5bb71220e077159f0c8a676","sha512":"09d41adf357a8d9a43d52750f54e1d50055c206f4cbcdaf334af95c0c10233ee6cf5beac20a4b2581e22e70254bd5f8f05ccb1414ff7efa2c0a750a9ca90280c","ssdeep":"1536:7/r+ahw0txluWyXcLo+TVXYODMfciGSJBAcqj3L3FRuo5nSX/7RzVgqqVu/YFenE:7T+aK0n3/IZbAFR9GlzGDbaYZYgSFM","tlshash":"ec25aaf26364d69500cbcd78fa32ee5aa2d7e5b7f827620873dce6811f4a4a28d53054","first_seen":"2026-05-02T21:27:14.142981Z","last_seen":"2026-06-20T13:38:12.696576Z","times_seen":6,"resource_available":true,"data":null}},"time_used":2328,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2186,"receive":142,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/dialog-clickwrap-cover.webp","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:30.589Z","timestamp":1781962650589,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /dialog-clickwrap-cover.webp HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:32 GMT\r\ncontent-type: image/webp\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\netag: W/\"6a1b1388-c0f8\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\npriority: u=5,i\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ap0%2FKBRWUDthYK9IZH2OX73h7o1dlOMtD%2FQPt07fx5wD%2FU6VBBeC5UcPngjPzWiXApoxAvjbOAnClAz7EZzvsAoiMS9tzCyjuTAfIGHaHpqMSTvrH%2BD8BBYS%2B3fZ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: a0eb2b263b9fb518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":49400,"size_decoded":50360,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1278x718, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"34a5a0b4ae583e61c7a129c4c7266ed0","sha1":"efd38ddabe4742c1ab3afe38117b53883d68f488","sha256":"614032d71f5b75053629744dae4f3a2b4cebb8640c703700d1a84a0171c93f1c","sha512":"ccbc426b8420c3e0979980d1c900bb0a65e6a90e77b0f63443fddbbc21f55f5f684626860f1eea86e46c12c0e1d14ad5a66d04a6446bae54744e02dc9e81b138","ssdeep":"768:FT+5/vKVdYTzU+QBJ2lbqpt10XDlJrkxSI16Hb27cuKAxKEHpml:h+5nKVmUBJoqpczl5USAQbig5EJml","tlshash":"6a2302a078a33433c80f50419adf5fab9df965803bde13b3087fa9c080cb55b16a914e","first_seen":"2026-04-12T23:10:39.455476Z","last_seen":"2026-06-20T13:38:12.697414Z","times_seen":15,"resource_available":false,"data":null}},"time_used":2220,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2185,"receive":35,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/image_d343204cb47e680b7efba0cad8e7958e07e523fb.svg","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:30.597Z","timestamp":1781962650597,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /image_d343204cb47e680b7efba0cad8e7958e07e523fb.svg HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:30 GMT\r\ncontent-type: image/svg+xml\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=x5u7GLjgpxxnWev9nkAE%2FXR9Q5D4uMt9Bo215uCQw%2FmyL7lB%2FGBrj3X8K2Y39k%2BzxzDNXQraHi8fc5YRm0EhpnurIxH9O1zb%2FOu6SJ8rVGjMwxLRWpAXg0pVs4Rj\"}]}\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\npriority: u=5,i\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\netag: W/\"6a1b1388-3e4\"\r\ncf-ray: a0eb2b263ba3b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":996,"size_decoded":1398,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"574b9e8c157fdcb1f62db13a3974b268","sha1":"d343204cb47e680b7efba0cad8e7958e07e523fb","sha256":"a27e00c9eae8be042d8ca20180bd1c409f3206739500712b9a1d0a99e59e95b4","sha512":"3ffdf84da9d003dddc8359d894c3979b946c946a6cf4fd0b6061a89e32032154bd8db8fe0cb13b6db177f8ee948076d843829477afe32d8c8e9dc31958deef02","ssdeep":"","tlshash":"2511027f131d11d5f80acfe4d30ba4e37a1254a66628f008806658c2fb08d5c5df6ce4","first_seen":"2025-12-18T09:47:26.932536Z","last_seen":"2026-06-20T13:38:12.698037Z","times_seen":137,"resource_available":false,"data":null}},"time_used":172,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":172,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/wallet.svg","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:30.608Z","timestamp":1781962650608,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /wallet.svg HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:30 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=5,i\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Zi0EL6HtfIMSRmWYT0LRB1Mf8nhSdkDaDS450067BiZeLNMNsDfLVJbxVAKZDsN%2F3ylD0JidQysIpz4xMwSvE5RL6zieNrvSIJfxaHZczWypaN92vf6kawvceD9H\"}]}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\netag: W/\"6a1b1388-3e4\"\r\ncf-ray: a0eb2b264babb518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":996,"size_decoded":1390,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"574b9e8c157fdcb1f62db13a3974b268","sha1":"d343204cb47e680b7efba0cad8e7958e07e523fb","sha256":"a27e00c9eae8be042d8ca20180bd1c409f3206739500712b9a1d0a99e59e95b4","sha512":"3ffdf84da9d003dddc8359d894c3979b946c946a6cf4fd0b6061a89e32032154bd8db8fe0cb13b6db177f8ee948076d843829477afe32d8c8e9dc31958deef02","ssdeep":"","tlshash":"2511027f131d11d5f80acfe4d30ba4e37a1254a66628f008806658c2fb08d5c5df6ce4","first_seen":"2025-12-18T09:47:26.932536Z","last_seen":"2026-06-20T13:38:12.698037Z","times_seen":137,"resource_available":false,"data":null}},"time_used":170,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":170,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/index_1.html","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:33.112Z","timestamp":1781962653112,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /index_1.html HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:33 GMT\r\ncontent-type: text/html\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\nvary: accept-encoding\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\npriority: u=4,i=?0\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YYXvgicbqkB4fVflLklop2VZVlqNQZUU8oldYG%2FqqUrCn8Y9opliuX9vGi6tjctiQBY3BGt1soaJG28unfadDKog0ZAM6dnldF9nL%2FTcMgE148WzqITgMxPVOa%2B0\"}]}\r\ncontent-encoding: zstd\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a0eb2b35fccdb518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":142,"size_decoded":973,"mime_type":"text/html","magic":"HTML document, ASCII text, with no line terminators","md5":"292f74c92c97c686c723a291030cfa93","sha1":"ff7ce2a278d64bb71b8a15797fd10276ea6f0df2","sha256":"baf0572ea402de47c8c0c44f67fe0b4af40bd7bc06f5733bac13f51bb4ac4d08","sha512":"4f34b0d47baba42b1c93958d291540f76e16fb3f67405fec9d87d0d8d57bf4ae454b63e8462a3b238ff1f6306323f7af84e182781658961d0acac1e55b70d953","ssdeep":"","tlshash":"54c02b22dc04480f3d009fd1cb8af1c4c003dc3ce8315c00b867b544e9ac131c012548","first_seen":"2024-08-19T15:34:07.77924Z","last_seen":"2026-06-20T13:38:12.656096Z","times_seen":462,"resource_available":true,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":81,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/stream-video.mp4","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:33.140Z","timestamp":1781962653140,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /stream-video.mp4 HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nRange: bytes=2686976-\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 206 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:33 GMT\r\ncontent-type: video/mp4\r\npriority: u=4,i=?0\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\netag: \"6a1b1388-2c6b4c\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nage: 0\r\ncontent-range: bytes 2686976-2911051/2911052\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qrIsSOgJouE4%2Bp0E1q36dg9n%2BQqDlqnwwVmzmmpM5BXgybI9iSkpJVd%2FzHXQ%2B0I8doZIhuSd%2B6L9dI0QukPiQb4l1%2Fk2SXutwDrWaSUiEkKZiRBm%2Bv0kdGlwlnvN\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-length: 224076\r\ncf-ray: a0eb2b362cd2b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":224076,"size_decoded":225034,"mime_type":"video/mp4","magic":"data","md5":"50be76425bd97896c6ca5ce8b47e0344","sha1":"a1eef451690ac6aa0a5931d9baa34adb398f1bb3","sha256":"fd6873b4eff5bc8529370dc61c4f50d5191fc0539427a8bbaa74fb234724f459","sha512":"7ad7130ef487ae590125bfd488cf30814f34f73b6538cda43272c9bc9befcd95c11ef235415f71fc7727466e1eb6f04ce80172471ae9ed3b40ce6ebff3cea5c9","ssdeep":"3072:iHVTKivHN7GBDZpBX6SoWOpTthBM6GlyXFKDVF6vK3OgZBrncJwnRCf5R8Fd1xTr:WTKi17wDBE5+Qrt61QFF8l","tlshash":"eb248f9dbb04803bd6a15372e8f107243372d4a817d7034f4aaca73d4e993a86eb6dd5","first_seen":"2026-04-12T23:10:39.54337Z","last_seen":"2026-06-20T13:38:12.679917Z","times_seen":15,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":9,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/wallet_phantom.svg","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:30.595Z","timestamp":1781962650595,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /wallet_phantom.svg HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:32 GMT\r\ncontent-type: image/svg+xml\r\npriority: u=5,i\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4lkiyrI1K8lS6IJLftGVg48Xg1GpFs3yYCZOLYIT%2BDE7ypJrtYT81Vr%2BeqNiDYdN3fBlzB%2B9ZHgBJ5DcFN8HGRYsHH2Y4%2Bo8G1fSqahJQMk3xfa1tfKMPbyaIfD3\"}]}\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: zstd\r\netag: W/\"6a1b1388-455\"\r\ncf-ray: a0eb2b263ba2b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1109,"size_decoded":1422,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"8c03cefef7d2f9c744962ad68f1a8fac","sha1":"078a264cd05cec66acb42574be3caa03bcba5441","sha256":"f0568a024a8290d744ee7a548839ab9db336357a3fe1b8efcd881d8da1e57013","sha512":"d32da9d18f95111d9185a1ac32bb754aa91af1e3767e168d3acaa272e6c32f62a3346e85380b68682403637407ba104cc6621414563f0b22710fb5ffb677e97e","ssdeep":"","tlshash":"f811ccd53747d375c447eafd0a262dd06c1754f66725b47fc2813c0aa8560a53ca48fe","first_seen":"2025-07-22T14:10:16.992352Z","last_seen":"2026-06-20T13:38:12.698683Z","times_seen":125,"resource_available":false,"data":null}},"time_used":2163,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2163,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/math_wallet.jpg","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:30.606Z","timestamp":1781962650606,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /math_wallet.jpg HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:30 GMT\r\ncontent-type: image/jpeg\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Q0fDsA%2FRrwaFTxH8LI08JPovR%2BO3L%2B3LF1U6vwjCDbdq5QtxBuPT3RR1yxpGJE%2FQ5XJPJpalpqD0Qf%2Fo7Ca6LdOdvHzuz6u03RjwzEDoHbHzOnELM9WaO%2BYL%2Bkdv\"}]}\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\netag: \"6a1b1388-3c20\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncontent-length: 15392\r\ncf-ray: a0eb2b264baab518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":15392,"size_decoded":16314,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x400, components 3","md5":"ca7e678bdcb1c57f6507b027a35460b3","sha1":"391a4acca26995c78698b6aebfe613f76bf96504","sha256":"318c8ec85c792f74dbd1c9e0e0c6d2bf0444b72f72cef6ce0d9233b8ec89bd22","sha512":"84de1b6bdfbd89f0057876ae93c05a993ffa57695603e78f3f790e67ca47a0083a919adf01295a93e77ccbc65dbcf4b888f4acbfa634363fb68fd4122b88f451","ssdeep":"384:siQPzejPLrRJmPO12SVCcqxvm/A/gofuW8+iN:50SdMm12YCVxwA/goWVrN","tlshash":"8362c01383603802cd3fb67076c0e722db753a2a445d2da5121fe937af4d8a15d5d1f9","first_seen":"2026-01-13T00:13:53.398076Z","last_seen":"2026-06-20T13:38:12.699207Z","times_seen":104,"resource_available":false,"data":null}},"time_used":189,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":189,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gocoin.top/35907fda4c28fba3.css","fqdn":"gocoin.top","domain":"gocoin.top","tld":"top"},"ip":{"addr":"172.67.181.47","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://gocoin.top/","date":"2026-06-20T13:37:30.535Z","timestamp":1781962650535,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gocoin.top","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 30 May 2026 15:18:40 GMT","end":"Fri, 28 Aug 2026 15:18:39 GMT"},"fingerprint":{"sha1":"86:97:28:51:A6:75:99:B5:7A:D8:B4:3C:EB:D6:1E:0F:39:44:DF:DA","sha256":"0D:CA:3E:63:45:DB:8B:E4:1B:DA:4C:49:65:42:91:ED:F2:63:71:4C:A6:B7:F7:A1:6C:2D:2A:02:FE:BD:4C:C6"}}},"request":{"raw":"GET /35907fda4c28fba3.css HTTP/1.1\r\nHost: gocoin.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gocoin.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: cloudflare\r\ndate: Sat, 20 Jun 2026 13:37:30 GMT\r\ncontent-type: text/css\r\ncast-mode: default\r\nlast-modified: Sat, 30 May 2026 16:42:48 GMT\r\netag: W/\"6a1b1388-4b85\"\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\ncontent-security-policy: frame-ancestors http: https:\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nx-cast-cache: MISS\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0DB6gLwbqJRCdr7%2FfClRiD2ZbsxtCc6hrdW4YMyix4WmgArLt5X56A9CurcXOlzSlKVrqlKxeUW0pVEOtxQ9HuBipiOBUoK5Sft65FtzoP7U7X0C9TgG8kBs9NKb\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: a0eb2b25db91b518-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19333,"size_decoded":5790,"mime_type":"text/css","magic":"ASCII text, with very long lines (19332)","md5":"42875ef18ebb0e99a71ad1b8b17844ea","sha1":"bc843fb81c83ae9a849feb83daf273e81c945e14","sha256":"2c27a675d98de5722db706d01f648740a913cdd7a82ea9fd6382a1dd191e5df2","sha512":"595e29ad1bd4115f20abfc539a1f6e44237f1a3de3594877e75951e57bf76156075a80cf8fd174477eaba1b43e8d9e55e481b43d692a45e4f564887d1f6ea9c4","ssdeep":"384:vvQAz/wArLLymtEttAhrNHDRW8xQIj4d27UseF2:LLyftANDRW8aIj4DseF2","tlshash":"8592a6bb2530a3fcbd6792076ac985cc6234f1c4da3115ede5a7a2b005cb6d13b26e53","first_seen":"2025-12-20T19:39:47.56599Z","last_seen":"2026-06-20T13:38:12.699898Z","times_seen":110,"resource_available":false,"data":null}},"time_used":182,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":182,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-20","alert":"Sinkholed","trigger":"gocoin.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}