{"report_id":"b0b9b0bf-2e26-4584-b382-5d9c9a147f39","version":6,"status":"done","tags":[],"date":"2025-10-26T02:29:38Z","url":{"schema":"http","addr":"nc.gpgxy.co/","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"172.67.190.186","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"nc.gpgxy.co/login","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"title":"Login – Gameplay Galaxy"},"submit":{"url":{"schema":"http","addr":"nc.gpgxy.co/","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"172.67.190.186","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-11-30T02:29:38Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null},"summary":[{"fqdn":"nc.gpgxy.co","ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2022-05-31","domain_rank":0,"first_seen":"2025-10-26T02:29:43.458076Z","last_seen":"2025-10-26T02:29:43.458076Z","alert_count":35,"request_count":35,"received_data":16707747,"sent_data":24615,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"nc.gpgxy.co/login","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"79fab49a919294d73878380e18f3ec7a","sha1":"ce6f6e45fd0ae594aaee865111b3bbd4f3a8be72","sha256":"6c93fc515e272af5d6acddca5d1f903302a1134472ed428d8b40bfe5ec7a5a5f","sha512":"1c7f45c75eb611360e10613fb3b58a106048a8a6c3017cbeef8e84b561daf37e5d2946338a3b03a47dae78a34cf220d4b28eb7ab13f8a484680acc603ce056e9","ssdeep":"","tlshash":"967196ae24404efa07085bfe838559372aff3063279514ced79cc63c22adb91529e91a","size":3653,"data":"","first_seen":"2025-10-26T02:29:49.655529Z","last_seen":"2025-10-26T02:29:49.655529Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/dist/core-files_client.js?v=9a8c2087-9","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"4863a6ea18859aa7d022f8680a865e1c","sha1":"4d4a8427a3487871bfb349d41cc7ab8b91981269","sha256":"68c73e3df49ab39b6fdf6f16c2bd33e64207b0eb632121f1ff4e59aae6dcdb39","sha512":"388fecc33e40d3da17a2f42395ecdc6bfa911e1dfad2b0aa86c5bbe76cb8ea410684c339ff0a6a3184d459743b82ff315e1de684f5f60c16b239fe95925056aa","ssdeep":"192:8eCpstgnpaDXpVVHVFWTwB+GNyTsmciwlEoz0rDjWC2Re2Lu6+3L/4fszq1mqAX+:NCprp+N4wAueyu6+ycqwhar","tlshash":"0242a684b241bcb95b53f6f09c3f6402e8725db9a0491158f920cade3c7658a93f7ba1","size":12467,"data":"","first_seen":"2023-04-12T17:27:23Z","last_seen":"2026-03-25T02:02:06.24625Z","times_seen":52,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/dist/core-main.js?v=9a8c2087-9","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c8e7ffff0a73a3f6b87fcb697e6428fa","sha1":"56cf9abfdfb77da151dcae5c1b86c8dde6f3bd1e","sha256":"8a3bcf59da49feedd3e24451b43754cd6bc241c75711e16cadc963ae1bd449b5","sha512":"38059324219754e54e64f00446d13bb53e6d29467e036545ad91214b97189a2e9fa0a13c30498b0e4123c68a2b42a77693eb352abf667c0511ac481ebae20e1d","ssdeep":"3072:57Ra9TeJSMlRwME3jSO3984WAJYR3MaDRy/UWJ1trVO2xXJ4Gz:57Ra9T+llRwljSO3984WAJYR3MaDRy/v","tlshash":"a8f34b9074a27176137babb611af2215a3336d1af1114e80e275f4c868fcf8db167e2d","size":164693,"data":"","first_seen":"2023-07-01T16:59:04Z","last_seen":"2026-03-14T14:55:17.346757Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/apps/files_rightclick/js/script.js?v=9a8c2087-9","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c96a8f5f25ef51f00b32b37b051fb4ce","sha1":"f117ec65e8387932c674908a30ab90d0a7f01eba","sha256":"2263fdb9b43029256cf21ee1a577e3d4cc91ae150949200c05733b19e1e15912","sha512":"8c3c49631b4fd6ef18957f48bd8cd1d20fc042b9f08b6618263650d74f24e6474ee3bc139fa89c70fd503285d04af411d70bccb7e3dbb05c99210c5fc8356e95","ssdeep":"192:zZ3YzAfqAxHXmsPTX2DNDYm9Ec/wdDtxOsuIciXk7saCvSINkPjoLf2K6C2LFUwO:ZYFamsbyiYsO/4L2kLezpUKaeXxGd","tlshash":"6562db5d29fb21a09267b0bd4fdfa0497b3481475009c928bd5c8bd8afc1038d6e6fb9","size":14871,"data":"","first_seen":"2023-03-07T01:06:52Z","last_seen":"2026-04-04T18:44:51.302381Z","times_seen":373,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/dist/core-common.js?v=9a8c2087-9","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"71cfdedd4994527be4bbb979fa67e5f9","sha1":"621c8cec8d05dd162317744f23f7024cdd43f361","sha256":"e28c3b45eab6b1bebb41af9bce157125af31014d548dad692a2bd9fa93af9e90","sha512":"0674dca7213b27543c3a1bf2e9aeeec4f6c71b9deac6e47eaefbaf4e4003958f7afbb84b7e4f56fd880bf079aaa0cefaf6c243619b2e51ac8d65e9e4afc86f96","ssdeep":"49152:9mR1E4R1orHcRJu1JAORbjMkmjZYqvI+IDaOMHJKvJAORC6AmJAORhhYwG1wJAO6:K5JsnJQ1g2JB6eyk3j9wYE0pFDii4lJ8","tlshash":"6fd67c083556b234865792e3d06f3a41a23ee815f14950c0bf75d1f789f8b4ae27be3a","size":13473752,"data":"","first_seen":"2023-07-01T16:59:05Z","last_seen":"2025-10-26T02:29:49.658616Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/apps/files_rightclick/js/files.js?v=9a8c2087-9","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"cd7269162464f076d1189acef259c10b","sha1":"5da8ea7dca1cf01016469028f146492c697335b4","sha256":"360179bd40e7186ac9d2fbc97ce8697c0544cda5d89c7c6ff90a58e12f66e8ad","sha512":"dc533e9458f54335fff36c77dad3a5498a0087bb7ff32fb9fc600506cd23d5211b69ebec81b4c50a3ca2693f7402db56fa51e5d91237606d4ca6f4fd1c5114bc","ssdeep":"96:vfIkSqw7N0Zb0i+0KBDgvue5aRJkck+KnBDVFyZCWLWeZw1Fhw5z:vftQ7OZ4itosvkJjZKBD+FLY1o5z","tlshash":"18a1dd693cf32ab094b730af17ef041972754227b108c921384f9b995fb2494e7d3a9d","size":4810,"data":"","first_seen":"2023-05-05T00:03:30Z","last_seen":"2026-03-14T14:55:17.372767Z","times_seen":28,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/dist/core-files_fileinfo.js?v=9a8c2087-9","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"7c7bdc349e1bdb7494ca37540d06b7f8","sha1":"e56f3ad7e0623640211db61b521f33e7e7e62860","sha256":"1889e20598b510771e1c2c378ce8cc073fd2e1f6cdaa9c65a9031a68514d5e02","sha512":"db1d69058ccbd4c9a38df472ae9613817bb962053b40a6c7be23a07eb368ce2eadc164543c1b17cf9d4e860692dac958aac072d30bba0a9da6a407958866bba7","ssdeep":"","tlshash":"e51100d5f8d55c7e2c52b6586a1f0855522ee64b2249c83cf928cffe3c348056257f38","size":928,"data":"","first_seen":"2023-03-07T22:58:00Z","last_seen":"2026-03-25T02:02:06.266157Z","times_seen":126,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/core/js/backgroundjobs.js?v=9a8c2087-9","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"fe9d784b38735c227827bcf8cf36627a","sha1":"a87af3e54de3711f740c3a56ac6e6e81eb82c774","sha256":"a26df87a8e20a612ae4a8a6de0fdfab7bfe3fc26b9c072d865d709ee0767efe0","sha512":"f4f4d989adcad4c46d64d0b3aa39fbc829c640b7eebafb5a307871603ef495eb43d9eb67d870199cd8b7893cdf30133886d58078a9fa122abc563b2681fcd7eb","ssdeep":"","tlshash":"6011547d9501cbb769e41252b1cb63ae611b1df1218bd4502099c50f650ab7702b20e8","size":943,"data":"","first_seen":"2023-03-07T18:10:33Z","last_seen":"2026-04-04T18:44:51.296798Z","times_seen":125,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/dist/files_sharing-main.js?v=9a8c2087-9","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"8381fa39881b5c908f8eeb853fa57d6b","sha1":"2ca28d40b3ecf96d458408534c6cc300fd98a652","sha256":"0f6fb7f6a8c4d59f1a9ba85d9d7926ac147c87629074d490c4cf65853bc7bf4a","sha512":"963e10598aca7c731ab4b841f783a432abbab2053df673b0e1ec3e18ba2e1cfc0518f5a9a8675d880bb83e0cf9d6eb5deb523926f649a79d3d030dfd4568ddcf","ssdeep":"","tlshash":"f6e0864ecb79fe1612530cba7062b38ba938584cf5f5736de8f475599c108428b4f523","size":397,"data":"","first_seen":"2023-04-11T12:47:10Z","last_seen":"2026-03-25T02:02:06.234524Z","times_seen":201,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/dist/core-login.js?v=9a8c2087-9","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"0ff5e04cbe75488d61a488335bd6d0e2","sha1":"ec2d61a0a4fe3abe913e2ebaae14c611247b2ea8","sha256":"93feeefe3250f48d78c132d649a088e81b9bafefdc553cba5e8326a762ca729b","sha512":"e8f63967062ce42c4134365eef52b1712aa469628e69b4a6763cba15662df066050d984f2d533928b912a3c0ee507303cb90719b06d006040cb02f26eb7deda9","ssdeep":"1536:r2rWSXNe5pNejZ4x7Yfrtiz+s7L+UBI5sz/TcJcbvMzgtXDgC:hSXNe9R+s7KUBI5sHcJceC","tlshash":"83b32c5574a1bda502bb2660102f2107b3336e1b7406ce80da71e9d96dbce4da663f3f","size":109025,"data":"","first_seen":"2023-07-01T16:59:04Z","last_seen":"2026-03-14T14:55:17.353951Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/js/core/merged-template-prepend.js?v=9a8c2087-9","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"e2c95eaabb507e3d8dfb8de151387d02","sha1":"7c7d2af7bbe04c70f487cb84011e327cf56ad575","sha256":"5aa81a1437f7064ff4e0e0279150b418837453fa43b2f6353b06283701b67491","sha512":"5e8b686ce35fdacf90f5bbd2813e7ca7c6f30975f0d68a84d6b54485bd84769b271fa66010018f63f81d6fecb5979ed7afbe7a9f637422a32d196a8cd0058752","ssdeep":"192:dKJqY588cXpk1Nrd5Q19nNtCNfIcqx9sjrQWw7eB9exAtgNbRvrRmHu8BjLM:dKJqY588cXp6FxNfIcqx9sjrfw76exMG","tlshash":"0d42ddc7b40b49a30f8b2076bab2c1d5743a127f1c857492fb99485d2f0866e137fa2d","size":12238,"data":"","first_seen":"2023-03-08T20:48:27Z","last_seen":"2026-03-25T02:02:06.25026Z","times_seen":219,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/apps/theming/js/theming.js?v=9a8c2087-9","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"44b0d37d24a2e33ca0b64b50f83cfd6a","sha1":"1c09d10dcabf2c8fac03ea3b56852ca3feb58cb0","sha256":"ec4e73e49bca3f6e523c3dfd66e58fa157c81c4da5eb3fa0ceaa589ba8dc0785","sha512":"475648150e3a144444dab1f8e37eaa97e78aa810ae238308a5e49a84d187a28bc4e81cde24f0858edcd1c2be71f929000c9faf7bdbfcd96fae2accdc4cc32922","ssdeep":"","tlshash":"cba0022c3d404f19cc01d0c6250c505d4df634a5b7914a52ce0b41436711a9ce57da10","size":60,"data":"","first_seen":"2023-03-07T01:06:52Z","last_seen":"2026-03-31T16:41:53.650786Z","times_seen":571,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null},"http":[{"url":{"schema":"https","addr":"nc.gpgxy.co/apps/theming/css/default.css?v=47354877-9","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:11.028Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /apps/theming/css/default.css?v=47354877-9 HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:11 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nlast-modified: Tue, 30 May 2023 10:56:57 GMT\r\netag: \"cb3-5fce70fe1197a-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncache-control: max-age=15778463, immutable\r\ncontent-length: 993\r\ncontent-type: text/css\r\ncf-cache-status: MISS\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RiMTgBrBFDvAnNifmpYaSyr2c9SvlilmuBD5GVgFUIi4DXYr549jBr4PWmMQIaBshdEpOeD9ekHzMPD1vDwYs%2BJ%2BSEnGTX7JZ65O\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 99468647d9a6dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3251,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"938cf633cb9c24274b1d4b7f9ad1c528","sha1":"80b42a1d3ce6ecdb9671622a9b42d5e7108c6d52","sha256":"f50cae237c429ddad74b70172f04bda4081ff48fa400c7af60e31edb984ad1be","sha512":"8f7c35e850070ddad42c3491f0457588aaf9851e0e9f3fc84888435d5f43e832c19f3ab5dd2cc55e25467790572f1ffc0991b880c92fcd5878030d4904f4846f","ssdeep":"","tlshash":"fe616244b846f626363f04bf792aca6462783947c525eb6ebced606a1c0db9b14f2024","first_seen":"2023-04-11T07:39:06Z","last_seen":"2026-03-25T02:02:06.23132Z","times_seen":58,"resource_available":false,"data":null}},"time_used":162,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":162,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/apps/theming/theme/dark.css?plain=0\u0026v=0ade7c2c","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:11.038Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /apps/theming/theme/dark.css?plain=0\u0026v=0ade7c2c HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:11 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nexpires: Mon, 27 Oct 2025 02:29:11 +0000\r\ncache-control: private, max-age=86400, must-revalidate\r\npragma: private\r\ncontent-security-policy: default-src 'none';base-uri 'none';manifest-src 'self';frame-ancestors 'none'\r\nx-request-id: WPvpDz8jfkrHrjNd2SWj\r\nfeature-policy: autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'\r\ncontent-disposition: inline; filename=\"\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 1040\r\ncontent-type: text/css;charset=UTF-8\r\ncf-cache-status: BYPASS\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3WjprS6lFs2ng0lhS7VhD3oPOzamPQq8yjXM23HuxYmzQkdZQdji1dzHTrZnuBxk8X5AXg6dLz0Bnve5LIBZN04bXQhKS7rUgsfC\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 99468647d9abdfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3320,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text","md5":"fad6185d820993492345fe8927feebcc","sha1":"8760528b2627632eb85f1f02cd5a15f8a841916e","sha256":"847cc4a699aca2daf159219ac9b3d9c22b5df8cc6dd9142ecf14124bf80ff842","sha512":"237db49e38b350f8fea1484d6b64dff7c3e7c6e2be2434f912417f6a8556f08290d756496a757029a4dd23bea4e58eb3da5c5a2bcbf847bda035bc5f689ed18d","ssdeep":"","tlshash":"a0617655b946f62b342f087f752eda6656783807c911ef6ebce960290c0db9b15f3024","first_seen":"2025-10-26T02:29:49.608845Z","last_seen":"2026-03-14T14:55:17.359295Z","times_seen":2,"resource_available":false,"data":null}},"time_used":287,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":287,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/apps/theming/theme/dark-highcontrast.css?plain=0\u0026v=0ade7c2c","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:11.040Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /apps/theming/theme/dark-highcontrast.css?plain=0\u0026v=0ade7c2c HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:11 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nexpires: Mon, 27 Oct 2025 02:29:11 +0000\r\ncache-control: private, max-age=86400, must-revalidate\r\npragma: private\r\ncontent-security-policy: default-src 'none';base-uri 'none';manifest-src 'self';frame-ancestors 'none'\r\nx-request-id: Mc3UaindoXHCEHoWp9jl\r\nfeature-policy: autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'\r\ncontent-disposition: inline; filename=\"\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 1130\r\ncontent-type: text/css;charset=UTF-8\r\ncf-cache-status: BYPASS\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dMGXdG1GFvNgFM3XWk6%2B2znwIN62kBbqWuGz445qLmh4uffMmeol5vmbe4qVkKavyieXAJksKQGXVJUuq7rPdGxcT7vWaGIwzVJ4\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 99468647d9addfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3723,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text","md5":"c40f98b34b9730fb7c99a11b772822a7","sha1":"1eda31155bfad01fab7a37ed6a493b3fcbb0c242","sha256":"40475d729bbe1989b2e08a66438a2d401c1b52a884c886d8f695ba35e2f6cd95","sha512":"3ebff7d5fb3e30e5479b751821d7d8d280d98b80369a07ab1a14ebd7870275c1a7c2821c8402ba80b15fba9caa2ef56e91f238c72d3dc623c0e3d3ad4bf627af","ssdeep":"","tlshash":"a971c858bc4af626343f087f7129da656638b907da14efafbceca0155c4c78715e3124","first_seen":"2025-10-26T02:29:49.611786Z","last_seen":"2026-03-14T14:55:17.367853Z","times_seen":2,"resource_available":false,"data":null}},"time_used":275,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":275,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/dist/core-main.js?v=9a8c2087-9","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:11.044Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /dist/core-main.js?v=9a8c2087-9 HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:11 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nlast-modified: Tue, 30 May 2023 10:56:58 GMT\r\netag: \"28355-5fce70ff1364b-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncache-control: max-age=15778463, immutable\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-cache-status: MISS\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eqv7ZWnVm4PP7mr56uDzf9smliRTEQitgGwsxHgj1dLhSzf10Glc8RViKrRYCIpqWjtllS8TVK3LE%2FRG4KqElsofBmkOQsMqm0D6\"}]}\r\ncf-ray: 99468647e9b1dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":164693,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65459)","md5":"c8e7ffff0a73a3f6b87fcb697e6428fa","sha1":"56cf9abfdfb77da151dcae5c1b86c8dde6f3bd1e","sha256":"8a3bcf59da49feedd3e24451b43754cd6bc241c75711e16cadc963ae1bd449b5","sha512":"38059324219754e54e64f00446d13bb53e6d29467e036545ad91214b97189a2e9fa0a13c30498b0e4123c68a2b42a77693eb352abf667c0511ac481ebae20e1d","ssdeep":"3072:57Ra9TeJSMlRwME3jSO3984WAJYR3MaDRy/UWJ1trVO2xXJ4Gz:57Ra9T+llRwljSO3984WAJYR3MaDRy/v","tlshash":"a8f34b9074a27176137babb611af2215a3336d1af1114e80e275f4c868fcf8db167e2d","first_seen":"2023-07-01T16:59:04Z","last_seen":"2026-03-14T14:55:17.346757Z","times_seen":11,"resource_available":true,"data":null}},"time_used":271,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":187,"receive":84,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/dist/core-files_client.js?v=9a8c2087-9","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:11.046Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /dist/core-files_client.js?v=9a8c2087-9 HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:11 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nlast-modified: Tue, 30 May 2023 10:56:58 GMT\r\netag: \"30b3-5fce70ff0e82c-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncache-control: max-age=15778463, immutable\r\ncontent-length: 4297\r\ncontent-type: application/javascript\r\ncf-cache-status: MISS\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mUkz6GHYm8terOFwtCVqN8%2F8Tz%2ByXlC8b1gC1EAKXtQWmpVfy%2BiB9x7pQPMzdHI9%2FMJvYLzbM3xbbM8HNxah05CfzDL1an9nSpon\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 99468647e9b3dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12467,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (12323)","md5":"4863a6ea18859aa7d022f8680a865e1c","sha1":"4d4a8427a3487871bfb349d41cc7ab8b91981269","sha256":"68c73e3df49ab39b6fdf6f16c2bd33e64207b0eb632121f1ff4e59aae6dcdb39","sha512":"388fecc33e40d3da17a2f42395ecdc6bfa911e1dfad2b0aa86c5bbe76cb8ea410684c339ff0a6a3184d459743b82ff315e1de684f5f60c16b239fe95925056aa","ssdeep":"192:8eCpstgnpaDXpVVHVFWTwB+GNyTsmciwlEoz0rDjWC2Re2Lu6+3L/4fszq1mqAX+:NCprp+N4wAueyu6+ycqwhar","tlshash":"0242a684b241bcb95b53f6f09c3f6402e8725db9a0491158f920cade3c7658a93f7ba1","first_seen":"2023-04-12T17:27:23Z","last_seen":"2026-03-25T02:02:06.24625Z","times_seen":52,"resource_available":true,"data":null}},"time_used":172,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":171,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/dist/core-login.js?v=9a8c2087-9","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:11.049Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /dist/core-login.js?v=9a8c2087-9 HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:12 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nlast-modified: Tue, 30 May 2023 10:56:58 GMT\r\netag: \"1a9e1-5fce70ff08a6d-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncache-control: max-age=15778463, immutable\r\ncontent-length: 30745\r\ncontent-type: application/javascript\r\ncf-cache-status: MISS\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ySR9WNdo1PXTYAymEWZAK4FPZ06cLHPMWeFHQLJJJ2Sb4Vmnxw37v3HHcJ4AkegyRaXUt9wKNdEJo1oSY%2FvDnl2tz5b65u6N%2FrgR\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 99468647e9b6dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":109025,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65456)","md5":"0ff5e04cbe75488d61a488335bd6d0e2","sha1":"ec2d61a0a4fe3abe913e2ebaae14c611247b2ea8","sha256":"93feeefe3250f48d78c132d649a088e81b9bafefdc553cba5e8326a762ca729b","sha512":"e8f63967062ce42c4134365eef52b1712aa469628e69b4a6763cba15662df066050d984f2d533928b912a3c0ee507303cb90719b06d006040cb02f26eb7deda9","ssdeep":"1536:r2rWSXNe5pNejZ4x7Yfrtiz+s7L+UBI5sz/TcJcbvMzgtXDgC:hSXNe9R+s7KUBI5sHcJceC","tlshash":"83b32c5574a1bda502bb2660102f2107b3336e1b7406ce80da71e9d96dbce4da663f3f","first_seen":"2023-07-01T16:59:04Z","last_seen":"2026-03-14T14:55:17.353951Z","times_seen":10,"resource_available":true,"data":null}},"time_used":1395,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1347,"receive":48,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/apps/theming/theme/dark.css?plain=1\u0026v=0ade7c2c","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:11.494Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /apps/theming/theme/dark.css?plain=1\u0026v=0ade7c2c HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:11 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nexpires: Mon, 27 Oct 2025 02:29:11 +0000\r\ncache-control: private, max-age=86400, must-revalidate\r\npragma: private\r\ncontent-security-policy: default-src 'none';base-uri 'none';manifest-src 'self';frame-ancestors 'none'\r\nx-request-id: 7a6EFyjHwl9PcyEMzgNp\r\nfeature-policy: autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'\r\ncontent-disposition: inline; filename=\"\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 1020\r\ncontent-type: text/css;charset=UTF-8\r\ncf-cache-status: BYPASS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NG7RUs%2BWXvH5t3vWRZN5pb%2BT9GMUygElBrU1UegIx6efuRcHvXzQ1IiqxsPO2yDrXQjVGHfg37YKtwhtIu1UXMFFAnM4CChrbze1\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9946864ac9c9dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3147,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (3147), with no line terminators","md5":"fb6f6652ba24f26c00b484760e3a981b","sha1":"390b7031d3b374fff884e7f10dd9ec9f244217f5","sha256":"a1549476cfa9e4c0883ff9a95ed70584c98712a76b536f3f18e706dec07f7638","sha512":"5df17baa5b4cea54187235878636f50892617b3af5db7cc4feee97b64d4fa3d60a51ef7f7157670ad8b0d4f5ba894ba748b320a8d2fc1256773de4c29132c8d0","ssdeep":"","tlshash":"ee51a818f046f67b3123447e722eda6ea6096c07cbd16faafc6c7055440ea9b46f7034","first_seen":"2025-10-26T02:29:49.622537Z","last_seen":"2026-03-14T14:55:17.375001Z","times_seen":2,"resource_available":false,"data":null}},"time_used":194,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":194,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/cron.php","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:13.858Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /cron.php HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nrequesttoken: KH3Lc/2EVh1/q6tJvL26HMZIifAiq2YyVP1xU75ARX8=:ei+cOsi1ImoS5uhx9+eVRJQB4Z1G5SpwHLcECsoDHRM=\r\nOCS-APIREQUEST: true\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:13 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-security-policy: default-src 'self'; script-src 'self' 'nonce-R2k5ZzBIcHZkVjRJaEZDbUVDNHhrZE9kS3VLNmVxVVg3VXBXTlRQTzBGQT06U0gwM21VOWVBU2xseVJPZVczUWV5WUhVUW8vZU5PbFZwUUFqYkVlTmlEdz0='; style-src 'self' 'unsafe-inline'; frame-src *; img-src * data: blob:; font-src 'self' data:; media-src *; connect-src *; object-src 'none'; base-uri 'self';\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FlfP4%2BkA98D3FyPNxD58qVThO4PUKfSA4Pu6mA0dplL%2Bw2kMLlUtWLa2GUTPmkEYiidfHcyaC7rm0HrwMaxYZcwXgfKIfWJBXGIu\"}]}\r\ncontent-type: application/json; charset=utf-8\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\ncontent-encoding: br\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 994686599a66dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"5820854f62a6eb3d38ba7ba0d1b3ea75","sha1":"639df0b84fe699b4a290a713fd6b9a94bd4deb95","sha256":"912d0c07da7bdb22cdae025b96da26d01523aaab7362edb28544e3949deb369d","sha512":"4452c0a26fa81357f95bf6160c3f5d35ff39f62e03d5faa1e69eb9dfdcb2c83eda4235463ee4065dceb534cc497891a05535467337ad84693e5fa48c317dbbbb","ssdeep":"","tlshash":"f67000020000208008803c0000000a203ae00aa0822a00c0802c00288e08088f08a000","first_seen":"2023-03-13T15:21:35Z","last_seen":"2026-04-05T00:07:17.825578Z","times_seen":88394,"resource_available":true,"data":null}},"time_used":139,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":139,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/login","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-26T02:29:10.695Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /login HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:10 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-cache, no-store, must-revalidate\r\npragma: no-cache\r\ncontent-security-policy: default-src 'none';base-uri 'none';manifest-src 'self';script-src 'nonce-S0gzTGMvMkVWaDEvcTZ0SnZMMjZITVpJaWZBaXEyWXlWUDF4VTc1QVJYOD06ZWkrY09zaTFJbW9TNXVoeDkrZVZSSlFCNFoxRzVTcHdITGNFQ3NvREhSTT0=';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;font-src 'self' data:;connect-src 'self';media-src 'self';frame-src 'self';frame-ancestors 'self';form-action 'self'\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-request-id: lVtZQpUdSpmDtYutYxxX\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Rl8ow85%2Bwfx6pIgcd5Do9qySYEBoHQQhzSbc2Aq3rR8yblBwcF7mIlJvt6jURswPIgNEWv41eHj%2F3fzEVBj1uFT2xEn%2F8I%2FKpg%3D%3D\"}]}\r\nfeature-policy: autoplay 'self';camera 'none';fullscreen 'self';geolocation 'none';microphone 'none';payment 'none'\r\ncf-cache-status: DYNAMIC\r\nvary: accept-encoding\r\ncontent-encoding: br\r\nset-cookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; HttpOnly; SameSite=Lax; Secure; Path=/\r\ncf-ray: 99468645d82e0b02-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16888,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5292)","md5":"356d02139824467c9d3608fc2c1e1cb7","sha1":"cebadf093e854863ffddd82658d35d54ccde7282","sha256":"f8fafb37e61912db5bbac05208a7ff067e4b6a68b9d88bc5e5e77ee7119b921f","sha512":"632c4fde107eb1fc251749558efedc070e0b647c8b980bdfb8b26c633a257cdcca73e54340cea04c9a5566d45dda140edf08a360732d549ecc9af2bf35980f33","ssdeep":"384:hekJem8IrTx+cs9GXPybmVvbJfsyeOE+m9GtYRxjOGP:hekJem8IrTx+cs7bmEyeOjm9GtYR7","tlshash":"78721b071c450fef850047d99bb4e51ec38fb0237615289cfbee817e9ad6aa6006d5eb","first_seen":"2025-10-26T02:29:49.625446Z","last_seen":"2025-10-26T02:29:49.625446Z","times_seen":1,"resource_available":false,"data":null}},"time_used":139,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":139,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/apps/theming/theme/light.css?plain=1\u0026v=0ade7c2c","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:11.034Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /apps/theming/theme/light.css?plain=1\u0026v=0ade7c2c HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:11 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nexpires: Mon, 27 Oct 2025 02:29:11 +0000\r\ncache-control: private, max-age=86400, must-revalidate\r\npragma: private\r\ncontent-security-policy: default-src 'none';base-uri 'none';manifest-src 'self';frame-ancestors 'none'\r\nx-request-id: ECpUcG88C8Z1WnxNqg0G\r\nfeature-policy: autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'\r\ncontent-disposition: inline; filename=\"\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 1028\r\ncontent-type: text/css;charset=UTF-8\r\ncf-cache-status: BYPASS\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hGPQhIPxwCMAH5Y5eINsw25TcI%2BXEdxRuD7VEWbHIlstK40sG07eUxVzoAF7mkhJn98x9tVBOTQ0kaz4I07U8d%2Fdl58sVoZt2NpA\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 99468647d9a9dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3202,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (3202), with no line terminators","md5":"bd0ac1d89d687f5b903375bbe5bbac05","sha1":"aaae70ed2d0992acf4e967283c0d27497426e7d1","sha256":"b396d0eb86506ffe1e4fd0c1c06cd48e5b53e12711e495c8bfeadbeb7a54470b","sha512":"dd3f3c2d22df3a9d17db1daa3b0a33009885a159f88fb3619656de915032a3b9a4a5d986019d739cdb92508e7752be9d26d6edb308f957371e30250dfb98dc4b","ssdeep":"","tlshash":"f0618804f046f26b3133447e762dca6ea5096c07cbe16faafc6d7055540ea9b46f7124","first_seen":"2025-10-26T02:29:49.627486Z","last_seen":"2026-03-14T14:55:17.352492Z","times_seen":2,"resource_available":false,"data":null}},"time_used":190,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":190,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/apps/theming/theme/light.css?plain=0\u0026v=0ade7c2c","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:11.035Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /apps/theming/theme/light.css?plain=0\u0026v=0ade7c2c HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:11 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nexpires: Mon, 27 Oct 2025 02:29:11 +0000\r\ncache-control: private, max-age=86400, must-revalidate\r\npragma: private\r\ncontent-security-policy: default-src 'none';base-uri 'none';manifest-src 'self';frame-ancestors 'none'\r\nx-request-id: JNcEabVPZgy9rl8EBfKD\r\nfeature-policy: autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'\r\ncontent-disposition: inline; filename=\"\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 1047\r\ncontent-type: text/css;charset=UTF-8\r\ncf-cache-status: BYPASS\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MfGDQXsrHhCXaGWRbqYsqsTZgKUwC61kAil0doDjIUxST4NdoOQGDdez2ECmWcK%2FjTI1pY%2FN3o4Sm%2B3nEX247jxOzXtEkmJ2TWSn\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 99468647d9aadfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3376,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text","md5":"97db0e2169d88f174400f39aa5bddf9c","sha1":"ac12393f2ccd59cfd812a67aabc842d8068ff624","sha256":"c124047c14cb20b0efa110117f2a99e479431edc2c889b2d4d9fdf0c5a671fe0","sha512":"68ba3f1ab222ebfa857b33ca2f422270bb0f42584f6bb3eded4cf2d6d85b9586575e888d5452b583891b2250a9ae5a90c9b687d55a1b6d63f7d252510021a812","ssdeep":"","tlshash":"2d615244b846f62b353f047f352eca6261387807c920efaebced605a0c0db9a15e3124","first_seen":"2025-10-26T02:29:49.629375Z","last_seen":"2026-03-14T14:55:17.355428Z","times_seen":2,"resource_available":false,"data":null}},"time_used":279,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":279,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/apps/theming/theme/light-highcontrast.css?plain=0\u0026v=0ade7c2c","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:11.039Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /apps/theming/theme/light-highcontrast.css?plain=0\u0026v=0ade7c2c HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:11 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nexpires: Mon, 27 Oct 2025 02:29:11 +0000\r\ncache-control: private, max-age=86400, must-revalidate\r\npragma: private\r\ncontent-security-policy: default-src 'none';base-uri 'none';manifest-src 'self';frame-ancestors 'none'\r\nx-request-id: yw6nnH8y0ObK4zAi3RuG\r\nfeature-policy: autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'\r\ncontent-disposition: inline; filename=\"\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 1105\r\ncontent-type: text/css;charset=UTF-8\r\ncf-cache-status: BYPASS\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rWxdLVk%2BIxekAAlZXB5wngbh9piSdTkdGc%2Bc2QHKcit5TJ30aiA8HoJOUb7epX01Ny5WJ4nFh5LPONJs5qKX8ED%2F9mf%2F4my0EECV\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 99468647d9acdfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3663,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text","md5":"21d689b086bf84a6d12836bd05a2f840","sha1":"8a669c220a02e38b8c9e090386eac65cb087b732","sha256":"5ff3d90a69d356d865deffe10d2bd63763a2861628c0648d01f740c707761d7f","sha512":"62ef080504aa6e5f9709c4f8969eb9d3f8738293b4b23c60f9bf39cf31067f04765a169867270cedd70512f079967c7f1527c0568baa1ac9abc324009772a7a8","ssdeep":"","tlshash":"f5719655b846f627747f043f3119db66a238b907da61ef6efced601a4c0c78615e3124","first_seen":"2025-10-26T02:29:49.63121Z","last_seen":"2026-03-14T14:55:17.345948Z","times_seen":2,"resource_available":false,"data":null}},"time_used":271,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":271,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/core/js/backgroundjobs.js?v=9a8c2087-9","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:11.048Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /core/js/backgroundjobs.js?v=9a8c2087-9 HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:12 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nlast-modified: Tue, 30 May 2023 10:56:56 GMT\r\netag: \"3af-5fce70fd30fe2-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncache-control: max-age=15778463, immutable\r\ncontent-length: 608\r\ncontent-type: application/javascript\r\ncf-cache-status: MISS\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RrvWxqz09%2F9mWC0rTIjxCUAmjY62szA%2FlCc3ZiFdy%2BoOZjjDapeSYNK40oa3n%2BvNEG%2FHmUJkSFF19rNZORn4HN5VO4KAVZ3ocutd\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 99468647e9b5dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":943,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"fe9d784b38735c227827bcf8cf36627a","sha1":"a87af3e54de3711f740c3a56ac6e6e81eb82c774","sha256":"a26df87a8e20a612ae4a8a6de0fdfab7bfe3fc26b9c072d865d709ee0767efe0","sha512":"f4f4d989adcad4c46d64d0b3aa39fbc829c640b7eebafb5a307871603ef495eb43d9eb67d870199cd8b7893cdf30133886d58078a9fa122abc563b2681fcd7eb","ssdeep":"","tlshash":"6011547d9501cbb769e41252b1cb63ae611b1df1218bd4502099c50f650ab7702b20e8","first_seen":"2023-03-07T18:10:33Z","last_seen":"2026-04-04T18:44:51.296798Z","times_seen":125,"resource_available":true,"data":null}},"time_used":1343,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1343,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-26T02:29:10.390Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\ndate: Sun, 26 Oct 2025 02:29:10 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nlocation: https://nc.gpgxy.co/login\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-security-policy: default-src 'self'; script-src 'self' 'nonce-dUk2bkxRdUlsVG9GQk4ra0pPRlhhL2c1YTBMaFgrSWhyYm5NdS9BR1Y3bz06NnR6d1pENjU0VTFvU1p5Y2I3dDRNNnB3QXkrRkVhNWo1Zk81NG9SRkQ5WT0='; style-src 'self' 'unsafe-inline'; frame-src *; img-src * data: blob:; font-src 'self' data:; media-src *; connect-src *; object-src 'none'; base-uri 'self';\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GcsFrF8WGNyuL%2BE4IBjiXXPMHteAanHmR2r4Ij7VbalzmhcRxBlgX%2FYaDNJvhG9Y%2BoJFSjQnOzpR7g18RTE0xRyE%2Bs7amA3G0Q%3D%3D\"}]}\r\nset-cookie: ocp09vj69pgl=s90gpe1g4v87qgf38uqn0fca42; HttpOnly; SameSite=Lax; Secure; Path=/\noc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; HttpOnly; SameSite=Lax; Secure; Path=/\nocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; HttpOnly; SameSite=Lax; Secure; Path=/\nocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; HttpOnly; SameSite=Lax; Secure; Path=/\n__Host-nc_sameSiteCookielax=true; HttpOnly; SameSite=Lax; Secure; Path=/; Expires=Fri, 31 Dec 2100 23:59:59 GMT\n__Host-nc_sameSiteCookiestrict=true; HttpOnly; SameSite=Strict; Secure; Path=/; Expires=Fri, 31 Dec 2100 23:59:59 GMT\nocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; HttpOnly; SameSite=Lax; Secure; Path=/\r\ncf-ray: 994686447ffa0b02-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16888,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-05T00:47:03.388486Z","times_seen":13352920,"resource_available":true,"data":null}},"time_used":380,"timings":{"blocked":82,"dns":63,"connect":1,"send":0,"wait":215,"receive":0,"ssl":16},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/apps/theming/icon?v=0ade7c2c","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:13.953Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /apps/theming/icon?v=0ade7c2c HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:14 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nexpires: Mon, 27 Oct 2025 02:29:14 +0000\r\ncache-control: private, max-age=86400, must-revalidate\r\npragma: private\r\ncontent-security-policy: default-src 'none';base-uri 'none';manifest-src 'self';frame-ancestors 'none'\r\nlast-modified: Thu, 01 Jun 2023 21:26:43 +0000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8YtQB19PuNNKRueAErGtzdXofsw12jDkOWi3Q1WxkwB5JIMPHpUFx1KYHbHhHIf8CYbcW2VzYc3%2BbpX68CmlxGGojlG7wrk8MFAK\"}]}\r\nx-request-id: NlW3oYPHXjEQHU0Ir925\r\nfeature-policy: autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'\r\ncontent-disposition: inline; filename=\"favicon\"\r\ncontent-encoding: br\r\ncontent-type: image/x-icon\r\ncf-cache-status: DYNAMIC\r\npriority: u=6,i=?0\r\netag: W/\"c331b8c066ffb65e29fbe97789f58f9d\"\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9946865a3a69dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":263797,"size_decoded":0,"mime_type":"image/x-icon","magic":"PNG image data, 1800 x 1800, 8-bit/color RGB, non-interlaced","md5":"5f21c662ed2317212f7e161942146737","sha1":"65a1f448082be1011ded89713aba9482c377cb4b","sha256":"4a77da55791087b2b62dfec9e2d0e58b1f0889dfb948c3ad18506c66bef7a3dc","sha512":"8675277c935beb2eec22185d65cb69bb5728d8a46c1190cf191faee21a5b943c9760dfc9d9c169986a7acc6330a812b55fc3305a6adbb71e440bc86ff7827265","ssdeep":"6144:+eJntuuY1hvVqh8lOwDQSJpNZJBYzq8Ni5DvLN:vtuuAhGXwQSJpDJsxNMF","tlshash":"d7441299bd47cebbf98873f54ca8641c39ba096c2250a39111df567afc34327d3a2d84","first_seen":"2025-10-26T02:29:49.634705Z","last_seen":"2026-03-14T14:55:17.344972Z","times_seen":2,"resource_available":false,"data":null}},"time_used":313,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":120,"receive":193,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/apps/theming/theme/opendyslexic.css?plain=0\u0026v=0ade7c2c","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:11.042Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /apps/theming/theme/opendyslexic.css?plain=0\u0026v=0ade7c2c HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:11 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nexpires: Mon, 27 Oct 2025 02:29:11 +0000\r\ncache-control: private, max-age=86400, must-revalidate\r\npragma: private\r\ncontent-security-policy: default-src 'none';base-uri 'none';manifest-src 'self';frame-ancestors 'none'\r\nx-request-id: lsbpVrZQ8AZoaiXxNxet\r\nfeature-policy: autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'\r\ncontent-disposition: inline; filename=\"\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 331\r\ncontent-type: text/css;charset=UTF-8\r\ncf-cache-status: BYPASS\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4mlhEo9wqODRz6u6QWbjMyg7NyRl%2FDqrtX%2FO4yXj89llcsYXOK%2FeFtS7sDW%2BsYHloJyYs21DjyrVHMFv7Hbz6fM%2Bm2Lpa0pmLSrB\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 99468647e9aedfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":867,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text","md5":"53a0c39897a4ef34666540a1ef72e2ee","sha1":"0fbbc36cd6794eb62e50d5545edcdff6b19a1978","sha256":"1f90b1cc10add6e6cf941ddcc78fc9ef4fe28d7478e49c000658dfc50fbf4258","sha512":"f398e2f765e6235a4703bbe4f119a906054aac90bf71d9d28272bd574e97a15b1479346d15c5eedc1f661ce3e3384f2f269521baeeed8c5b4fcde65e156472fa","ssdeep":"","tlshash":"2c115945f3cd2b39a0720c98b3c71539de0ebb15001ac0575b1a68448fa161c63b6b5f","first_seen":"2023-04-11T07:39:06Z","last_seen":"2026-03-25T02:02:06.262795Z","times_seen":74,"resource_available":false,"data":null}},"time_used":277,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":277,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/apps/theming/image/background?v=9","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:11.479Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /apps/theming/image/background?v=9 HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:11 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nexpires: Sun, 26 Oct 2025 03:29:11 +0000\r\ncache-control: private, max-age=3600, must-revalidate\r\npragma: private\r\ncontent-security-policy: default-src 'none';base-uri 'none';manifest-src 'self';script-src 'nonce-UmFrdHVLUll3Mko2OGJwL2lUVU9WcVZkOC9ZeXJZK1RwZ0FmbXJIaC9YND06Ri90NjhaRnB0eFVYdlBsSHdtOGhEdmNVbTV0VzQ4UFI3a3BxdzhXaXBSST0=';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;font-src 'self' data:;connect-src 'self';media-src 'self';frame-src 'self';frame-ancestors 'self';form-action 'self'\r\nlast-modified: Thu, 01 Jun 2023 21:21:44 +0000\r\netag: \"3d686ec01679bb5941dd62733db682dc\"\r\nx-request-id: wyAuQM8j12OrwZ9ImzXp\r\nfeature-policy: autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'\r\ncontent-disposition: attachment; filename=\"background\"\r\ncontent-length: 1573286\r\ncontent-type: image/jpeg\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lEFHRQr0c0zIC0tHHp2Jee6bgUAijkvJYX9RnVnkL3eMzw9A%2F3HDbx4p4r3PUlJ09J%2B6AcIg5LoanV%2B8z0H%2BIry0iWHGlawIBN%2BX\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9946864ab9c7dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1573286,"size_decoded":0,"mime_type":"image/jpeg","magic":"PNG image data, 1200 x 675, 8-bit/color RGBA, interlaced","md5":"2e20cf04f007506548f0025c530f80e2","sha1":"ecc22346269659bdb02279ae1a0e4103eb707cad","sha256":"fd20cbfc7279301894c0333023f129bccfd6dd3b4be94cd1e4dc8f3296017152","sha512":"f5560fe3ac9f3b15fbe0eca9849f90ab80162567eb98306c8e03a26189a585add0d8931689e10c76cf80c9862ebb110260575ad26e5f98271a7503b705a65fc4","ssdeep":"24576:1KKa04NEQEqrVaPySQDPhW3y2nAhGLT1/nEHyG:1G0iEfqrgaZhqJJWl","tlshash":"fe2533a0574ef0212ed758375c14644da5833e252733192b9ac86af81fbfb9b136272f","first_seen":"2025-10-26T02:29:49.637115Z","last_seen":"2026-03-14T14:55:17.348544Z","times_seen":2,"resource_available":false,"data":null}},"time_used":542,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":199,"receive":343,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/apps/theming/image/logo?v=9","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:11.483Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /apps/theming/image/logo?v=9 HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:11 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nexpires: Sun, 26 Oct 2025 03:29:11 +0000\r\ncache-control: private, max-age=3600, must-revalidate\r\npragma: private\r\ncontent-security-policy: default-src 'none';base-uri 'none';manifest-src 'self';script-src 'nonce-dDRMbDgwYmkxU2Y2aDR3OWtqTm85R2ltQW1yOG9QVTBWVzJtLzJOSjRwZz06NWRDeXVuUFRvVkNYeXM4RjJXbEhyRHJ2YWdlWTdybDJIU2ZUcGhjS3V2UT0=';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;font-src 'self' data:;connect-src 'self';media-src 'self';frame-src 'self';frame-ancestors 'self';form-action 'self'\r\nlast-modified: Thu, 01 Jun 2023 22:21:56 +0000\r\netag: \"0539c569848d823fbd3061f0f85cd2da\"\r\nx-request-id: DLLNZhIS8zWsOPo6e8Bc\r\nfeature-policy: autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'\r\ncontent-disposition: attachment; filename=\"logo\"\r\ncontent-length: 308363\r\ncontent-type: image/png\r\ncf-cache-status: DYNAMIC\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=U5ptFEGxB1K%2BpbYeohivlHekQulJig1qXWTXWL0P08Crik4dp0gBBNxTJ2jJ0X4okvi8bVIAuUwB0jGsZzGrVKsGby2auseiLNcU\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9946864ab9c8dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":308363,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1372 x 1372, 8-bit/color RGBA, non-interlaced","md5":"6b0c7b10832e5be5051da45ad426f6cd","sha1":"a3eb0a165986802bb4954be131cbd691e4dd1393","sha256":"393621cf4b96816e3190b15092644a7c345fad8c3e669dc074a5041bc036aaa7","sha512":"b746f9649b0375fcd4eca12af3d397370bef662bbf51bdbe7b7d6c553c732e530b06ddbd1e6ccfd3ccf0ad8853e4bcc4898b88d2ef11f1e8046e13e1e6b7596f","ssdeep":"6144:2yxxqkcYYWo1n1XU7VK2TiTSQhhp+oJ16KqVDBPqEXKN7p6Bc:VxxqZlOc2TiTSkhp9J16Kq3SEYIO","tlshash":"d5642248c8b7ef291a33cc16e0f672f96e7341bbe96d2cd40411362a655d8281ce9add","first_seen":"2025-10-26T02:29:49.63876Z","last_seen":"2026-03-14T14:55:17.366935Z","times_seen":2,"resource_available":false,"data":null}},"time_used":389,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":186,"receive":203,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/apps/integration_gitlab/css/gitlab-search.css?v=70eabcd8-9","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:11.021Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /apps/integration_gitlab/css/gitlab-search.css?v=70eabcd8-9 HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:11 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nlast-modified: Tue, 30 May 2023 10:57:11 GMT\r\netag: \"eb-5fce710af252d-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncache-control: max-age=15778463, immutable\r\ncontent-length: 159\r\ncontent-type: text/css\r\ncf-cache-status: MISS\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zL5VUmQYV9LAI425D5dbWcE4z6bQz463%2BCJTY8DN%2FG%2FPsgPp5eOB%2B%2FDuBKgNm6a1w0bvdQ6n3Qfl%2Fc0x3Do4MSfUQS5fdCqL7K%2BB\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 99468647c9a4dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":235,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"68da4fd13f681ff3a4bea5dff7132887","sha1":"cadeb2efe982e3487b7e078e12779088afceb8fe","sha256":"0fc6b190b721731863a5f7fec9f2f7dcec8c03fa2fb805b6d62767f637c2f565","sha512":"b3b97004a6bd8a0d4ca862c24e74fd08f94897a17e281ce4260e2c1fc491397c1645e2727192350cbe97c58c869c135db025614adecc1398a5f2bccb0cde2e80","ssdeep":"","tlshash":"50d05eea4063d6452b71d2796a9a3f58835c20066ec9bfaa106e36e56aa20414517206","first_seen":"2023-07-08T00:39:49Z","last_seen":"2026-04-01T14:50:01.59394Z","times_seen":13,"resource_available":false,"data":null}},"time_used":160,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":160,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/js/core/merged-template-prepend.js?v=9a8c2087-9","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:11.047Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /js/core/merged-template-prepend.js?v=9a8c2087-9 HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:11 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nexpires: Mon, 26 Oct 2026 02:29:11 +0000\r\ncache-control: max-age=31536000, immutable\r\npragma: cache\r\ncontent-security-policy: default-src 'none';base-uri 'none';manifest-src 'self';frame-ancestors 'none'\r\nlast-modified: Tue, 30 May 2023 10:57:31 +0000\r\netag: \"df147815ce013e0b7ce1c7938606d749\"\r\nx-request-id: XjzwtQWSvvyLpM6iUcEG\r\nfeature-policy: autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'\r\ncontent-disposition: inline; filename=\"merged-template-prepend.js.gzip\"\r\ncontent-encoding: gzip\r\ncontent-length: 3098\r\ncontent-type: application/javascript\r\ncf-cache-status: MISS\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Or%2F1DdMxSesisBX93KtMPVhMfsO6qtVQ687msJx5xG8YD49JZF4PKvA0Df%2B9j%2BO7o3h8wT6viMe1Rw5lHDjdjnHef0hCcUVW9Gd%2F\"}]}\r\nvary: accept-encoding\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 99468647e9b4dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12238,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"e2c95eaabb507e3d8dfb8de151387d02","sha1":"7c7d2af7bbe04c70f487cb84011e327cf56ad575","sha256":"5aa81a1437f7064ff4e0e0279150b418837453fa43b2f6353b06283701b67491","sha512":"5e8b686ce35fdacf90f5bbd2813e7ca7c6f30975f0d68a84d6b54485bd84769b271fa66010018f63f81d6fecb5979ed7afbe7a9f637422a32d196a8cd0058752","ssdeep":"192:dKJqY588cXpk1Nrd5Q19nNtCNfIcqx9sjrQWw7eB9exAtgNbRvrRmHu8BjLM:dKJqY588cXp6FxNfIcqx9sjrfw76exMG","tlshash":"0d42ddc7b40b49a30f8b2076bab2c1d5743a127f1c857492fb99485d2f0866e137fa2d","first_seen":"2023-03-08T20:48:27Z","last_seen":"2026-03-25T02:02:06.25026Z","times_seen":219,"resource_available":true,"data":null}},"time_used":241,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":241,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/apps/theming/js/theming.js?v=9a8c2087-9","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:11.056Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /apps/theming/js/theming.js?v=9a8c2087-9 HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:11 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nlast-modified: Tue, 30 May 2023 10:56:57 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncache-control: max-age=15778463, immutable\r\ncontent-type: application/javascript\r\ncf-cache-status: MISS\r\npriority: u=3,i=?0\r\netag: W/\"3c-5fce70fe0dafa\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mTSnu7fdocb9Yqqyz029kzWyTFe98O80HuM%2FQEViHDztPCHb6POBeYgyeFKor8hor54qJDr07XccqF84DN8nPihExPkXeF1deP49\"}]}\r\ncf-ray: 99468647f9badfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":60,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"44b0d37d24a2e33ca0b64b50f83cfd6a","sha1":"1c09d10dcabf2c8fac03ea3b56852ca3feb58cb0","sha256":"ec4e73e49bca3f6e523c3dfd66e58fa157c81c4da5eb3fa0ceaa589ba8dc0785","sha512":"475648150e3a144444dab1f8e37eaa97e78aa810ae238308a5e49a84d187a28bc4e81cde24f0858edcd1c2be71f929000c9faf7bdbfcd96fae2accdc4cc32922","ssdeep":"","tlshash":"cba0022c3d404f19cc01d0c6250c505d4df634a5b7914a52ce0b41436711a9ce57da10","first_seen":"2023-03-07T01:06:52Z","last_seen":"2026-03-31T16:41:53.650786Z","times_seen":571,"resource_available":true,"data":null}},"time_used":179,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":179,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/apps/theming/theme/dark-highcontrast.css?plain=1\u0026v=0ade7c2c","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:11.492Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /apps/theming/theme/dark-highcontrast.css?plain=1\u0026v=0ade7c2c HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:11 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nexpires: Mon, 27 Oct 2025 02:29:11 +0000\r\ncache-control: private, max-age=86400, must-revalidate\r\npragma: private\r\ncontent-security-policy: default-src 'none';base-uri 'none';manifest-src 'self';frame-ancestors 'none'\r\nx-request-id: U3nA4dMvNEv88L0DUJ0x\r\nfeature-policy: autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'\r\ncontent-disposition: inline; filename=\"\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 1107\r\ncontent-type: text/css;charset=UTF-8\r\ncf-cache-status: BYPASS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aAlu3wKm5SDik50Lo5%2FB6nhVlZSpAp%2FeiDwG0YW1wWmFPZb%2BDCaq9yWaqjVxkVt0yZRzKGElrvPbvOd3CS2CClZ1Z2CDcAE4pKKU\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9946864ac9cadfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3355,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (3109)","md5":"8fa8d8c6a3045f3b368a789e4eb41e39","sha1":"4158f1aacc92a6044d1ecb4de176a379c5bf41f5","sha256":"512d2e8a72860aea7e84322021370fc6a62cd559cb21fd83ef1e2513e8dfbd5d","sha512":"f489b1cf2342b7bcb30c170123078621d4a9d00495a8f5233eedde1c7cdfdc232a00ab3e18b8d10bc4cb53387159593fe9eca4e065684c2569da22a6c46191ad","ssdeep":"","tlshash":"03619b58f14af1673123447d722dda6da918bc07cbd06fb7bc6db061544da9b46f3024","first_seen":"2025-10-26T02:29:49.642982Z","last_seen":"2026-03-14T14:55:17.374105Z","times_seen":2,"resource_available":false,"data":null}},"time_used":182,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":182,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/apps/theming/theme/default.css?plain=1\u0026v=0ade7c2c","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:11.032Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /apps/theming/theme/default.css?plain=1\u0026v=0ade7c2c HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:11 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nexpires: Mon, 27 Oct 2025 02:29:11 +0000\r\ncache-control: private, max-age=86400, must-revalidate\r\npragma: private\r\ncontent-security-policy: default-src 'none';base-uri 'none';manifest-src 'self';frame-ancestors 'none'\r\nx-request-id: UyM0IPDQdFeNPoFGIiZW\r\nfeature-policy: autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'\r\ncontent-disposition: inline; filename=\"\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 1028\r\ncontent-type: text/css;charset=UTF-8\r\ncf-cache-status: BYPASS\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hCmeseZ0SsB0U1a2VPtAIYeIna54nYtPM0h6itJyUvfC4O9atPFAB6%2BvB%2BaquSDidSNhub5tqkjBhoiRnqVM6wMCH3q6WR88pvB1\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 99468647d9a8dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3202,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (3202), with no line terminators","md5":"bd0ac1d89d687f5b903375bbe5bbac05","sha1":"aaae70ed2d0992acf4e967283c0d27497426e7d1","sha256":"b396d0eb86506ffe1e4fd0c1c06cd48e5b53e12711e495c8bfeadbeb7a54470b","sha512":"dd3f3c2d22df3a9d17db1daa3b0a33009885a159f88fb3619656de915032a3b9a4a5d986019d739cdb92508e7752be9d26d6edb308f957371e30250dfb98dc4b","ssdeep":"","tlshash":"f0618804f046f26b3133447e762dca6ea5096c07cbe16faafc6d7055540ea9b46f7124","first_seen":"2025-10-26T02:29:49.627486Z","last_seen":"2026-03-14T14:55:17.352492Z","times_seen":2,"resource_available":false,"data":null}},"time_used":190,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":190,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/dist/core-common.js?v=9a8c2087-9","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:11.043Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /dist/core-common.js?v=9a8c2087-9 HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:11 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nlast-modified: Tue, 30 May 2023 10:56:58 GMT\r\netag: \"cd97d8-5fce70ff1170b-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncache-control: max-age=15778463, immutable\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-cache-status: MISS\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fk8i1xt%2FvvhubFhOka%2FOtEj%2FMTxSfvhowAddzFYlb%2FeWRWVSMH3hE%2BqBT2%2FDWhj443sGTI437bGNhp4hMZhF243Og25OSZ9MR5c2\"}]}\r\ncf-ray: 99468647e9b0dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":13473752,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65466)","md5":"5aa355725a01c582e1b329abcb5cba81","sha1":"a95f7e76eeb159e685d5c6ddcb540abe8412c77c","sha256":"5757a970a7a61b4be83851ec3f24c70996ce2ad630398eb536f984d37d5c7038","sha512":"3e43988b9e1e4e27963faf14a2097dc57989fabf5f62f29404452741b5c902653f209fd81b7ed631450d34dab7fd4b9018d79cb5d8fa0b75846107e1eac9ec50","ssdeep":"12288:d/m2fgCKXtOetMSHpoSE4h9NH1JEKkVrH2nQUJe373S3e2cS7DKPXtr9nVJAOR2w:9mR1E4R1orHcQUJu1JAORbjMZQDv","tlshash":"a5352989b695706547a75261007f270bb33f7c58b4cdd858f22ac4c9b8a8e49d23bf78","first_seen":"2025-10-26T02:29:49.644672Z","last_seen":"2025-10-26T02:29:49.644672Z","times_seen":1,"resource_available":false,"data":null}},"time_used":627,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":205,"receive":422,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/dist/core-files_fileinfo.js?v=9a8c2087-9","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:11.045Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /dist/core-files_fileinfo.js?v=9a8c2087-9 HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:11 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nlast-modified: Tue, 30 May 2023 10:56:58 GMT\r\netag: \"3a0-5fce70ff0e82c-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncache-control: max-age=15778463, immutable\r\ncontent-length: 521\r\ncontent-type: application/javascript\r\ncf-cache-status: MISS\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lQcYHBegsoYxTMdoiVpGXiWcPHau6g1japndwUfpe8MlV9Hua2PnYYUBuuDKnR7HZGC7DcXYEGtVlIlv%2BuuyzOXrqhXiDskgizw1\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 99468647e9b2dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":928,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (780)","md5":"7c7bdc349e1bdb7494ca37540d06b7f8","sha1":"e56f3ad7e0623640211db61b521f33e7e7e62860","sha256":"1889e20598b510771e1c2c378ce8cc073fd2e1f6cdaa9c65a9031a68514d5e02","sha512":"db1d69058ccbd4c9a38df472ae9613817bb962053b40a6c7be23a07eb368ce2eadc164543c1b17cf9d4e860692dac958aac072d30bba0a9da6a407958866bba7","ssdeep":"","tlshash":"e51100d5f8d55c7e2c52b6586a1f0855522ee64b2249c83cf928cffe3c348056257f38","first_seen":"2023-03-07T22:58:00Z","last_seen":"2026-03-25T02:02:06.266157Z","times_seen":126,"resource_available":true,"data":null}},"time_used":170,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":170,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/dist/files_sharing-main.js?v=9a8c2087-9","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:11.050Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /dist/files_sharing-main.js?v=9a8c2087-9 HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:11 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nlast-modified: Tue, 30 May 2023 10:56:58 GMT\r\netag: \"18d-5fce70ff145eb-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncache-control: max-age=15778463, immutable\r\ncontent-length: 266\r\ncontent-type: application/javascript\r\ncf-cache-status: MISS\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=G36YbZ%2F88Tnkqfc2zqODqEBDriYiPm0GYvhfDbmSyWmDKokk5O%2BcMrrckEHj4ug6xF2xpWncJR3LcGvlLDwBvlbadF2zYCu20oOi\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 99468647e9b7dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":397,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"8381fa39881b5c908f8eeb853fa57d6b","sha1":"2ca28d40b3ecf96d458408534c6cc300fd98a652","sha256":"0f6fb7f6a8c4d59f1a9ba85d9d7926ac147c87629074d490c4cf65853bc7bf4a","sha512":"963e10598aca7c731ab4b841f783a432abbab2053df673b0e1ec3e18ba2e1cfc0518f5a9a8675d880bb83e0cf9d6eb5deb523926f649a79d3d030dfd4568ddcf","ssdeep":"","tlshash":"f6e0864ecb79fe1612530cba7062b38ba938584cf5f5736de8f475599c108428b4f523","first_seen":"2023-04-11T12:47:10Z","last_seen":"2026-03-25T02:02:06.234524Z","times_seen":201,"resource_available":true,"data":null}},"time_used":337,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":337,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/apps/files_rightclick/js/script.js?v=9a8c2087-9","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:11.052Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /apps/files_rightclick/js/script.js?v=9a8c2087-9 HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:11 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nlast-modified: Tue, 30 May 2023 10:56:58 GMT\r\netag: \"3a17-5fce70feb69fc-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncache-control: max-age=15778463, immutable\r\ncontent-length: 3219\r\ncontent-type: application/javascript\r\ncf-cache-status: MISS\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fRxTdr9TcFYoGXlMnNifBorphFUzJe7xwWi7od5AC10adlONVVAXdCYtIjQCzi2lHlsCwtMRnOZdvVfufg54aH0bcd6piwbUhhtQ\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 99468647f9b8dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14871,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"c96a8f5f25ef51f00b32b37b051fb4ce","sha1":"f117ec65e8387932c674908a30ab90d0a7f01eba","sha256":"2263fdb9b43029256cf21ee1a577e3d4cc91ae150949200c05733b19e1e15912","sha512":"8c3c49631b4fd6ef18957f48bd8cd1d20fc042b9f08b6618263650d74f24e6474ee3bc139fa89c70fd503285d04af411d70bccb7e3dbb05c99210c5fc8356e95","ssdeep":"192:zZ3YzAfqAxHXmsPTX2DNDYm9Ec/wdDtxOsuIciXk7saCvSINkPjoLf2K6C2LFUwO:ZYFamsbyiYsO/4L2kLezpUKaeXxGd","tlshash":"6562db5d29fb21a09267b0bd4fdfa0497b3481475009c928bd5c8bd8afc1038d6e6fb9","first_seen":"2023-03-07T01:06:52Z","last_seen":"2026-04-04T18:44:51.302381Z","times_seen":373,"resource_available":true,"data":null}},"time_used":184,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":184,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/dist/icons.css","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:11.234Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /dist/icons.css HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:11 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nlast-modified: Tue, 30 May 2023 10:56:58 GMT\r\netag: \"351b5-5fce70ff126ab-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncache-control: max-age=15778463\r\ncontent-length: 30980\r\ncontent-type: text/css\r\ncf-cache-status: MISS\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=j0mkS8K1VtIefZEBLLIUbut4lGWiZn9o9belN74iwg1rPdwoy%2B3hc3myXcVHf3rrxki09GVcNH%2Bp7jPMcquF3PSqFTFnfq9T%2Bl8V\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9946864939c3dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":217525,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1612)","md5":"6c81d6d63f4b621b149773c13c193bb0","sha1":"935b410913d71faa0f7b5bf92a37bfaba1781a42","sha256":"6d14d306a071132f38a470e9ed5fb23a8e445faca6a093d75fc925e35e804bf3","sha512":"33252ad4e38d43e74760705ceb6567c02b7f7897127f3272891e618c8872f15d7c3763b4a5debaf74f9063f2bc181c48fdca7ff1df6d3f8ea943162614e6ebbd","ssdeep":"3072:tyBrIu8hTfEDZzHZt2VzVVprnu83ain6aK:tyBr6fEDZeprnu83ain6aK","tlshash":"7424317b8d1d41b21b362737ab0f1d4c762ca252ccd7efd1a4f9458886a872a3056dbc","first_seen":"2023-04-11T07:37:44Z","last_seen":"2026-03-25T02:02:06.276104Z","times_seen":74,"resource_available":false,"data":null}},"time_used":210,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":164,"receive":46,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/apps/theming/theme/light-highcontrast.css?plain=1\u0026v=0ade7c2c","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:11.496Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /apps/theming/theme/light-highcontrast.css?plain=1\u0026v=0ade7c2c HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:11 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nexpires: Mon, 27 Oct 2025 02:29:11 +0000\r\ncache-control: private, max-age=86400, must-revalidate\r\npragma: private\r\ncontent-security-policy: default-src 'none';base-uri 'none';manifest-src 'self';frame-ancestors 'none'\r\nx-request-id: ckUN00dYWGrUoHOOGu4t\r\nfeature-policy: autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'\r\ncontent-disposition: inline; filename=\"\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 1084\r\ncontent-type: text/css;charset=UTF-8\r\ncf-cache-status: BYPASS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Bf8hj%2BVVW4NRECvLK4Iqm954FZ4wiGzawuwHjpGK13vYCIZK9maYBh0x4ze0BdrqXubK2zZOyM75LRUIPdvrm%2F1pUzHWsrgfIFGf\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9946864ac9cbdfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3312,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (3115)","md5":"f04c25a40cea93c5d6bd9ab30f00b360","sha1":"c83399bb32adff33302c36003892041ca9bb23d7","sha256":"4751482c516649c8ccc381375ed2eebd1efc986803d1223bc9ae646162265334","sha512":"de08e46c4712661e3946c0e9b1a4c78aba23a6f98b82f5d31e5427889248deac7ede3a18b22d80d2fa04686dee0efc23b34ebc3fa33a6bc53429bee4406f0183","ssdeep":"","tlshash":"a261a804f14af5bb7263443e722dea6ea5087c07c7d16faafcad7055940da8a46f3034","first_seen":"2025-10-26T02:29:49.649405Z","last_seen":"2026-03-14T14:55:17.365977Z","times_seen":2,"resource_available":false,"data":null}},"time_used":192,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":191,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/core/img/loading-dark.gif","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:13.085Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /core/img/loading-dark.gif HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:13 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nlast-modified: Tue, 30 May 2023 10:56:56 GMT\r\netag: \"124b-5fce70fd5619b\"\r\naccept-ranges: bytes\r\ncontent-length: 4683\r\ncache-control: max-age=15778463\r\ncontent-type: image/gif\r\ncf-cache-status: MISS\r\npriority: u=4,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=J287QEej5OldCDtRMEh9OyX6BI6Di5j615RNOn2SSe5f492nz9qLoJMM4TsAG9lKr7esq%2BGLUXepCewp3a6L%2BRVz07jgE178ywp6\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 99468654ca07dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4683,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 32 x 32","md5":"7446c22d8ed8b7b4641adc5dc30f39d2","sha1":"1ccb798de57db7a5d8996c3eac5ffc3c6b0c5147","sha256":"93b795ec06aebf7141dbfb46cf6fa51fb964d2a5c0646303eb135b38d007a0a9","sha512":"29626be8025ce603875905ad8c984b366a9e9b718aa44ab324e0016034e3fa38f4e235ba81630510f21bd4cb335799339fb12092f24546058c963e2cfc7caa34","ssdeep":"96:3jhK74OD5cPzXaA+8KYSlvZ5WKlYOuXQIf5f5rUgB:FK7/aPJcYSdZ5VDs5QgB","tlshash":"32a1f72da011aae3ded921f043548d6639f56cf12c69530a69ef39ca240b31d26d4e58","first_seen":"2023-05-01T19:33:17Z","last_seen":"2026-04-04T18:44:51.320904Z","times_seen":899,"resource_available":false,"data":null}},"time_used":160,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":160,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/core/css/server.css?v=9a8c2087-9","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:11.019Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /core/css/server.css?v=9a8c2087-9 HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:11 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nlast-modified: Tue, 30 May 2023 10:56:56 GMT\r\netag: \"25be9-5fce70fd39c80-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncache-control: max-age=15778463, immutable\r\ncontent-length: 25065\r\ncontent-type: text/css\r\ncf-cache-status: MISS\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0yEeKBEuNFa5Q9hT6aMsS1ecDV4%2F0uXUUKbs6Fevuf%2Fy560prHC%2FwGYgSmQ5ylqH6g43P79CxbCi77%2FJc2gYT%2FMGFhe7EI%2Fo7osd\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 99468647c9a3dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":154601,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (792)","md5":"78aed0cf354f0a00d075bfbbafedd3e4","sha1":"5dab868c0554492b9250ff5ec87a15fc3a98bd57","sha256":"20ef4302a186d998c9492211941ebace390fbe1750fd587f134abb80cec1f600","sha512":"fc486921714b90d3af039f2f3baa65722109d39d95d879aa11bd1595d36712918e117c5896a55569e8d14bef628f9c0ccd7e92f02b534490e4f8a2daa18f03e1","ssdeep":"1536:Les/i6hSrXjYz6WII5BIGXEAlTTAv7N3B8pa7q0T+m5ZQ4glpiq0y5BlvZh67CQB:RRzAcJXAv7Nxjqz5BFIdsPi","tlshash":"1ee398d50cf1b1312637c36ba68b6a50f73ac002d67aafba58db525c0fc5ed002b6758","first_seen":"2025-04-15T03:07:45.884037Z","last_seen":"2026-03-25T02:02:06.230245Z","times_seen":21,"resource_available":false,"data":null}},"time_used":222,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":214,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/apps/theming/favicon?v=0ade7c2c","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:13.955Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /apps/theming/favicon?v=0ade7c2c HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:14 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nexpires: Mon, 27 Oct 2025 02:29:14 +0000\r\ncache-control: private, max-age=86400, must-revalidate\r\npragma: private\r\ncontent-security-policy: default-src 'none';base-uri 'none';manifest-src 'self';frame-ancestors 'none'\r\nlast-modified: Thu, 01 Jun 2023 21:26:43 +0000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mHCAcsrE5KhRLRdCKEsReoligINPljS5GcEaYShPuPz8yAxNOs9ZfANECnep6eH2F0xfy5OeegJ7VoCci7XC9W3vJepXU3nApNjK\"}]}\r\nx-request-id: x0YlvHY8lyqDuIPtukBG\r\nfeature-policy: autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'\r\ncontent-disposition: inline; filename=\"favicon\"\r\ncontent-encoding: br\r\ncontent-type: image/x-icon\r\ncf-cache-status: DYNAMIC\r\npriority: u=6,i=?0\r\netag: W/\"c331b8c066ffb65e29fbe97789f58f9d\"\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9946865a3a6adfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":263797,"size_decoded":0,"mime_type":"image/x-icon","magic":"PNG image data, 1800 x 1800, 8-bit/color RGB, non-interlaced","md5":"5f21c662ed2317212f7e161942146737","sha1":"65a1f448082be1011ded89713aba9482c377cb4b","sha256":"4a77da55791087b2b62dfec9e2d0e58b1f0889dfb948c3ad18506c66bef7a3dc","sha512":"8675277c935beb2eec22185d65cb69bb5728d8a46c1190cf191faee21a5b943c9760dfc9d9c169986a7acc6330a812b55fc3305a6adbb71e440bc86ff7827265","ssdeep":"6144:+eJntuuY1hvVqh8lOwDQSJpNZJBYzq8Ni5DvLN:vtuuAhGXwQSJpDJsxNMF","tlshash":"d7441299bd47cebbf98873f54ca8641c39ba096c2250a39111df567afc34327d3a2d84","first_seen":"2025-10-26T02:29:49.634705Z","last_seen":"2026-03-14T14:55:17.344972Z","times_seen":2,"resource_available":false,"data":null}},"time_used":361,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":316,"receive":45,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/apps/files_rightclick/css/app.css?v=1bf6e69c-9","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:11.023Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /apps/files_rightclick/css/app.css?v=1bf6e69c-9 HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:11 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nlast-modified: Tue, 30 May 2023 10:56:58 GMT\r\netag: \"19c-5fce70feb893b-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncache-control: max-age=15778463, immutable\r\ncontent-length: 199\r\ncontent-type: text/css\r\ncf-cache-status: MISS\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BMJR0l5jKoCINZT6EYRbi5DkRzikYVppPWfHdH8DwyUbB2yPQiE%2Bd6nGQ%2F9AVnqrbN%2BexglTLZ0MNjwTDfqNt0HcX%2FbnbG%2BW%2BEJz\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 99468647c9a5dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":412,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"fdf5f4b9a2cf9214a61c17e5455f4f57","sha1":"cd2b0c8819d98513930bac4284ac16d9820a1a3c","sha256":"2d1f3b92d7591b69a06cb8bd6cda8e4d2fa4ed9ebb470488990780a2423d0bb7","sha512":"996492b95e5aff26cb790f04b03ea677fd40ea32df25c99959a54eaeb1604ea62964c3e8f78208a49daac3af3a7805b3f554fdef9bbeca53a098e7158a4726b3","ssdeep":"","tlshash":"54e06c61797b2450f01ed1576b75be24623900435b5bdc183a942614df5754195d1de0","first_seen":"2023-04-05T23:13:55Z","last_seen":"2026-04-04T18:44:51.335873Z","times_seen":246,"resource_available":false,"data":null}},"time_used":163,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":163,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/core/css/guest.css?v=9a8c2087-9","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:11.030Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /core/css/guest.css?v=9a8c2087-9 HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:11 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nlast-modified: Tue, 30 May 2023 10:56:56 GMT\r\netag: \"4aac-5fce70fd39c80-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncache-control: max-age=15778463, immutable\r\ncontent-length: 5308\r\ncontent-type: text/css\r\ncf-cache-status: MISS\r\npriority: u=2,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=k0jS1iptyO3KJ2ZyoLWuh4wzF4Wz8tQZftfHxDSYsP20JeNku%2BxFYOmJN%2FTZ%2BGL5KCN%2FHUBGMKSLg9zcYmb1p6ziarugjlBr%2BLT0\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 99468647d9a7dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19116,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (455)","md5":"45b020c365bd40ea058bec0771c16d84","sha1":"a119bf2f021a65f7600c15b02e51cbbff89108eb","sha256":"43f794c27ef65cfb79270d3eca9512e0b7e5646d41035b0d9055df3bcf99d5a6","sha512":"e05a06fc0f0e8b50dfe243f3b5a1c66441971c4474286b32ac5d00ec04e7f12c04a614437dd20ef7c86db544e9d3f83b4e9e6c64b20d77fb7f6cd30f37c99e3f","ssdeep":"384:KBg9gMVWzAJG7+EnScNCAg79HKK6pVUw51f:KBgSMpJG7+E9g79qFASf","tlshash":"7782a71a2590a5dda72781747f8d5a51eb1e40038e0f5dbbb62b787cc7d88d809b32cd","first_seen":"2023-04-11T07:37:44Z","last_seen":"2026-03-25T02:02:06.240497Z","times_seen":52,"resource_available":false,"data":null}},"time_used":164,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":163,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"nc.gpgxy.co/apps/files_rightclick/js/files.js?v=9a8c2087-9","fqdn":"nc.gpgxy.co","domain":"gpgxy.co","tld":"co"},"ip":{"addr":"104.21.20.2","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://nc.gpgxy.co/login","date":"2025-10-26T02:29:11.055Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gpgxy.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 29 Aug 2025 00:44:22 GMT","end":"Thu, 27 Nov 2025 00:55:45 GMT"},"fingerprint":{"sha1":"BF:9B:DD:D7:C3:A7:7B:BE:AF:3E:9C:6B:7F:0A:32:FE:7C:E7:12:1E","sha256":"62:8A:F8:8F:BF:98:86:2E:BE:30:7C:B6:CE:50:9B:2E:67:51:A1:F9:EA:40:4A:44:CF:39:A9:A8:5B:83:71:16"}}},"request":{"raw":"GET /apps/files_rightclick/js/files.js?v=9a8c2087-9 HTTP/1.1\r\nHost: nc.gpgxy.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: ocp09vj69pgl=gg338lu8agjd8thnqb43l16eqo; oc_sessionPassphrase=hTolVE4%2B1gPps5fSKcda7l9rBMWFltFeAHy%2BI2MavuCDB8pdH6Dbt13CRGxj%2FgR08pgUOyALX3IGYC2%2BZ2l3Rn21TjA%2BfFUfN%2By2%2F%2Fri0cvVLILsZ2o5rrNhInRcaPAm; __Host-nc_sameSiteCookielax=true; __Host-nc_sameSiteCookiestrict=true\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Sun, 26 Oct 2025 02:29:13 GMT\r\nserver: cloudflare\r\nreferrer-policy: no-referrer\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-robots-tag: noindex, nofollow\r\nx-xss-protection: 1; mode=block\r\nlast-modified: Tue, 30 May 2023 10:56:58 GMT\r\netag: \"12ca-5fce70feb69fc-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncache-control: max-age=15778463, immutable\r\ncontent-length: 1277\r\ncontent-type: application/javascript\r\ncf-cache-status: MISS\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5CBPflWLn4qmhMvMCVAe53csL4l3fgif5XXM81wvi3saBYMz3uhgRyQJ%2B403nLcLn47WUinCmdzE4v6jBpUjCLCUKFteDfx58TDh\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 99468647f9b9dfec-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4810,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"cd7269162464f076d1189acef259c10b","sha1":"5da8ea7dca1cf01016469028f146492c697335b4","sha256":"360179bd40e7186ac9d2fbc97ce8697c0544cda5d89c7c6ff90a58e12f66e8ad","sha512":"dc533e9458f54335fff36c77dad3a5498a0087bb7ff32fb9fc600506cd23d5211b69ebec81b4c50a3ca2693f7402db56fa51e5d91237606d4ca6f4fd1c5114bc","ssdeep":"96:vfIkSqw7N0Zb0i+0KBDgvue5aRJkck+KnBDVFyZCWLWeZw1Fhw5z:vftQ7OZ4itosvkJjZKBD+FLY1o5z","tlshash":"18a1dd693cf32ab094b730af17ef041972754227b108c921384f9b995fb2494e7d3a9d","first_seen":"2023-05-05T00:03:30Z","last_seen":"2026-03-14T14:55:17.372767Z","times_seen":28,"resource_available":true,"data":null}},"time_used":2341,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2340,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-10-26","alert":"Sinkholed","trigger":"nc.gpgxy.co","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}}]}